Endermanch / scripts

Random scripts
GNU General Public License v3.0
66 stars 21 forks source link

Implement fully-automated extraction from an offline Windows system #3

Closed depau closed 4 weeks ago

depau commented 1 month ago

Hi!

First of all thanks for the two videos about the topics in these scripts, nice work!

I wanted to see if it was possible to extract the required values directly off of an offline Windows installation. I found python-registry which implements reading the registry hives directly out of System32 if the user has read-only access to the required files.

I tested this on a Linux system by mounting the Windows drive to /mnt:

$ python3 -m sam.samreader --sys32-config /mnt/Windows/System32/config

LSA key:
🔑 0x...

Boot key:
🔐 0x...

[...]

This PR:

Endermanch commented 1 month ago

I'll merge that somewhere around next week. Thank you for cleaning up the code, I've been wanting to do that since the video dropped.