dissect.target.plugins.os.windows.credential.defaultpassword

Module Contents

Classes

DefaultPasswordPlugin

Windows LSA DefaultPassword plugin.

Attributes

defaultpassword_def

c_defaultpassword

DefaultPasswordRecord

dissect.target.plugins.os.windows.credential.defaultpassword.defaultpassword_def = Multiline-String
Show Value
"""
struct DefaultPassword {
    DWORD   length;
    char    flags[4*3];
    WCHAR   data[length/2];
    // char    checksum_or_guid[0x10];
};
"""
dissect.target.plugins.os.windows.credential.defaultpassword.c_defaultpassword
dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordRecord
class dissect.target.plugins.os.windows.credential.defaultpassword.DefaultPasswordPlugin(target: dissect.target.target.Target)

Bases: dissect.target.plugins.os.windows.credential.credential.WindowsCredentialPlugin

Windows LSA DefaultPassword plugin.

__namespace__ = 'defaultpassword'

Defines the plugin namespace.

check_compatible() → None

Perform a compatibility check with the target.

This function should return None if the plugin is compatible with the current target (self.target). For example, check if a certain file exists. Otherwise it should raise an UnsupportedPluginError.

Raises:

UnsupportedPluginError – If the plugin could not be loaded.

defaultpassword() → collections.abc.Iterator[DefaultPasswordRecord]

Yield decrypted Windows LSA DefaultPassword records.

Extracts decrypted DefaultPassword values from the LSA.

References