{"id":12091,"date":"2021-01-12T18:43:45","date_gmt":"2021-01-12T13:13:45","guid":{"rendered":"http:\/\/kalilinuxtutorials.com\/?p=12091"},"modified":"2021-01-12T18:43:45","modified_gmt":"2021-01-12T13:13:45","slug":"solarflare","status":"publish","type":"post","link":"https:\/\/kalilinuxtutorials.com\/solarflare\/","title":{"rendered":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility"},"content":{"rendered":"\n

Solarflare <\/strong>is a Credential Dumping Tool for SolarWinds Orion.<\/p>\n\n\n\n

============================================\n| Collecting RabbitMQ Erlang Cookie\n|       Erlang Cookie: abcdefg12456789abcde\n============================================\n| Collecting SolarWinds Certificate\n|       SolarWinds Orion Certificate Found!\n|       Subject Name: CN=SolarWinds-Orion\n|       Thumbprint  : BE85C6C3AACA8840E166187B6AB8C6BA9DA8DE80\n|       Password    : alcvabkajp4\n|       Private Key : MIIKHwIBAzCCCd8GCSqGSIb3DQEHAaCCCdAEggn<snip>\n============================================\n| Collecting Default.DAT file\n|       Encrypted: 01000000D08C9DDF0115D<snip>\n|       Decrypted: 5D3CE5B08C9201E636BCF<snip>\n============================================\n| Collecting Database Credentials          |\n|       Path to SWNetPerfMon.DB is: C:\\Program Files (x86)\\SolarWinds\\Orion\\SWNetPerfMon.DB\n|       Connection String: Server=(local)\\SOLARWINDS_ORION;Database=SolarWindsOrion;User ID=SolarWindsOrionDatabaseUser;Password=SUPERSECRETPASSWORDHERE\n|       Number of database credentials found: 1\n============================================\n| Connecting to the Database              |\n|       Successfully connected to: Server=(local)\\SOLARWINDS_ORION;Database=SolarWindsOrion;User ID=SolarWindsOrionDatabaseUser;MultipleActiveResultSets=true\n============================================\n| DB - Exporting Key Table                 |\n|       KeyID: 1\n|       Encrypted Key: LmjknGhSXTC<snip>\n|       Kind: Aes256\n|       Purpose: master\n|       Protection Type: 1\n|       Protection Value: BE85C6C3AACA8<snip>\n|       Protection Details: {}\n------------------------------------------------\n|       KeyID: 2\n|       Encrypted Key: \/\/pj6a4FaCyfv\/Rgs<snip>\n|       Kind: Aes256\n|       Purpose: oldcryptohelper\n|       Protection Type: 0\n|       Protection Value: 1\n|       Protection Details: {\"IV\":\"oj3JCT7Cft<snip>\"}\n============================================\n| DB - Exporting Accounts Table            |\n|        Account: _system\n|        Password Hash: qE9ClH<snip>\n|        Password Salt: XgtO8XNWc\/KiIdglGOnxvw==\n|        Hashcat Mode 12501: $solarwinds$1$XgtO8XNWc\/KiIdglGOnxvw==$qE9ClHDI<snip>\n|        Account Enabled: Y\n|        Allow Admin: Y\n|        Last Login: 12\/15\/2020\n--------------------------------------------\n|        Account: Admin\n|        Password Hash: IfAEwA7LXxOAH7ORCG0ZYeq<snip>\n|        Password Salt: jNhn3i2XtHfY8y4EOmNdiQ==\n|        Hashcat Mode 12501: $solarwinds$1$jNhn3i2XtHfY8y4EOmNdiQ==$IfAEwA7LXxOAH7ORCG0ZY<snip>\n|        Account Enabled: Y\n|        Allow Admin: Y\n|        Last Login: 12\/02\/2020\n--------------------------------------------\n|        Account: Guest\n|        Password Hash: Y\/EMuOWMNfCd<snip>\n|        Salt is NULL in DB so lowercase username is used: guest\n|        Hashcat Mode 12500: $solarwinds$0$guest$Y\/EMuOWMNfCd<snip>\n|        Account Enabled: N\n|        Allow Admin: N\n|        Last Login: 12\/30\/1899\n--------------------------------------------\n|        Account: iprequest\n|        Password Hash: 7zskGWFukuHuwQ<snip>\n|        Salt is NULL in DB so lowercase username is used: iprequest\n|        Hashcat Mode 12500: $solarwinds$0$iprequest$7zskGWFukuHuwQ<snip>\n|        Account Enabled: Y\n|        Allow Admin: N\n|        Last Login: 01\/01\/1900\n--------------------------------------------\n|        Account: SITTINGDUCK\\uberolduser\n|        Password: 