Add pass-the-sha1 for non domain joined machines #21
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ing the password in plaintext or SHA1 with the /password flag and /local flag.
…with the /target: flag. This is needed since the directory might not contain a BK file if it was lifted from another system.
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR allows the user to specify the
/passwordflag in SHA1 format when the machine is not domain-joined (i.e. local). These SHA1 passwords are calculated asSHA1(UTF16LE(password)), which is output by mimikatz'sekurlsa::msv. This feature mirrors the functionality already provided to support PtH for NTLM on domain-joined machines.Note that when using the
masterkeyscommand with a/targetspecified (e.g. a path to directory containing masterkeys), SharpDPAPI will not attempt to detect domain-joined-ness via theBKfile (since it may not exist simply because the user didn't copy it from the target system) - therefore I've also added the/localflag which can be specified along with/targetto force the SHA1 path.