ntds_decode.cpp

/**
 *  The MIT License:
 *
 *  Copyright © 2013 Kevin Devine
 *
 *  Permission is hereby granted,  free of charge,  to any person obtaining a
 *  copy of this software and associated documentation files (the "Software"),
 *  to deal in the Software without restriction,  including without limitation
 *  the rights to use,  copy,  modify,  merge,  publish,  distribute, 
 *  sublicense,  and/or sell copies of the Software,  and to permit persons to
 *  whom the Software is furnished to do so,  subject to the following
 *  conditions:
 *
 *  The above copyright notice and this permission notice shall be included in
 *  all copies or substantial portions of the Software.
 *
 *  THE SOFTWARE IS PROVIDED "AS IS",  WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 *  IMPLIED,  INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 *  FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
 *  AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM,  DAMAGES OR OTHER
 *  LIABILITY,  WHETHER IN AN ACTION OF CONTRACT,  TORT OR OTHERWISE, 
 *  ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR
 *  OTHER DEALINGS IN THE SOFTWARE.
 */

 // cl /O2 /Os /Oy /GS- ntds_decode.cpp ntds.cpp systemkey.cpp
 
#include "systemkey.h"
#include "ntds.h"

/*********************************************************************
 *
 *  Determines if process token is elevated
 *  Returns TRUE or FALSE
 *
 ********************************************************************/
BOOL isElevated(VOID) {
  HANDLE hToken;
	BOOL bResult = FALSE;
  
  if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY, &hToken)) {
    TOKEN_ELEVATION te;
    DWORD dwSize;
    if (GetTokenInformation(hToken, TokenElevation, &te, 
        sizeof(TOKEN_ELEVATION), &dwSize)) {
		  bResult = te.TokenIsElevated != 0;
    }
    CloseHandle(hToken);
	}
  return bResult;
}

/*********************************************************************
 *
 *  Get password from user, input doesn't echo
 *  Assign input result to pwd
 *
 ********************************************************************/
VOID getPwd(std::wstring &pwd) {
  HANDLE hStdIn = GetStdHandle(STD_INPUT_HANDLE);
  DWORD dwMode = 0;
  GetConsoleMode(hStdIn, &dwMode);
  SetConsoleMode(hStdIn, dwMode & (~ENABLE_ECHO_INPUT));
  
  wprintf(L"\n  Enter password: ");
  
  std::getline(std::wcin, pwd);
  std::wcin.sync();
  SetConsoleMode(hStdIn, dwMode);
}

/*********************************************************************
 *
 *  get path from user and assign result to path
 *  if user doesn't enter anything, default location is used
 *
 *********************************************************************/
VOID getPath(std::wstring &path) {
  wprintf(L"\n  Enter path to syskey file [A:\\StartKey.key]: ");
  std::getline(std::wcin, path);
  std::wcin.sync();
  if (path.length() == 0) {
    path = L"A:\\StartKey.key";
  }
}

/********************************************************************
 *
 *  Convert a windows error code to human readable message and display
 *
 ********************************************************************/
VOID showError(DWORD dwError, PWCHAR pFmt, ...) {
  PWCHAR pDetails;
  WCHAR buffer[2048];
  
  if (pFmt != NULL) {
    va_list arglist;
    va_start(arglist, pFmt);
		wvsprintf(buffer, pFmt, arglist);
		va_end(arglist);
  }
  FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM,
      NULL, dwError, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), 
      (LPWSTR)&pDetails, 0, NULL);

  wprintf(L"\n  %s : %s", buffer, pDetails);
  LocalFree(pDetails);
}

/********************************************************************
 *
 *  Attempts to load SYSTEM registry hive into memory and return key
 *  return TRUE for success else FALSE
 *
 ********************************************************************/
BOOL GetSystemKey(std::wstring systemFile, PBYTE pKey) {
  SystemKey *syskey = new SystemKey();
  BOOL bStatus = FALSE;
  
  // attempt to load ..assumes user has Administrator privileges
  if (syskey->Load(systemFile.c_str())) {
    DWORD authType;
    std::wstring param;
    
    // get the type of authentication
    authType = syskey->AuthType();
    
    /****************************************************************
     *
     *  0 - Disabled
     *  1 - Random key generated by OS,  stored in registry.
     *  2 - Derived from password chosen by administrator.
     *  3 - Random key generated by OS,  stored on removable storage.
     *
     ****************************************************************/
    switch (authType) {
      case AUTH_REGISTRY : {
        param.clear();
        break;
      }
      case AUTH_PASSWORD : {
        wprintf(L"\n  System Key is derived from password");
        getPwd(param);
        break;
      }
      case AUTH_FILE : {
        wprintf(L"\n  System Key is stored on file");
        getPath(param);
        break;
      }
      default: {
        wprintf(L"\n  Unknown System key authentication detected : %08X", authType);
        syskey->UnLoad();
        return FALSE;
      }
    }
    bStatus = syskey->SetKey(param);
    if (bStatus) {
      syskey->GetKey(pKey);
    } else {
      showError(syskey->GetError(), L"SystemKey->SetKey()");
    }
    syskey->UnLoad();
  } else {
    showError(syskey->GetError(), L"SystemKey->Load(\"%s\")", systemFile.c_str());
  }
  return bStatus;
}