11-417578424799297-9-6260697430795685763067724\n|        Decoded Password: ASDQWE123\n|        Hashcat Mode 21500: $solarwinds$0$admin$fF1lrlOXfxVz51Etjcs18XNK+Zt3keV2AllH9cYtGzdt5Yg2TtcsU84G9+5VVFMIUorR5eNJzX\/1kmef6wZfrg==\n|        Account Enabled: Y\n|        Allow Admin: N\n|        Last Login: 11\/15\/2015\n|        Account SID: S-1-5-21-1000000000-2000000000-3000000000-50000\n|        Group: SITTINGDUCK\\Domain Admins\n--------------------------------------------\n============================================\n| DB - Exporting Credentials Table         |\n------------------1--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: _system\n|       Desc: Cortex Integration\n|       Owner: CORE\n|               Password: 9dM-5pH\/&amp;Y(KU-v\n|               Username: _system\n------------------1--------------------------\n------------------2--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: JobEngine\n|       Desc: Job Engine router TCP endpoint credentials\n|       Owner: JobEngine\n|               Password: +fBByxJFsK+da6ZN2wKvLTKC\/PWUzFlfIvvwtW\/XqvA=\n|               Username: KWPPhiYJmE8+fRF6qlkxulK2tf3t79TQOAk1ywBMVOI=\n------------------2--------------------------\n------------------3--------------------------\n| Type: SolarWinds.Orion.Core.Models.Credentials.SnmpCredentialsV2\n| Name: public\n|       Desc:\n|       Owner: Orion\n|               Community: public\n------------------3--------------------------\n------------------4--------------------------\n| Type: SolarWinds.Orion.Core.Models.Credentials.SnmpCredentialsV2\n| Name: private\n|       Desc:\n|       Owner: Orion\n|               Community: private\n------------------4--------------------------\n------------------5--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: Erlang cookie\n|       Desc: Erlang clustering cookie\n|       Owner: Erlang\n|               Password: abcdefg12456789abcde\n|               Username: ignored\n------------------5--------------------------\n------------------6--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: RabbitMQ user account\n|       Desc: RabbitMQ user account for Message Bus\n|       Owner: RabbitMQ\n|               Password: LtVmCrzlTNyWmwxpxJMi\n|               Username: orion\n------------------6--------------------------\n------------------7--------------------------\n| Type: SolarWinds.Orion.Core.Models.Credentials.SnmpCredentialsV3\n| Name: User: snmpv3user, Context: thisisthecontext\n|       Desc:\n|       Owner: Orion\n|               AuthenticationKeyIsPassword: false\n|               AuthenticationPassword: ASDqwe123\n|               AuthenticationType: SHA1\n|               Context: thisisthecontext\n|               PrivacyKeyIsPassword: false\n|               PrivacyPassword: ASDqwe123\n|               PrivacyType: AES256\n|               UserName: snmpv3user\n------------------7--------------------------\n------------------8--------------------------\n| Type: SolarWinds.Orion.Core.Models.Credentials.SnmpCredentialsV3\n| Name: User: rootsnmpv3, Context: newcontextv3\n|       Desc:\n|       Owner: Orion\n|               AuthenticationKeyIsPassword: true\n|               AuthenticationPassword: ASDqwe123\n|               AuthenticationType: MD5\n|               Context: newcontextv3\n|               PrivacyKeyIsPassword: true\n|               PrivacyPassword: ASDqwe123\n|               PrivacyType: AES128\n|               UserName: rootsnmpv3\n------------------8--------------------------\n------------------9--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: DomainAdmin\n|       Desc:\n|       Owner: Orion\n|               Password: ASDqwe123\n|               Username: SITTINGDUCK\\uberuser\n------------------9--------------------------\n------------------10--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: DomainJoiner\n|       Desc:\n|       Owner: Orion\n|               Password: ASDqwe123\n|               Username: