From a1ece11afae1407605cb189ca69d49f2e2f0833b Mon Sep 17 00:00:00 2001 From: Sergio Date: Fri, 2 Oct 2020 12:38:41 +0100 Subject: [PATCH 1/6] Adding SharpSecDump as new submodule --- .gitmodules | 3 +++ Covenant/Data/ReferenceSourceLibraries/SharpSecDump | 1 + 2 files changed, 4 insertions(+) create mode 160000 Covenant/Data/ReferenceSourceLibraries/SharpSecDump diff --git a/.gitmodules b/.gitmodules index 6debcc64..6d29f8a3 100644 --- a/.gitmodules +++ b/.gitmodules @@ -30,3 +30,6 @@ path = Covenant/Data/ReferenceSourceLibraries/SharpSC url = https://github.com/djhohnstein/SharpSC ignore = dirty +[submodule "Covenant/Data/ReferenceSourceLibraries/SharpSecDump"] + path = Covenant/Data/ReferenceSourceLibraries/SharpSecDump + url = https://github.com/G0ldenGunSec/SharpSecDump.git diff --git a/Covenant/Data/ReferenceSourceLibraries/SharpSecDump b/Covenant/Data/ReferenceSourceLibraries/SharpSecDump new file mode 160000 index 00000000..ef246368 --- /dev/null +++ b/Covenant/Data/ReferenceSourceLibraries/SharpSecDump @@ -0,0 +1 @@ +Subproject commit ef2463688e405fad0fabb001b3d8869db51da0e0 From cf58535c383cfd7fb8a1edbd61d784cb99c708c0 Mon Sep 17 00:00:00 2001 From: Sergio Date: Sat, 3 Oct 2020 10:20:00 +0100 Subject: [PATCH 2/6] SharpSecDump task added --- Covenant/Data/Tasks/SharpSecDump.yml | 72 ++++++++++++++++++++++++++++ 1 file changed, 72 insertions(+) create mode 100644 Covenant/Data/Tasks/SharpSecDump.yml diff --git a/Covenant/Data/Tasks/SharpSecDump.yml b/Covenant/Data/Tasks/SharpSecDump.yml new file mode 100644 index 00000000..64f336dd --- /dev/null +++ b/Covenant/Data/Tasks/SharpSecDump.yml @@ -0,0 +1,72 @@ +- Name: SharpSecDump + Aliases: [] + Author: + Name: Sergio Lazaro + Handle: slazar0 + Link: '' + Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py + Help: + Language: CSharp + CompatibleDotNetVersions: + - Net40 + Code: "using System;\nusing System.IO;\n\nusing SharpSecDump;\n\npublic static class Task\n{\n public static Stream OutputStream { get; set; }\n public static string Execute(string Target, string Username, string Password, string Domain)\n {\n string output = \"\";\n try\n {\n TextWriter realStdOut = Console.Out;\n TextWriter realStdErr = Console.Error;\n TextWriter stdOutWriter = new StreamWriter(OutputStream);\n TextWriter stdErrWriter = new StreamWriter(OutputStream);\n Console.SetOut(stdOutWriter);\n Console.SetError(stdErrWriter);\n \n try\n { \n String[] args = new string[0];\n if (Username != \"\" && Password != \"\" && Domain != \"\")\n {\n args = new string[4];\n args[0] = Target;\n args[1] = Username;\n args[2] = Password;\n args[3] = Domain;\n }\n else\n {\n args = new string[1];\n args[0] = Target;\n }\n RegQueryValueDemo.Main(args);\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\n[!] Unhandled SharpSecDump exception:\\r\\n\");\n Console.WriteLine(e);\n }\n \n Console.Out.Flush();\n Console.Error.Flush();\n Console.SetOut(realStdOut);\n Console.SetError(realStdErr);\n OutputStream.Close();\n }\n catch (Exception e) { output += e.GetType().FullName + \": \" + e.Message + Environment.NewLine + e.StackTrace; }\n return output;\n }\n}" + TaskingType: Assembly + UnsafeCompile: false + TokenTask: false + Options: + - Name: Target + Value: '' + DefaultValue: '' + Description: Target of SharpSecDump + SuggestedValues: + - -target= + Optional: false + DisplayInCommand: true + FileOption: false + - Name: Username + Value: '' + DefaultValue: '' + Description: Username + SuggestedValues: + - -u= + Optional: true + DisplayInCommand: true + FileOption: false + - Name: Password + Value: '' + DefaultValue: '' + Description: Password + SuggestedValues: + - -p= + Optional: true + DisplayInCommand: true + FileOption: false + - Name: Domain + Value: '' + DefaultValue: '' + Description: Domain + SuggestedValues: + - -d= + Optional: true + DisplayInCommand: true + FileOption: false + ReferenceSourceLibraries: + - Name: SharpSecDump + Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump + Location: SharpSecDump/ + Language: CSharp + CompatibleDotNetVersions: + - Net40 + ReferenceAssemblies: + - Name: mscorlib.dll + Location: net40/mscorlib.dll + DotNetVersion: Net40 + - Name: System.dll + Location: net40/System.dll + DotNetVersion: Net40 + - Name: System.Core.dll + Location: