{"id":22647358,"url":"https://github.com/processust/hekatomb","last_synced_at":"2025-04-07T19:14:21.197Z","repository":{"id":59757571,"uuid":"534691659","full_name":"ProcessusT/HEKATOMB","owner":"ProcessusT","description":"Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations. Then it will download all DPAPI blob of all users from all computers and uses Domain backup keys to decrypt them.","archived":false,"fork":false,"pushed_at":"2024-07-31T19:05:30.000Z","size":728,"stargazers_count":501,"open_issues_count":1,"forks_count":56,"subscribers_count":13,"default_branch":"main","last_synced_at":"2024-12-19T09:05:14.326Z","etag":null,"topics":["activedirectory","blob","dpapi","masterkey","python","secrets","windows"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"gpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/ProcessusT.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.md","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2022-09-09T15:07:15.000Z","updated_at":"2024-12-18T20:59:26.000Z","dependencies_parsed_at":"2023-02-14T17:45:49.356Z","dependency_job_id":"83d83f68-6313-420c-a757-fd2a99618711","html_url":"https://github.com/ProcessusT/HEKATOMB","commit_stats":{"total_commits":69,"total_committers":5,"mean_commits":13.8,"dds":"0.14492753623188404","last_synced_commit":"3b220b0382a38f19084fbe102e0a5cb4bd8c11ef"},"previous_names":["processust/hekatomb"],"tags_count":1,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ProcessusT%2FHEKATOMB","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ProcessusT%2FHEKATOMB/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ProcessusT%2FHEKATOMB/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/ProcessusT%2FHEKATOMB/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/ProcessusT","download_url":"https://codeload.github.com/ProcessusT/HEKATOMB/tar.gz/refs/heads/main","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":247713258,"owners_count":20983683,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["activedirectory","blob","dpapi","masterkey","python","secrets","windows"],"created_at":"2024-12-09T07:33:27.045Z","updated_at":"2025-04-07T19:14:21.159Z","avatar_url":"https://github.com/ProcessusT.png","language":"Python","readme":"# The HEKATOMB project\n\n\u003cdiv align=\"center\"\u003e\n  \u003cbr\u003e\n  \u003cimg src=\"https://img.shields.io/badge/Python-3.11-informational\"\u003e\n  \u003cbr\u003e\n  \u003ca href=\"https://twitter.com/intent/follow?screen_name=ProcessusT\" title=\"Follow\"\u003e\u003cimg src=\"https://img.shields.io/twitter/follow/ProcessusT?label=ProcessusT\u0026style=social\"\u003e\u003c/a\u003e\n  \u003cbr\u003e\n  \u003ch1\u003e\n    Because Domain Admin rights are not enough.\u003cbr /\u003e\n                Hack them all.\u003cbr /\u003e\n                🐍\n  \u003c/h1\u003e\n  \u003cbr\u003e\u003cbr\u003e\n\u003c/div\u003e\n\n\u003e Hekatomb is a python script that connects to LDAP directory to retrieve all computers and users informations.\u003cbr /\u003e\n\u003e Then it will download all DPAPI blob of all users from all computers.\u003cbr /\u003e\n\u003e\tFinally, it will extract domain controller private key through RPC uses it to decrypt all credentials.\u003cbr /\u003e\n\u003e \u003cbr /\u003e\n\u003e \n\u003cbr\u003e\n\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"https://github.com/ProcessusT/HEKATOMB/raw/main/.assets/github1.png\" width=\"80%;\"\u003e\n\u003c/div\u003e\n\u003cbr\u003e\n\n\n\n\n\n## Changelog\n\u003cbr /\u003e\nOn last version (V 1.5) :\u003cbr /\u003e\n- Fix local packages importation error with pip installation\u003cbr /\u003e\n- Prevent crash when no computers are reachable\u003cbr /\u003e\n- Prevent null domain or null domain extension\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.4 :\u003cbr /\u003e\n- Fix LDAP search limitation to 1000 items\u003cbr /\u003e\n- Add LDAP filter for computers to select only \"Enabled\" computers\u003cbr /\u003e\n- Add function to scan SMB port with multi thread prior to get blob and master key files\u003cbr /\u003e\n- Add a progress bar for files collection\u003cbr /\u003e\n- Added 2 function modules to simplify code readability and maintainability\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.3 :\u003cbr /\u003e\n- Compare LDAP usernames with SMB users folders before trying to retrieve blob files to get them faster\u003cbr /\u003e\n- DNSTCP option is no more used, DNS resolution is trying on UDP first and with TCP if it fails\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.2.1 :\u003cbr /\u003e\n- Use of the ldap3 