superadmin@sittingduck.info\n------------------10--------------------------\n------------------11--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.UsernamePasswordCredential\n| Name: vesxi\n|       Desc: vesxi\n|       Owner: VIM\n|               Password: ASDqwe123\n|               Username: root\n------------------11--------------------------\n------------------12--------------------------\n| Type: SolarWinds.Orion.Core.SharedCredentials.Credentials.ActiveDirectoryCredential\n| Name: SITTINGDUCK\\uberuser\n| \tDesc: \n| \tOwner: Orion\n| \t\tPassword: ASDqwe213\n| \t\tUsername: SITTINGDUCK\\uberuser\n------------------12--------------------------\n------------------13--------------------------\n| Type: SolarWinds.APM.Common.Credentials.ApmUsernamePasswordCredential\n| Name: App Monitoring User\n| \tDesc: \n| \tOwner: APM\n| \t\tPassword: ASDqwe123\n| \t\tUsername: SITTINGDUCK\\uberuser\n------------------13--------------------------\n------------------14--------------------------\n| Type: SolarWinds.SRM.Common.Credentials.SmisCredentials\n| Name: EMC_SMIS_Solarwinds\n| \tDesc: \n| \tOwner: SRM\n| \t\tHttpPort: 5988\n| \t\tHttpsPort: 5989\n| \t\tInteropNamespace: \/interop\n| \t\tNamespace: root\/emc\n| \t\tPassword: ASDqwe123\n| \t\tUsername: solarwinds\n| \t\tUseSSL: true\n------------------14--------------------------\n------------------15--------------------------\n| Type: SolarWinds.ESI.Common.Connection.ExternalSystemCredential\n| Name: ESC\n| \tDesc: \n| \tOwner: ESI\n| \t\tPassword: ASDqwe123\n| \t\tUsername: solar_winds\n------------------15--------------------------\n------------------16--------------------------\n| Type: SolarWinds.Orion.Web.Integration.OAuth2Token\n| Name: SITTINGDUCK\\uberuser\n| \tDesc: \n| \tOwner: Web.Integration\n| \t\tAccessToken: GthQHd3<snip>\n| \t\tAccessTokenExpiration: 2020-11-01T10:52:50.2768075Z\n| \t\tAccessTokenIssueDate: 2020-11-01T09:52:51.2768075Z\n| \t\tRefreshToken:hEyph9WqIfzm<snip>\n| \t\tScopes: \n| \t\tUsername: uberuser@sittingduck.info\n------------------16--------------------------\n------------------17--------------------------\n| Type: SolarWinds.SRM.Common.Credentials.XtremIoHttpCredential\n| Name: XtremIO_Admin\n| \tDesc: \n| \tOwner: SRM\n| \t\tHttpPort: 80\n| \t\tHttpsPort: 443\n| \t\tPassword: ASDqwe123\n| \t\tUsername: admin\n| \t\tUseSsl: true\n------------------18--------------------------\n============================================\n============================================<\/code><\/pre>\n\n\n\n
Credit :<\/strong> @asolino<\/a>, @gentilkiwi<\/a>, and @skelsec<\/a> for helping me figuring out DPAPI.<\/p>\n\n\n\n
\n
Download<\/strong><\/a><\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"
Solarflare is a Credential Dumping Tool for SolarWinds Orion. Credit : @asolino, @gentilkiwi, and @skelsec for helping me figuring out DPAPI.<\/p>\n","protected":false},"author":4,"featured_media":16658,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","fifu_image_alt":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[28],"tags":[980,2354,3178,3179],"class_list":["post-12091","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-kali","tag-dumping-utility","tag-orion","tag-solarflare","tag-solarwinds"],"yoast_head":"\nSolarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility<\/title>\n<meta name=\"description\" content=\"Solarflare is a Credential Dumping Tool for SolarWinds Orion.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/kalilinuxtutorials.com\/solarflare\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility\" \/>\n<meta property=\"og:description\" content=\"Solarflare is a Credential Dumping Tool for SolarWinds Orion.