Metadata-Version: 2.1
Name: masterkeybrute
Version: 1.1
Summary: Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager
Home-page: https://github.com/ProcessusT/MasterKeyBrute
License: GPL-3.0-only
Keywords: bruteforce,dpapi,windows,blob,masterkey,activedirectory,credentials
Author: Processus Thief
Author-email: processus@thiefin.fr
Maintainer: Processus Thief
Maintainer-email: processus@thiefin.fr
Requires-Python: >=3.7,<4.0
Classifier: License :: OSI Approved :: GNU General Public License v3 (GPLv3)
Classifier: Programming Language :: Python :: 3
Classifier: Programming Language :: Python :: 3.7
Classifier: Programming Language :: Python :: 3.8
Classifier: Programming Language :: Python :: 3.9
Classifier: Programming Language :: Python :: 3.10
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.13
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory
Classifier: Topic :: System :: Systems Administration :: Authentication/Directory :: LDAP
Requires-Dist: impacket (>=0.10.0,<0.11.0)
Requires-Dist: pycryptodomex (>=3.15.0,<4.0.0)
Project-URL: Bug Tracker, https://github.com/ProcessusT/MasterKeyBrute/issues
Project-URL: Documentation, https://github.com/ProcessusT/MasterKeyBrute
Project-URL: Repository, https://github.com/ProcessusT/MasterKeyBrute
Description-Content-Type: text/markdown

# MasterKeyBrute
 Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager

<div align="center">
  <br>
  <img src="https://img.shields.io/badge/Python-3.11-informational">
  <br>
  <a href="https://twitter.com/intent/follow?screen_name=ProcessusT" title="Follow"><img src="https://img.shields.io/twitter/follow/ProcessusT?label=ProcessusT&style=social"></a>
  <br><br>
</div>

<br>
<div align="center">
<img src="https://github.com/ProcessusT/MasterKeyBrute/raw/main/.assets/demo.gif" width="80%;">
</div>
<br>


## Usage
<br>
MasterKeyBrute uses Impacket syntax :
<br><br>

```bash
**************************************************
                 MASTERKEYBRUTE

                 @Processus
                    v1.0
**************************************************


usage: masterkeybrute.py [-h] -mkf MKF -sid SID -w W [--blob BLOB] [--show-prekeys SHOW_PREKEYS] [-debug]

Bruteforce DPAPI encrypted MasterKey File from Windows Credentials Manager

options:
  -h, --help            show this help message and exit
  -mkf MKF              Master Key File
  -sid SID              User SID to derivate key
  -w W                  Wordlist file

Optionnal:
  --blob BLOB           Blob file to decrypt with decrypted MasterKey
  --show-prekeys SHOW_PREKEYS
                        Show calculated prekeys

Verbosity:
  -debug                Turn DEBUG output ON
```

<br>
<br>

## Example

<br>

```bash
python3 masterkeybrute.py -mkf d5a8f4c9-a8ab-423a-a027-601472215dff -sid S-1-5-21-2097421949-534903256-19675394-500 -w /opt/rockyou.txt --blob 5AEA058AA7D881EBF78E4BE4515E5159 -debug
```

<br>
<br>
    
