[Eclipse]

I was wondering if there was a way to crack shit encrypted with Windows Cryptography's CryptProtectData? Specifically, the Wifi password within the XML file in which Win7 Wifi passwords are stored.

Brute Forcing is obviously possible (not sure about Python), but I wanted to know if any of you have any specific tips to make the cracking faster and more efficient.

Spoiler:

Code:

<?xml version="1.0"?> <WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1"> <name>CarltonW</name> <SSIDConfig> <SSID> <hex>4361726C746F6E57</hex> <name>CarltonW</name> </SSID> <nonBroadcast>false</nonBroadcast> </SSIDConfig> <connectionType>ESS</connectionType> <connectionMode>auto</connectionMode> <MSM> <security> <authEncryption> <authentication>WPA2PSK</authentication> <encryption>AES</encryption> <useOneX>false</useOneX> </authEncryption> <sharedKey> <keyType>passPhrase</keyType> <protected>true</protected> <keyMaterial>01000000D08C9DDF0115D1118C7A00C04FC297EB01000000368D74AECF31D149AB48771F2EDCBB980000000002000000000010660000000100002000000072AA601FE0643482C4D98D686388C20342C7997F02A66CF6CBA340271F15287E000000000E8000000002000020000000BED123D36F115CEF38C1C5CBE47DD1DCCEE6C03D3AB620D6B4A072C0FA09E829100000003628BCF854A45E627FD9809C5BE77AD1400000005593E176AB2275BC0A2194FC27A83BF407CF944B1EBA6041DFB6BBFE71EFBCD877E34A0AFFA18C9B7901A15EB9E844A7D9C8FD6E91284B4A45333A45D223D53B</keyMaterial> </sharedKey> </security> </MSM> </WLANProfile>

[Psycho_Coder]

Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.

something like

import win32crypt

password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]

[Misha-]

Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.

something like

import win32crypt

password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]

That's fine and dandy, but I don't think Python is good for bruteforcing.
Wouldn't C or C++ be way faster?

[Psycho_Coder]

That's fine and dandy, but I don't think Python is good for bruteforcing.
Wouldn't C or C++ be way faster?

There's nothing in particular designation for doing something in programming. Python is capable of doing all sorts of stuffs with great efficiency but depends on the programmer who makes it. Yes C/C++ would be faster due to native code generation.

[Eclipse]

Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.

something like

import win32crypt

password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]

Forgive my lack of knowledge on Windows Cryptography, but shouldn't you do CryptProtectData and the compare the result with the hash you're trying to hack?

[Psycho_Coder]

Forgive my lack of knowledge on Windows Cryptography, but shouldn't you do CryptProtectData and the compare the result with the hash you're trying to hack?

Yes normally thats the approach, what I said is when you want to get the plaintext. In forensics specially we are more concerned with retrieving passwords in their plain form so I generally prefer to use CryptUnprotectData for faster data retrieval. But yes different people can use it in different way.