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/kalilinuxtutorials.com\/solarflare\/\" \/>\n<meta property=\"og:site_name\" content=\"Kali Linux Tutorials\" \/>\n<meta property=\"article:published_time\" content=\"2021-01-12T13:13:45+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\" \/>\n<meta name=\"author\" content=\"R K\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\" \/>\n<meta name=\"twitter:creator\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:site\" content=\"@CyberEdition\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"R K\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"4 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/\"},\"author\":{\"name\":\"R K\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\"},\"headline\":\"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility\",\"datePublished\":\"2021-01-12T13:13:45+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/\"},\"wordCount\":29,\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\",\"keywords\":[\"Dumping Utility\",\"Orion\",\"Solarflare\",\"SolarWinds\"],\"articleSection\":[\"Kali Linux\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/\",\"name\":\"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility\",\"isPartOf\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\",\"datePublished\":\"2021-01-12T13:13:45+00:00\",\"description\":\"Solarflare is a Credential Dumping Tool for SolarWinds Orion.\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/kalilinuxtutorials.com\/solarflare\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage\",\"url\":\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\",\"contentUrl\":\"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png\"},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#website\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"name\":\"Kali Linux Tutorials\",\"description\":\"Kali Linux Tutorials\",\"publisher\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#organization\",\"name\":\"Kali Linux Tutorials\",\"url\":\"https:\/\/kalilinuxtutorials.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"contentUrl\":\"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png\",\"width\":272,\"height\":90,\"caption\":\"Kali Linux Tutorials\"},\"image\":{\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/x.com\/CyberEdition\",\"https:\/\/www.threads.com\/@cybersecurityedition\",\"https:\/\/www.linkedin.com\/company\/cyberedition\",\"https:\/\/www.instagram.com\/cybersecurityedition\/\"]},{\"@type\":\"Person\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad\",\"name\":\"R K\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g\",\"caption\":\"R K\"},\"url\":\"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility","description":"Solarflare is a Credential Dumping Tool for SolarWinds Orion.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/kalilinuxtutorials.com\/solarflare\/","og_locale":"en_US","og_type":"article","og_title":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility","og_description":"Solarflare is a Credential Dumping Tool for SolarWinds Orion.","og_url":"https:\/\/kalilinuxtutorials.com\/solarflare\/","og_site_name":"Kali Linux Tutorials","article_published_time":"2021-01-12T13:13:45+00:00","og_image":[{"url":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","type":"","width":"","height":""}],"author":"R K","twitter_card":"summary_large_image","twitter_image":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","twitter_creator":"@CyberEdition","twitter_site":"@CyberEdition","twitter_misc":{"Written by":"R K","Est. reading time":"4 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/#article","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/"},"author":{"name":"R K","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad"},"headline":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility","datePublished":"2021-01-12T13:13:45+00:00","mainEntityOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/"},"wordCount":29,"publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","keywords":["Dumping Utility","Orion","Solarflare","SolarWinds"],"articleSection":["Kali Linux"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/","url":"https:\/\/kalilinuxtutorials.com\/solarflare\/","name":"Solarflare : SolarWinds Orion Account Audit \/ Password Dumping Utility","isPartOf":{"@id":"https:\/\/kalilinuxtutorials.