README

NTHASH-FPC

A tribute to https://github.com/gentilkiwi/mimikatz...

And generally speaking a tool to handle hashes and ciphers with a particular focus on windows secrets and lateral movement.

https://attack.mitre.org/matrices/enterprise/windows/ is definitely worth reading when about lateral movement.

I wrote a series of articles here to illustrate what can be done with nthash.

Syntax/Commands are detailed (as much as possible) here.

todo/news:

-decrypt sam hashes online (rather than patching lsass) and offline : done in v1.1

-deal with new AES cipher used in latest win10 1607 : done in 1.2

-enum Lsasrv.dll!LogonSessionList: done in 1.3

-enum Wdigest.dll!l_LogSessList: done in 1.3

-decrypt dpapi encrypted vault and/or credentials : done in 1.4

-patch LogonSessionList and perform pth: done in 1.4

-decrypt chrome and firefox passwords: done in 1.4

-decrypt firefox and chrome passwords/cookies : done in 1.5 -dpapimk command to dump all masterkeys : done in 1.6 -getlsassecret using LsaRetrievePrivateData: done in 1.6 -todo : work out LsaICryptUnprotectData thru dll injection -work out masterkey decryption based on sha1 user password: done in 1.7 -work out credential blob decryption based on decrypted masterkey: done in 1.7 -work out offline decryption of lsasecrets as well: done in 1.7 -todo : work out credhist decryption -use ms symbol server to retrieve offset on the fly: done in 1.8 -introduce pipe - /input will always be fed by the pipe in : done o, 1.8 -chrome 80 new encryption (aes-256-gcm) : done in 1.8