如何从商店导出不可导出的私钥
我需要从 Windows 商店导出私钥。如果密钥被标记为不可导出，我该怎么办？我知道有可能，程序越狱可以导出这个密钥。
要导出密钥，我使用 Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair() 从 (RSACryptoServiceProvider)cryptoProv.ExportParameters(true) 导出密钥。我在 Org.BouncyCastle.Cms.CmsSignedDataGenerator 中使用导出的密钥进行 CMS 签名。
我需要 .Net 的解决方案，但任何解决方案都会有用。谢谢。
I need to export private key from Windows store. What should I do if the key is marked as non-exportable? I know that it is possible, program jailbreak can export this key.
To export key I use Org.BouncyCastle.Security.DotNetUtilities.GetKeyPair() that exports key from (RSACryptoServiceProvider)cryptoProv.ExportParameters(true). Exported key I use in Org.BouncyCastle.Cms.CmsSignedDataGenerator for CMS signature.
I need solution for .Net, but any solution will be useful. Thank you.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（7）
你是对的，据我所知，根本没有 API 可以导出标记为不可导出的 PrivateKey。
但是，如果您修补（在内存中）正常的 API，则可以使用正常的方式导出:)
有一个新版本的 mimikatz 也支持 CNG 导出（Windows Vista / 7 / 2008 ...）
运行它并在提示符中输入以下命令：
privilege::debug（除非您已经拥有它或仅针对 CryptoApi）crypto::patchcng(nt 6) 和/或 < code>crypto::patchcapi (nt 5 & 6)crypto::exportCertificates和/或crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE导出的 .pfx 文件是密码用密码“mimikatz”保护
You're right, no API at all that I'm aware to export PrivateKey marked as non-exportable.
But if you patch (in memory) normal APIs, you can use the normal way to export :)
There is a new version of mimikatz that also support CNG Export (Windows Vista / 7 / 2008 ...)
Run it and enter the following commands in its prompt:
privilege::debug(unless you already have it or target only CryptoApi)crypto::patchcng(nt 6) and/orcrypto::patchcapi(nt 5 & 6)crypto::exportCertificatesand/orcrypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINEThe exported .pfx files are password protected with the password "mimikatz"
Gentil Kiwi 的答案是正确的。他开发了这个 mimikatz 工具，能够检索不可导出的私钥。
然而，他的指示已经过时了。您需要：
从https://github.com/gentilkiwi/mimikatz/releases下载最新版本< /a>
在请求证书的同一台计算机中以管理员权限运行 cmd
更改为 mimikatz bin 目录（Win32 或 x64 版本）
运行
mimikatz遵循 wiki 说明 和 .pfx 文件（受密码保护） mimikatz）将被放置在mimikatz bin的同一文件夹中
Gentil Kiwi's answer is correct. He developed this mimikatz tool that is able to retrieve non-exportable private keys.
However, his instructions are outdated. You need:
Download the lastest release from https://github.com/gentilkiwi/mimikatz/releases
Run the cmd with admin rights in the same machine where the certificate was requested
Change to the mimikatz bin directory (Win32 or x64 version)
Run
mimikatzFollow the wiki instructions and the .pfx file (protected with password mimikatz) will be placed in the same folder of the mimikatz bin
此处提供了控制台应用程序的代码和二进制文件，可以导出标记为非的私钥-可导出，并且它不会像mimikatz那样触发防病毒应用程序。
该代码基于 NCC Group。
需要使用本地系统帐户运行该工具，因为它的工作原理是直接写入 Windows lsass 进程使用的内存，以便临时将密钥标记为可导出。这可以使用 SysInternals 的 PsTools 中的
PsExec来完成a>:生成一个以本地系统用户身份运行的新命令提示符：
在新命令提示符中运行该工具：
它将循环遍历每个本地计算机存储，搜索带有私钥的证书。对于每一个，它都会提示您输入密码 - 这是您想要用来保护导出的 PFX 文件的密码，因此可以是您想要的任何密码
所需文件的快捷方式：
There is code and binaries available here for a console app that can export private keys marked as non-exportable, and it won't trigger antivirus apps like mimikatz will.
The code is based on a paper by the NCC Group.
will need to run the tool with the local system account, as it works by writing directly to memory used by Windows'
lsassprocess, in order to temporarily mark keys as exportable. This can be done usingPsExecfrom SysInternals' PsTools:Spawn a new command prompt running as the local system user:
In the new command prompt, run the tool:
It will loop over every Local Computer store, searching for certificates with a private key. For each one, it will prompt you for a password - this is the password you want to secure the exported PFX file with, so can be whatever you want
Shortcuts to needed files:
我想提一下 越狱具体(GitHub) >：
下载适合您的 Windows 版本的可执行二进制文件（例如，jailbreak64.exe）。
启动提升的命令提示符。
运行命令
jailbreak64.exe %WINDIR%\system32\mmc.exe %WINDIR%\system32\certlm.msc -64（注意 - 这与 github 上的指导不太一样.certlm.msc在 Windows 2016 和 2019 上用于启动本地计算机证书存储。I wanted to mention Jailbreak specifically (GitHub):
Download the executable binaries for your version of Windows (e.g. jailbreak64.exe).
Start an elevated command prompt.
Run the command
jailbreak64.exe %WINDIR%\system32\mmc.exe %WINDIR%\system32\certlm.msc -64(note - this is not quite the same as the guidance on github.certlm.mscis used on Windows 2016 and 2019 to bring up the local machine certificate store).不幸的是，上述工具被多家防病毒供应商阻止。如果您属于这种情况，请查看以下内容。
打开证书存储中的不可导出证书并找到指纹值。
接下来，打开 regedit 到以下路径并找到与指纹值匹配的注册表项。
注册表项的导出将包含完整的证书，包括私钥。导出后，将导出复制到其他服务器并将其导入到注册表中。
该证书将显示在证书管理器中，其中包含私钥。
机器存储：HKLM\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
用户存储：HKCU\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
在紧要关头，您可以将导出保存为证书的备份。
Unfortunately, the tool mentioned above is blocked by several antivirus vendors. If this is the case for you then take a look at the following.
Open the non-exportable cert in the cert store and locate the Thumbprint value.
Next, open regedit to the path below and locate the registry key matching the thumbprint value.
An export of the registry key will contain the complete certificate including the private key. Once exported, copy the export to the other server and import it into the registry.
The cert will appear in the certificate manager with the private key included.
Machine Store: HKLM\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
User Store: HKCU\SOFTWARE\Microsoft\SystemCertificates\MY\Certificates
In a pinch, you could save the export as a backup of the certificate.
您可能需要卸载防病毒软件（就我而言，我必须删除 Avast）。
这可以确保
crypto::cng命令能够正常工作。否则它会给我错误：删除 Avast：Magic 后
。 （：
顺便说一句，
Windows Defender 是另一个阻止程序运行的程序，因此您至少在使用程序时还需要禁用它。
You might need to uninstall antivirus (in my case I had to get rid of Avast).
This makes sure that
crypto::cngcommand will work. Otherwise it was giving me errors:After removing Avast:
Magic. (:
BTW
Windows Defender is another program blocking the program to work, so you will need also to disable it for the time of using program at least.
如果它是由 digicert 颁发的 您可以使用适用于 Windows 的 DigiCert 证书实用程序。在创建它的服务器上进行“修复”。然后您可以将其导出到 c:\temp 等 .pfx。这对我来说有一个真正的 ssl 证书。
If it's issued by digicert You can use the DigiCert Certificate Utility for Windows. Do the 'Repair' on the server it was created on. Then you can export it to like c:\temp as .pfx. This worked for me with a real ssl cert.