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage"},"thumbnailUrl":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","datePublished":"2021-01-12T13:13:45+00:00","description":"Solarflare is a Credential Dumping Tool for SolarWinds Orion.","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/kalilinuxtutorials.com\/solarflare\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/solarflare\/#primaryimage","url":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","contentUrl":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png"},{"@type":"WebSite","@id":"https:\/\/kalilinuxtutorials.com\/#website","url":"https:\/\/kalilinuxtutorials.com\/","name":"Kali Linux Tutorials","description":"Kali Linux Tutorials","publisher":{"@id":"https:\/\/kalilinuxtutorials.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/kalilinuxtutorials.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/kalilinuxtutorials.com\/#organization","name":"Kali Linux Tutorials","url":"https:\/\/kalilinuxtutorials.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/","url":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","contentUrl":"https:\/\/kalilinuxtutorials.com\/wp-content\/uploads\/2025\/07\/Kali.png","width":272,"height":90,"caption":"Kali Linux Tutorials"},"image":{"@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/CyberEdition","https:\/\/www.threads.com\/@cybersecurityedition","https:\/\/www.linkedin.com\/company\/cyberedition","https:\/\/www.instagram.com\/cybersecurityedition\/"]},{"@type":"Person","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/69444b58b9e267a4cf08fceb34b6f6ad","name":"R K","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/kalilinuxtutorials.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d3937c9687f2da11bc0a716404ff91779fe19ca115208dbf66167ad353aca5aa?s=96&d=mm&r=g","caption":"R K"},"url":"https:\/\/kalilinuxtutorials.com\/author\/ranjith\/"}]}},"jetpack_featured_media_url":"https:\/\/1.bp.blogspot.com\/-_wzTU9s44vE\/X_yViTGVKUI\/AAAAAAAAITw\/9wg_uC2xhzw4RmzYOy8DEj-vgN2ffpDIQCLcBGAsYHQ\/s728\/Solarflare%25281%2529.png","jetpack_sharing_enabled":true,"jetpack-related-posts":[{"id":6151,"url":"https:\/\/kalilinuxtutorials.com\/badministration-management-administration-applications\/","url_meta":{"origin":12091,"position":0},"title":"BADministration : Tool Which Interfaces with Management or Administration Applications","author":"R K","date":"August 11, 2019","format":false,"excerpt":"BADministration is a tool which interfaces with management or administration applications from an offensive standpoint. It attempts to provide offsec personnel a tool with the ability to identify and leverage these non-technical vulnerabilities. As always: use for good, promote security, and fight application propagation. Sorry for using python2.7, I found\u2026","rel":"","context":"In "Kali Linux"","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]},{"id":26992,"url":"https:\/\/kalilinuxtutorials.com\/top-ip-management-softwares-in-2022\/","url_meta":{"origin":12091,"position":1},"title":"Top IP Management Softwares in 2022","author":"Kaladmin","date":"September 1, 2022","format":false,"excerpt":"Businesses have been getting more and more digitalized. This is great, but rapid digitization has made it difficult for businesses to track, manage, and retain big databases of devices and networks. Especially small businesses still struggle with a lack of accessible and trustworthy IP address management technology. There have been\u2026","rel":"","context":"Similar post","block_context":{"text":"Similar post","link":""},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP7_vMEBUdAZTkEbkNKZbmZdTX3VMs648BIyAUViz5YMPt57A8KPGgHWNb_0Z9tkVwWYRLSegIj0vLRn-tyMUdYaXV_IZnfAYRm8spwkeMpJhC7HMCq0lwLlj76_eI6yOwtxNtG6hCMzHEyBPkzg77o_AXRrx6L03nt6m63OZhcPfenxVFt8oQHVWBRQ\/s16000\/ips%20amnages.PNG?