/**
  bHistory  = TRUE "Yes, include LM and NT history hashes", else FALSE
  bInactive = TRUE "Yes, include inactive accounts" else FALSE
  bMachines = TRUE "Yes, include machines" else FALSE
  
 */
BOOL bInactive = FALSE;
BOOL bMachines = FALSE;

void DumpHashes(NTDS *ntds) {
  // history, inactive, machines
  DWORD dwUsers = ntds->GetHashes(FALSE, bInactive, bMachines);
  //printf("\n\n%i users found", dwUsers);
}

// JET_errDatabaseDirtyShutdown, Database was not shutdown cleanly. 
// Recovery must first be run to properly complete database operations for the previous shutdown.
// esentutl /p ntds.dit
// ntds_decode system ntds.dit
//
/********************************************************************
 *
 * display binary as hexadecimal string
 *
 ********************************************************************/
static VOID dumpHex(const wchar_t pStr[], BYTE binary[], size_t len) {
  wprintf(L"\n  %s = ", pStr);
  for (size_t i = 0; i < len; i++) {
    wprintf(L"%02x", binary[i]);
  }
}

VOID ConsoleSetBufferWidth(SHORT X) {
  CONSOLE_SCREEN_BUFFER_INFO csbi;
  GetConsoleScreenBufferInfo(GetStdHandle(STD_OUTPUT_HANDLE), &csbi);
  
  if (X <= csbi.dwSize.X) return;
  csbi.dwSize.X  = X;
  SetConsoleScreenBufferSize(GetStdHandle(STD_OUTPUT_HANDLE), csbi.dwSize); 
}

std::wstring getOption(int argc, wchar_t *argv[], int &index) {
  if ((index + 1) >= argc) {
    wprintf(L"  ERROR: %s requires parameter", argv[index]);
    exit(0);
  }
  return argv[++index];
}

int wmain(int argc, wchar_t *argv[]) {
  
  ConsoleSetBufferWidth(300);
  
  puts("\n  NTDS LM/NTLM hash dumper v0.11b"
       "\n  Copyright (c) 2013 dietrich@insecurety.net");
  
  if (argc < 5) {
    wprintf(L"\n  ntds_decode -s <SYSTEM> -d <NTDS.dit> -m -i\n");
    wprintf(L"\n    -s <FILE>             : SYSTEM registry hive");
    wprintf(L"\n    -d <FILE>             : Active Directory database");
    wprintf(L"\n    -m                    : Machines (omitted by default)");
    wprintf(L"\n    -i                    : Inactive, Locked or Disabled accounts (omitted by default)\n");
    wprintf(L"\n  Press any key to continue . . .");
    fgetc(stdin);
    return 0;
  }
  
  if (!isElevated()) {
    wprintf(L"\n  WARNING : Process requires elevation to read SYSTEM key.");
  }
  
  std::wstring systemFile, ntdsFile;
  
  for (int i = 1; i < argc; i++) {
    std::wstring arg = argv[i];
    if (arg == L"-s") {
      systemFile = getOption(argc, argv, i);
    } else if (arg == L"-d") {
      ntdsFile = getOption(argc, argv, i);
    } else if (arg == L"-m") {
      bMachines = TRUE;
      continue;
    } else if (arg == L"-i") {
      bInactive = TRUE;
      continue;
    } else {
      wprintf(L"\n  Unrecognized option: %s", arg.c_str());
      exit(-1);
    }
  }
  
  if (systemFile.empty()) {
    wprintf(L"\n  ERROR: You did not specify SYSTEM registry hive . . .");
    return 0;
  }
  
  if (ntdsFile.empty()) {
    wprintf(L"\n  ERROR: You did not specify Active Directory database . . .");
    return 0;
  }
  
  BYTE systemkey[SYSTEM_KEY_LEN];
  BYTE passwordkey[PEK_VALUE_LEN];
  
  // obtain key from SYSTEM hive
  if (GetSystemKey(systemFile, systemkey)) {
    dumpHex(L"\n  System Key", systemkey, SYSTEM_KEY_LEN);
    
    // load the database
    NTDS *ntds = new NTDS();
    if (ntds->Load(ntdsFile)) {
      // obtain password key from NTDS.dit database
      if (ntds->GetPEKey(systemkey, passwordkey)) {
        dumpHex(L"Password Key", passwordkey, PEK_VALUE_LEN);
        wprintf(L"\n\n");
        DumpHashes(ntds);
      } else {
        wprintf(L"\n  Password Key decryption failed...\n");
      }
      ntds->UnLoad();
    } else {
      std::string s = ntds->GetError();
      std::wstring errString(s.begin(), s.end());
      wprintf(L"\n  Unable to load \"%s\" : %s\n", ntdsFile.c_str(), errString.c_str());
    }
    delete ntds;
  } else {
    wprintf(L"\n  Unable to read System key from \"%s\"\n", systemFile.c_str());
  }
  return 0;
}