{"id":13540344,"url":"https://github.com/alessandroz/lazagneforensic","last_synced_at":"2025-04-05T04:14:52.439Z","repository":{"id":91043007,"uuid":"119856485","full_name":"AlessandroZ/LaZagneForensic","owner":"AlessandroZ","description":"Windows passwords decryption from dump files","archived":false,"fork":false,"pushed_at":"2023-02-02T16:36:21.000Z","size":280,"stargazers_count":494,"open_issues_count":6,"forks_count":110,"subscribers_count":35,"default_branch":"master","last_synced_at":"2025-03-29T03:11:42.650Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/AlessandroZ.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG","contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null}},"created_at":"2018-02-01T15:44:31.000Z","updated_at":"2025-03-27T22:39:21.000Z","dependencies_parsed_at":"2023-03-12T14:00:34.026Z","dependency_job_id":null,"html_url":"https://github.com/AlessandroZ/LaZagneForensic","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AlessandroZ%2FLaZagneForensic","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AlessandroZ%2FLaZagneForensic/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AlessandroZ%2FLaZagneForensic/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/AlessandroZ%2FLaZagneForensic/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/AlessandroZ","download_url":"https://codeload.github.com/AlessandroZ/LaZagneForensic/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247284954,"owners_count":20913704,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:47.303Z","updated_at":"2025-04-05T04:14:52.408Z","avatar_url":"https://github.com/AlessandroZ.png","language":"Python","funding_links":[],"categories":["\u003ca id=\"e1fc1d87056438f82268742dc2ba08f5\"\u003e\u003c/a\u003e事件响应\u0026\u0026取证\u0026\u0026内存取证\u0026\u0026数字取证","\u003ca id=\"ecb63dfb62722feb6d43a9506515b4e3\"\u003e\u003c/a\u003e新添加"],"sub_categories":["\u003ca id=\"1fc5d3621bb13d878f337c8031396484\"\u003e\u003c/a\u003e取证\u0026\u0026Forensics\u0026\u0026数字取证\u0026\u0026内存取证"],"readme":"\n__The LaZagne Project !!!__ \n==\n\nDescription\n----\nThe __LaZagne project__ is back !!! \n\n[LaZagne](https://github.com/AlessandroZ/LaZagne) uses an internal Windows function called *CryptUnprotectData* to decrypt user passwords. This API should be called on the victim user session, otherwise, it does not work. If the computer has not been started (when the analysis is realized on an offline mounted disk), or if we do not want to drop a binary on the remote host, no passwords can be retrieved. \n\n[LaZagneForensic](https://github.com/AlessandroZ/LaZagneForensic) has been created to avoid this problem. This work has been mainly inspired by the awesome work done by *Jean-Michel Picod* and *Elie Bursztein* for [DPAPICK](https://bitbucket.org/jmichel/dpapick) and *Francesco Picasso* for [Windows DPAPI laboratory](https://github.com/dfirfpi/dpapilab). \n\n__Note__: The main problem is that to decrypt these passwords, the user Windows passwords is needed. \n\nInstallation\n----\n\n- **Requires python2 (Not compatible with python3)**\n- **Requires pip2**: if not installed :\n  ```bash\n  sudo wget https://bootstrap.pypa.io/pip/2.7/get-pip.py\n  sudo python2 ./get-pip.py\n  ```\n\n```bash\nsudo apt install python2-dev\npip2 install markerlib\npip2 install distribute\npip2 install -r requirements.txt\n```\n\nUsage\n----\n\n### First way - Dump configuration files from the remote host\n* Using the powershell [script](https://github.com/AlessandroZ/LaZagneForensic/blob/master/dump/dump.ps1)\n```\nPS C:\\Users\\test\\Desktop\u003e Import-Module .\\dump.ps1\nPS C:\\Users\\test\\Desktop\u003e Dump\nFolder dump created successfully !\n```\n* Using the python [script](https://github.com/AlessandroZ/LaZagneForensic/blob/master/dump/dump.py)\n```\npython dump.py\n```\n* Launch Lazagne with password if you have it\n```\npython laZagneForensic.py all -remote /tmp/dump -password 'ZapataVive'\n```\n* Launch Lazagne without password \n```\npython laZagneForensic.py all -remote /tmp/dump\n```\n\n### Second way - Mount a disk on your filesystem\n* The file should be mounted on your filesystem\n```\ntest:~$ ls /tmp/disk/\ntotal 769M\ndrwxr-xr-x 2 root root    0 févr.  1 14:05 ProgramData\n-rwxr-xr-x 1 root root 256M févr.  1 14:05 swapfile.sys\n-rwxr-xr-x 1 root root 512M févr.  1 14:05 pagefile.sys\ndrwxr-xr-x 2 root root    0 janv. 31 00:35 System Volume Information\ndr-xr-xr-x 2 root root    0 janv. 26 10:17 Program Files (x86)\ndr-xr-xr-x 2 root root    0 janv. 25 18:13 Program Files\ndrwxr-xr-x 2 root root    0 janv. 19 10:09 Windows\ndrwxr-xr-x 2 root root    0 janv. 16 15:52 Homeware\ndrwxr-xr-x 2 root root    0 janv.  9 17:33 PerfLogs\ndrwxr-xr-x 2 root root    0 nov.  22 20:37 Recovery\ndrwxr-xr-x 2 root root 4,0K nov.  22 20:31 Documents and Settings\ndr-xr-xr-x 2 root root    0 nov.  22 20:31 Users\n```\n* Launch Lazagne with password if you have it\n```\npython laZagneForensic.py all -local /tmp/disk -password 'ZapataVive'\n```\n* Launch Lazagne without password \n```\npython laZagneForensic.py all -local /tmp/disk\n```\n__Note__: Use __-v__ for verbose mode and __-vv__ for debug mode.\n\nSupported software\n----\n__Note__: Check the following image to understand which passwords you could decrypt without needed the user windows password. All credentials found will be tested as Windows password in case of the user re-uses the same password. \n\n\u003cp align=\"center\"\u003e\u003cimg src=\"./pictures/softwares.png\" alt=\"The LaZagne project\"\u003e\u003c/p\u003e\n\nDonation\n----\nDo not hesitate to support my work doing a donation, I will appreciate a lot:\n* Via BTC: 16zJ9wTXU4f1qfMLiWvdY3woUHtEBxyriu\n\nSpecial thanks\n----\n* Jean-Michel Picod and Elie Bursztein for [DPAPICK](https://bitbucket.org/jmichel/dpapick)\n* Francesco Picasso for [Windows DPAPI laboratory](https://github.com/dfirfpi/dpapilab)\n* Jean-Christophe Delaunay - Jiss/Fist0urs from the Synacktiv team for their [work](https://www.synacktiv.com/ressources/univershell_2017_dpapi.pdf)\n\nRecommended articles related to DPAPI\n----\n* [Happy DPAPI!](http://blog.digital-forensics.it/2015/01/happy-dpapi.html)\n* [ReVaulting! Decryption and opportunities](https://www.slideshare.net/realitynet/revaulting-decryption-and-opportunities)\n* [Windows ReVaulting](http://blog.digital-forensics.it/2016/01/windows-revaulting.html)\n* [DPAPI exploitation during pentest and password cracking](https://www.synacktiv.com/ressources/univershell_2017_dpapi.pdf)\n\n----\n| __Alessandro ZANNI__    |\n| ------------- |\n| __zanni.alessandro@gmail.com__  |\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falessandroz%2Flazagneforensic","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Falessandroz%2Flazagneforensic","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Falessandroz%2Flazagneforensic/lists"}