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP7_vMEBUdAZTkEbkNKZbmZdTX3VMs648BIyAUViz5YMPt57A8KPGgHWNb_0Z9tkVwWYRLSegIj0vLRn-tyMUdYaXV_IZnfAYRm8spwkeMpJhC7HMCq0lwLlj76_eI6yOwtxNtG6hCMzHEyBPkzg77o_AXRrx6L03nt6m63OZhcPfenxVFt8oQHVWBRQ\/s16000\/ips%20amnages.PNG?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP7_vMEBUdAZTkEbkNKZbmZdTX3VMs648BIyAUViz5YMPt57A8KPGgHWNb_0Z9tkVwWYRLSegIj0vLRn-tyMUdYaXV_IZnfAYRm8spwkeMpJhC7HMCq0lwLlj76_eI6yOwtxNtG6hCMzHEyBPkzg77o_AXRrx6L03nt6m63OZhcPfenxVFt8oQHVWBRQ\/s16000\/ips%20amnages.PNG?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP7_vMEBUdAZTkEbkNKZbmZdTX3VMs648BIyAUViz5YMPt57A8KPGgHWNb_0Z9tkVwWYRLSegIj0vLRn-tyMUdYaXV_IZnfAYRm8spwkeMpJhC7HMCq0lwLlj76_eI6yOwtxNtG6hCMzHEyBPkzg77o_AXRrx6L03nt6m63OZhcPfenxVFt8oQHVWBRQ\/s16000\/ips%20amnages.PNG?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":28483,"url":"https:\/\/kalilinuxtutorials.com\/aws-security-assessment-solution\/","url_meta":{"origin":12091,"position":2},"title":"Aws-Security-Assessment-Solution – An AWS Tool To Help You Create A Point In Time Assessment Of Your AWS Account","author":"R K","date":"February 27, 2023","format":false,"excerpt":"Aws-Security-Assessment-Solution is an AWS tool to help you create a point in time assessment of your AWS account using Prowler and Scout as well as optional AWS developed ransomware checks. Self-Service Security Assessment tool Cybersecurity remains a very important topic and point of concern for many CIOs, CISOs, and their\u2026","rel":"","context":"In "Kali Linux"","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjZ0nQsIL_s_ZnnKVybCJXiCm8-RzDv_WEJtda_lcYjzkWAVmiy2pNgRkBmpnvWMBrB7NncN9S-EySg4vIn_oGM70__Weo4veSsXNkulP5p3jbBSUDnPappnTIEdbR4WaPm8tgfaRxutc5md1Sstv6J832iuM-B4P5ZwAzRKjxbEtnXOGa3mryJrs1p\/s16000\/aws-security-.png?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjZ0nQsIL_s_ZnnKVybCJXiCm8-RzDv_WEJtda_lcYjzkWAVmiy2pNgRkBmpnvWMBrB7NncN9S-EySg4vIn_oGM70__Weo4veSsXNkulP5p3jbBSUDnPappnTIEdbR4WaPm8tgfaRxutc5md1Sstv6J832iuM-B4P5ZwAzRKjxbEtnXOGa3mryJrs1p\/s16000\/aws-security-.png?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjZ0nQsIL_s_ZnnKVybCJXiCm8-RzDv_WEJtda_lcYjzkWAVmiy2pNgRkBmpnvWMBrB7NncN9S-EySg4vIn_oGM70__Weo4veSsXNkulP5p3jbBSUDnPappnTIEdbR4WaPm8tgfaRxutc5md1Sstv6J832iuM-B4P5ZwAzRKjxbEtnXOGa3mryJrs1p\/s16000\/aws-security-.png?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjZ0nQsIL_s_ZnnKVybCJXiCm8-RzDv_WEJtda_lcYjzkWAVmiy2pNgRkBmpnvWMBrB7NncN9S-EySg4vIn_oGM70__Weo4veSsXNkulP5p3jbBSUDnPappnTIEdbR4WaPm8tgfaRxutc5md1Sstv6J832iuM-B4P5ZwAzRKjxbEtnXOGa3mryJrs1p\/s16000\/aws-security-.png?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":31162,"url":"https:\/\/kalilinuxtutorials.com\/poc-for-dumping-and-decrypting-cookies-in-the-latest-version-of-microsoft-teams\/","url_meta":{"origin":12091,"position":3},"title":"PoC For Dumping And Decrypting Cookies In The Latest Version Of Microsoft Teams","author":"Varshini","date":"November 6, 2023","format":false,"excerpt":"In the realm of cybersecurity, understanding the intricacies of cookie management and security is paramount. In this article, we delve into a Proof of Concept (PoC) for extracting and decrypting cookies from the latest version of Microsoft Teams. By unraveling the secrets hidden within these cookies, we uncover valuable insights\u2026","rel":"","context":"In "Cyber security"","block_context":{"text":"Cyber security","link":"https:\/\/kalilinuxtutorials.com\/category\/cyber-security\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi-ZCTJ_XWfGefnjvQH3hgBZL3c7Sq0NVR_avJ-GHnhh1l7yzQGhz_T5tuaSKPtSMGItw6SgJ0widWerMgGGHmCeMLc-w_XlcsIeyuwizaCG0Z18s1hSCo0lB0j9Hw8mXYco5JspchIOjDXUdw13tjpwuPKNRWy-FV32vz6NXlt_-51tsTEnaQk5eX_Y-eD\/s16000\/Data-Encryption-Descryption-1024x631.