net40/System.Core.dll + DotNetVersion: Net40 + EmbeddedResources: [] + ReferenceAssemblies: [] + EmbeddedResources: [] From 73b98c87ce2f4ed2f2e6972bd8b7db626a4612df Mon Sep 17 00:00:00 2001 From: Sergio Date: Sat, 3 Oct 2020 10:24:59 +0100 Subject: [PATCH 3/6] SharpSecDump DbInitializer update --- Covenant/Core/DbInitializer.cs | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-) diff --git a/Covenant/Core/DbInitializer.cs b/Covenant/Core/DbInitializer.cs index 95cccf18..b54ff9a5 100644 --- a/Covenant/Core/DbInitializer.cs +++ b/Covenant/Core/DbInitializer.cs @@ -259,6 +259,12 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte Name = "SharpSC", Description = "SharpSC is a .NET assembly to perform basic operations with services.", Location= "SharpSC" + Path.DirectorySeparatorChar, CompatibleDotNetVersions = new List { Common.DotNetVersion.Net35, Common.DotNetVersion.Net40 } + }, + new ReferenceSourceLibrary + { + Name = "SharpSecDump", Description = "SharpSecDump is a .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py.", + Location= "SharpSecDump" + Path.DirectorySeparatorChar, + CompatibleDotNetVersions = new List { Common.DotNetVersion.Net40 } } }; await service.CreateReferenceSourceLibraries(ReferenceSourceLibraries); @@ -272,6 +278,7 @@ public async static Task InitializeTasks(ICovenantService service, CovenantConte var su = await service.GetReferenceSourceLibraryByName("SharpUp"); var sw = await service.GetReferenceSourceLibraryByName("SharpWMI"); var sc = await service.GetReferenceSourceLibraryByName("SharpSC"); + var ssd = await service.GetReferenceSourceLibraryByName("SharpSecDump"); await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ss, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, @@ -391,7 +398,11 @@ await service.CreateEntities( new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net35) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) }, new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net35) }, - new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) } + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = sc, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.ServiceProcess.dll", Common.DotNetVersion.Net40) }, + + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("mscorlib.dll", Common.DotNetVersion.Net40) }, + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.dll", Common.DotNetVersion.Net40) }, + new ReferenceSourceLibraryReferenceAssembly { ReferenceSourceLibrary = ssd, ReferenceAssembly = await service.GetReferenceAssemblyByName("System.Core.dll", Common.DotNetVersion.Net40) } ); } #endregion From e7b4cf7430c2ba9122d9a5483f21220f8eddf537 Mon Sep 17 00:00:00 2001 From: Sergio Date: Sat, 3 Oct 2020 10:53:14 +0100 Subject: [PATCH 4/6] SharpSecDump task updated --- Covenant/Data/Tasks/SharpSecDump.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Covenant/Data/Tasks/SharpSecDump.yml b/Covenant/Data/Tasks/SharpSecDump.yml index 64f336dd..a55eb844 100644 --- a/Covenant/Data/Tasks/SharpSecDump.yml +++ b/Covenant/Data/Tasks/SharpSecDump.yml @@ -1,8 +1,8 @@ - Name: SharpSecDump Aliases: [] Author: - Name: Sergio Lazaro - Handle: slazar0 + Name: 'Sergio Lázaro, Daniel López & Simone Salucci' + Handle: '@Slazar0, @attl4s, @saim1z' Link: '' Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py Help: From 3e29c1bc4c5cc02e69350f92767cd72cee9f0c69 Mon Sep 17 00:00:00 2001 From: Sergio Date: Sat, 3 Oct 2020 11:20:06 +0100 Subject: [PATCH 5/6] SharpSecDump task fix --- Covenant/Data/Tasks/{SharpSecDump.yml => SharpSecDump.yaml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename Covenant/Data/Tasks/{SharpSecDump.yml => SharpSecDump.yaml} (100%) diff --git a/Covenant/Data/Tasks/SharpSecDump.yml b/Covenant/Data/Tasks/SharpSecDump.yaml similarity index 100% rename from Covenant/Data/Tasks/SharpSecDump.yml rename to Covenant/Data/Tasks/SharpSecDump.yaml From 815a608a3a49890e5fc2935429127ccc502ad4a7 Mon Sep 17 00:00:00 2001 From: Sergio Date: Sat, 3 Oct 2020 13:10:21 +0100 Subject: [PATCH 6/6] SharpSecDump task update to improve parameter handling --- Covenant/Data/Tasks/SharpSecDump.yaml | 18 +++++++----------- 1 file changed, 7 insertions(+), 11 deletions(-) diff --git a/Covenant/Data/Tasks/SharpSecDump.yaml b/Covenant/Data/Tasks/SharpSecDump.yaml