+- Sinisterly (https://sinister.li)
+-- Forum: Hacking (https://sinister.li/Forum-Hacking)
+--- Forum: Tutorials (https://sinister.li/Forum-Tutorials)
+--- Thread: Cracking Windows Cryptography (CryptProtectData) (/Thread-Cracking-Windows-Cryptography-CryptProtectData)
Cracking Windows Cryptography (CryptProtectData) - Eclipse - 04-15-2015
I was wondering if there was a way to crack shit encrypted with Windows Cryptography's CryptProtectData? Specifically, the Wifi password within the XML file in which Win7 Wifi passwords are stored.
Brute Forcing is obviously possible (not sure about Python), but I wanted to know if any of you have any specific tips to make the cracking faster and more efficient.
Spoiler:
Code:
<?xml version="1.0"?>
<WLANProfile xmlns="http://www.microsoft.com/networking/WLAN/profile/v1">
<name>CarltonW</name>
<SSIDConfig>
<SSID>
<hex>4361726C746F6E57</hex>
<name>CarltonW</name>
</SSID>
<nonBroadcast>false</nonBroadcast>
</SSIDConfig>
<connectionType>ESS</connectionType>
<connectionMode>auto</connectionMode>
<MSM>
<security>
<authEncryption>
<authentication>WPA2PSK</authentication>
<encryption>AES</encryption>
<useOneX>false</useOneX>
</authEncryption>
<sharedKey>
<keyType>passPhrase</keyType>
<protected>true</protected>
<keyMaterial>01000000D08C9DDF0115D1118C7A00C04FC297EB01000000368D74AECF31D149AB48771F2EDCBB980000000002000000000010660000000100002000000072AA601FE0643482C4D98D686388C20342C7997F02A66CF6CBA340271F15287E000000000E8000000002000020000000BED123D36F115CEF38C1C5CBE47DD1DCCEE6C03D3AB620D6B4A072C0FA09E829100000003628BCF854A45E627FD9809C5BE77AD1400000005593E176AB2275BC0A2194FC27A83BF407CF944B1EBA6041DFB6BBFE71EFBCD877E34A0AFFA18C9B7901A15EB9E844A7D9C8FD6E91284B4A45333A45D223D53B</keyMaterial>
</sharedKey>
</security>
</MSM>
</WLANProfile>RE: Cracking Windows Cryptography (CryptProtectData) - Psycho_Coder - 04-15-2015
Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.
something like
import win32crypt
password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]
RE: Cracking Windows Cryptography (CryptProtectData) - Misha- - 04-15-2015
(04-15-2015, 08:22 PM)Psycho_Coder Wrote: Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.
something like
import win32crypt
password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]
That's fine and dandy, but I don't think Python is good for bruteforcing.
Wouldn't C or C++ be way faster?
RE: Cracking Windows Cryptography (CryptProtectData) - Psycho_Coder - 04-19-2015
(04-15-2015, 09:36 PM)Misha- Wrote: That's fine and dandy, but I don't think Python is good for bruteforcing.
Wouldn't C or C++ be way faster?
There's nothing in particular designation for doing something in programming. Python is capable of doing all sorts of stuffs with great efficiency but depends on the programmer who makes it. Yes C/C++ would be faster due to native code generation.
RE: Cracking Windows Cryptography (CryptProtectData) - Eclipse - 05-18-2015
(04-15-2015, 08:22 PM)Psycho_Coder Wrote: Yes it can be done. You can install pywin32 which contains a library called win32crypt. You can simple reverse the process.
something like
import win32crypt
password = win32crypt.CryptUnprotectData(pass, None, None, None, 0)[1]
Forgive my lack of knowledge on Windows Cryptography, but shouldn't you do CryptProtectData and the compare the result with the hash you're trying to hack?
RE: Cracking Windows Cryptography (CryptProtectData) - Psycho_Coder - 05-20-2015
(05-18-2015, 09:22 PM)Eclipse Wrote: Forgive my lack of knowledge on Windows Cryptography, but shouldn't you do CryptProtectData and the compare the result with the hash you're trying to hack?
Yes normally thats the approach, what I said is when you want to get the plaintext. In forensics specially we are more concerned with retrieving passwords in their plain form so I generally prefer to use CryptUnprotectData for faster data retrieval. But yes different people can use it in different way.