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi-ZCTJ_XWfGefnjvQH3hgBZL3c7Sq0NVR_avJ-GHnhh1l7yzQGhz_T5tuaSKPtSMGItw6SgJ0widWerMgGGHmCeMLc-w_XlcsIeyuwizaCG0Z18s1hSCo0lB0j9Hw8mXYco5JspchIOjDXUdw13tjpwuPKNRWy-FV32vz6NXlt_-51tsTEnaQk5eX_Y-eD\/s16000\/Data-Encryption-Descryption-1024x631.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi-ZCTJ_XWfGefnjvQH3hgBZL3c7Sq0NVR_avJ-GHnhh1l7yzQGhz_T5tuaSKPtSMGItw6SgJ0widWerMgGGHmCeMLc-w_XlcsIeyuwizaCG0Z18s1hSCo0lB0j9Hw8mXYco5JspchIOjDXUdw13tjpwuPKNRWy-FV32vz6NXlt_-51tsTEnaQk5eX_Y-eD\/s16000\/Data-Encryption-Descryption-1024x631.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi-ZCTJ_XWfGefnjvQH3hgBZL3c7Sq0NVR_avJ-GHnhh1l7yzQGhz_T5tuaSKPtSMGItw6SgJ0widWerMgGGHmCeMLc-w_XlcsIeyuwizaCG0Z18s1hSCo0lB0j9Hw8mXYco5JspchIOjDXUdw13tjpwuPKNRWy-FV32vz6NXlt_-51tsTEnaQk5eX_Y-eD\/s16000\/Data-Encryption-Descryption-1024x631.webp?resize=700%2C400&ssl=1 2x"},"classes":[]},{"id":34939,"url":"https:\/\/kalilinuxtutorials.com\/globalunprotect\/","url_meta":{"origin":12091,"position":4},"title":"GlobalUnProtect – Decrypting And Harvesting Sensitive Data From GlobalProtect Installations","author":"Varshini","date":"September 23, 2024","format":false,"excerpt":"PoC tool for decrypting and collecting GlobalProtect configuration, cookies, and HIP files from windows client installations. Usage Run as standalone or in-memory via execute-assembly or equivalent. Collects all contents to an in-memory zip and writes to specified location. > GlobalUnProtect.exe Usage: GlobalUnProtect.exe C:\\Path\\To\\Output.zip > GlobalUnProtect.exe %TEMP%\\GPUnprotect.zip [*] Deriving AES key\u2026","rel":"","context":"In "Post Exploitation"","block_context":{"text":"Post Exploitation","link":"https:\/\/kalilinuxtutorials.com\/category\/pe\/"},"img":{"alt_text":"","src":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=350%2C200&ssl=1","width":350,"height":200,"srcset":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=350%2C200&ssl=1 1x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=525%2C300&ssl=1 1.5x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=700%2C400&ssl=1 2x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=1050%2C600&ssl=1 3x, https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhUowVEBKbQXuJIDlt2onsZw_FVAol5yC8hk_whMkUwN_j_uPlnTwdv1B09EN2NOKodSsHirVqxfhp5ofwt9Dg80WagxTjDrY_rYl98yqqoo59ZJ95HZRMBqZhsOsEHZB3Bi7AU0DwYTt2aiKTL8Xtsrc1jbtpuJ_YHV0ux-x3hekZWArwr4RGuCIPOiQ9g\/s1600\/GlobalUnProtect%20.webp?resize=1400%2C800&ssl=1 4x"},"classes":[]},{"id":11230,"url":"https:\/\/kalilinuxtutorials.com\/chalumeau\/","url_meta":{"origin":12091,"position":5},"title":"Chalumeau : Automated, Extendable & Customizable Credential Dumping Tool","author":"R K","date":"August 14, 2020","format":false,"excerpt":"Chalumeau is automated,extendable and customizable credential dumping tool based on powershell and python. Main Features Write your own PayloadsIn-Memory executionExtract Password ListDashboard reporting \/ Web InterfaceParsing MimikatzDumping Tickets Known Issues Parsing Mimikatz dcsync (working on fix)Bypassing Antivirus and EDRs , you will need to maintain your payloads To Do Encrypted\u2026","rel":"","context":"In "Kali Linux"","block_context":{"text":"Kali Linux","link":"https:\/\/kalilinuxtutorials.com\/category\/kali\/"},"img":{"alt_text":"","src":"","width":0,"height":0},"classes":[]}],"_links":{"self":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/12091","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/comments?post=12091"}],"version-history":[{"count":0,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/posts\/12091\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media\/16658"}],"wp:attachment":[{"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/media?parent=12091"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/categories?post=12091"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/kalilinuxtutorials.com\/wp-json\/wp\/v2\/tags?post=12091"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}