index a55eb844..73e742ae 100644 --- a/Covenant/Data/Tasks/SharpSecDump.yaml +++ b/Covenant/Data/Tasks/SharpSecDump.yaml @@ -1,7 +1,7 @@ - Name: SharpSecDump Aliases: [] Author: - Name: 'Sergio Lázaro, Daniel López & Simone Salucci' + Name: Sergio Lázaro, Daniel López & Simone Salucci Handle: '@Slazar0, @attl4s, @saim1z' Link: '' Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py @@ -9,7 +9,7 @@ Language: CSharp CompatibleDotNetVersions: - Net40 - Code: "using System;\nusing System.IO;\n\nusing SharpSecDump;\n\npublic static class Task\n{\n public static Stream OutputStream { get; set; }\n public static string Execute(string Target, string Username, string Password, string Domain)\n {\n string output = \"\";\n try\n {\n TextWriter realStdOut = Console.Out;\n TextWriter realStdErr = Console.Error;\n TextWriter stdOutWriter = new StreamWriter(OutputStream);\n TextWriter stdErrWriter = new StreamWriter(OutputStream);\n Console.SetOut(stdOutWriter);\n Console.SetError(stdErrWriter);\n \n try\n { \n String[] args = new string[0];\n if (Username != \"\" && Password != \"\" && Domain != \"\")\n {\n args = new string[4];\n args[0] = Target;\n args[1] = Username;\n args[2] = Password;\n args[3] = Domain;\n }\n else\n {\n args = new string[1];\n args[0] = Target;\n }\n RegQueryValueDemo.Main(args);\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\n[!] Unhandled SharpSecDump exception:\\r\\n\");\n Console.WriteLine(e);\n }\n \n Console.Out.Flush();\n Console.Error.Flush();\n Console.SetOut(realStdOut);\n Console.SetError(realStdErr);\n OutputStream.Close();\n }\n catch (Exception e) { output += e.GetType().FullName + \": \" + e.Message + Environment.NewLine + e.StackTrace; }\n return output;\n }\n}" + Code: "using System;\nusing System.IO;\n\nusing SharpSecDump;\n\npublic static class Task\n{\n public static Stream OutputStream { get; set; }\n public static string Execute(string Target, string Username, string Password, string Domain)\n {\n string output = \"\";\n try\n {\n TextWriter realStdOut = Console.Out;\n TextWriter realStdErr = Console.Error;\n TextWriter stdOutWriter = new StreamWriter(OutputStream);\n TextWriter stdErrWriter = new StreamWriter(OutputStream);\n Console.SetOut(stdOutWriter);\n Console.SetError(stdErrWriter);\n \n try\n { \n if (Target != \"\")\n {\n String[] args = new string[0];\n if (Username != \"\" && Password != \"\" && Domain != \"\")\n {\n args = new string[4];\n args[0] = \"-target=\" + Target;\n args[1] = \"-u=\" + Username;\n args[2] = \"-p=\" + Password;\n args[3] = \"-d=\" + Domain;\n }\n else\n {\n args = new string[1];\n args[0] = \"-target=\" + Target;\n }\n RegQueryValueDemo.Main(args);\n }\n else{\n Console.WriteLine(\"\\r\\n[!] SharpSecDump [username] [password] [domain]\\r\\n\");\n }\n }\n catch (Exception e)\n {\n Console.WriteLine(\"\\r\\n[!] Unhandled SharpSecDump exception:\\r\\n\");\n Console.WriteLine(e);\n }\n \n Console.Out.Flush();\n Console.Error.Flush();\n Console.SetOut(realStdOut);\n Console.SetError(realStdErr);\n OutputStream.Close();\n }\n catch (Exception e) { output += e.GetType().FullName + \": \" + e.Message + Environment.NewLine + e.StackTrace; }\n return output;\n }\n}" TaskingType: Assembly UnsafeCompile: false TokenTask: false @@ -18,8 +18,7 @@ Value: '' DefaultValue: '' Description: Target of SharpSecDump - SuggestedValues: - - -target= + SuggestedValues: [] Optional: false DisplayInCommand: true FileOption: false @@ -27,8 +26,7 @@ Value: '' DefaultValue: '' Description: Username - SuggestedValues: - - -u= + SuggestedValues: [] Optional: true DisplayInCommand: true FileOption: false @@ -36,8 +34,7 @@ Value: '' DefaultValue: '' Description: Password - SuggestedValues: - - -p= + SuggestedValues: [] Optional: true DisplayInCommand: true FileOption: false @@ -45,14 +42,13 @@ Value: '' DefaultValue: '' Description: Domain - SuggestedValues: - - -d= + SuggestedValues: [] Optional: true DisplayInCommand: true FileOption: false ReferenceSourceLibraries: - Name: SharpSecDump - Description: .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump + Description: SharpSecDump is a .Net port of the remote SAM + LSA Secrets dumping functionality of impacket's secretsdump.py. Location: SharpSecDump/ Language: CSharp CompatibleDotNetVersions: