4

Recently I was working on recovering data from dead (bricked PSU) Windows XP machine, which included some client certificates installed into IE 6. I plugged in a temporary PSU and tried to export the certificate, only to be told that "these certificates are marked as non-exportable, and thus the private key can not be exported".

I've done some searching around the intertubes, however the only advices I could find were related to pre-install scenarios (ie. there is apparently an option which you can check during the installation to avoid this situation).

My questions would be:

  • Is this a real security measure? It seems to me that you can simply patch the verification logic in IE6 (or the CryptoAPI) and force the export of the certificate / private-key
  • Is there a ready-made tool to do this? (for backup purposes for example)
Zypher
  • 37,405
  • 5
  • 53
  • 95
Grey Panther
  • 988
  • 8
  • 12

3 Answers3

7

Exporting private keys on certificates that have been marked non-exportable? Uh, how about a tool called Jailbreak...

Dscoduc
  • 1,095
  • 2
  • 8
  • 15
1

"Unexportable" means the private key is inaccessible to CryptExportKey(). It might be possible to patch CryptoAPI in memory, but I haven't found any references to it.

There also might be a way to load the registry "hive" in another system and either copy the certificates or edit the "unexportable" bit... but again, no such things on the googlenet.

user1686
  • 10,162
  • 1
  • 26
  • 42
0

Update:

There is a new version of mimikatz that also supports CNG Export (Windows Vista / 7 / 2008 ...)

  1. download (and launch with administrative privileges; trunk version for last version)
  2. privilege::debug (or not if you're already system or target only CryptoApi)
  3. crypto::patchcng (nt 6) and/or crypto::patchcapi (nt 5 & 6)
  4. crypto::exportCertificates and/or crypto::exportCertificates CERT_SYSTEM_STORE_LOCAL_MACHINE

pfx files are passwords protected "mimikatz"

Old post:

Maybe can you try another tool with other private keys functions : "mimikatz", it export other keys that other cannot export (non exportable, medium protected, orphan, etc..) The "bit" is not altered on system file, only the program context is altered :) For example, an user (not administrator) can export his own protected / non exportable keys without particulars rights.

splattne
  • 28,508
  • 20
  • 98
  • 148