library instead of Impacket for LDAP requests\u003cbr /\u003e\n- Fix a bug that prevented querying trusted domains via an external domain account with administrator rights on the trusted domain controller\u003cbr /\u003e\n- Add -smb2 parameter to force the use of SMBv2 protocol when it is available\u003cbr /\u003e\n- LDAP and SMB communications are now more difficult to detect on the network\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.2.1 :\u003cbr /\u003e\n- Add installation with Pypi\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.2 :\u003cbr /\u003e\n- Increase the LDAP results limit of users or computers extraction (1000 previously)\u003cbr /\u003e\n- Add the possibility to specify a user or a computer to target\u003cbr /\u003e\n- Add the possibility to export results to a CSV file\u003cbr /\u003e\n\u003cbr /\u003e\nV 1.1 :\u003cbr /\u003e\n- Domain controller private key extraction through RPC\u003cbr /\u003e\n- Credentials classification by computers and by users\u003cbr /\u003e\n\n\u003cbr /\u003e\u003cbr /\u003e\n\n## What da fuck is this ?\n\u003cbr /\u003e\nOn Windows, credentials saved in the Windows Credentials Manager are encrypted using Microsoft's Data Protection API and stored as \"blob\" files in user AppData folder.\u003cbr /\u003e\nOutside of a domain, the user's password hash is used to encrypt these \"blobs\".\u003cbr /\u003e\nWhen you are in an Active Directory environment, the Data Protection API uses the domain controller's public key to encrypt these blobs.\u003cbr /\u003e\nWith the extracted private key of the domain controller, it is possible to decrypt all the blobs, and therefore to recover all the secrets recorded in the Windows identification manager of all the workstations in the domain.\u003cbr /\u003e\n\u003cbr /\u003e\nHekatomb automates the search for blobs and the decryption to recover all domain users' secrets ☠️\n\u003cbr /\u003e\n\u003cbr /\u003e\n\n## Installation\n\u003cbr\u003e\nFrom Pypi for Debian-based :\n\u003cbr\u003e\u003cbr\u003e\n\n```python\npip3 install hekatomb\n```\n\n\n\u003cbr\u003e\nFrom BlackArch :\n\u003cbr\u003e\u003cbr\u003e\n\n```python\npacman -S hekatomb\n```\n\n[![BlackArch package](https://repology.org/badge/version-for-repo/blackarch/hekatomb.svg)](https://repology.org/project/hekatomb/versions)\n\n\u003cbr\u003e\n\nFrom github :\n\u003cbr\u003e\u003cbr\u003e\n\n```python\ngit clone https://github.com/ProcessusT/HEKATOMB\ncd HEKATOMB\npoetry install\npoetry run hekatomb\n```\n\u003cbr\u003e\n\u003cbr\u003e\n\n\n## Usage\n\u003cbr\u003e\nHekatomb uses Impacket syntax :\n\u003cbr\u003e\u003cbr\u003e\n\n```python\nusage: hekatomb [-h] [-hashes LMHASH:NTHASH] [-pvk PVK] [-dns DNS] [-dnstcp] [-port [port]] [-just-user JUST_USER] [-just-computer JUST_COMPUTER] [-md5] [-debug] [-debugmax] target\n\nScript used to automate domain computers and users extraction from LDAP and extraction of domain controller private key through RPC to collect and decrypt all users' DPAPI secrets saved in Windows credential manager.\n\npositional arguments:\n  target                [[domain/]username[:password]@]\u003ctargetName or address of DC\u003e\n\noptions:\n  -h, --help            Show this help message and exit\n\nauthentication:\n  -hashes LMHASH:NTHASH     NTLM hashes, format is LMHASH:NTHASH\n\nauthentication:\n  -pvk PVK                  Domain backup keys file\n  -dns DNS                  DNS server IP address to resolve computers hostname\n  -port [port]              Port to connect to SMB Server\n  -smb2                     Force the use of SMBv2 protocol\n  -just-user [USERNAME]     Test only specified username\n  -just-computer [COMPUTER] Test only specified computer\n  -md5                      Print md5 hash insted of clear passwords\n\nverbosity:\n  -csv                  Output the results in csv\n  -debug                Turn DEBUG output ON\n  -debugmax             Turn DEBUG output TO MAAAAXXXX\n```\n\n\u003cbr\u003e\n\u003cbr\u003e\n\n## Example\n\n\u003cbr\u003e\n\n```python\nhekatomb -hashes :ed0052e5a66b1c8e942cc9481a50d56 DOMAIN.local/administrator@10.0.0.1 -debug \n```\n\n\u003cbr\u003e\n\u003cbr\u003e\n    \n## How to retrieve domain backup keys ?\n\n\u003cbr /\u003e\nIf no domain backup keys are provided, the script will retrieve it through RPC\n","funding_links":[],"categories":[],"sub_categories":[],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprocessust%2Fhekatomb","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fprocessust%2Fhekatomb","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fprocessust%2Fhekatomb/lists"}