Modules :

Because tofu works on modules, it can be expanded for different purposes. See the 'modules' section for examples.
Current Modules:
1. hashdump.py - Dumps NTLM hashes from the target Windows filesystem
2. osk_backdoor.py - Backdoor osk.exe to bypass the login; also includes an 'unbackdoor' module
3. list_users.py - List the users with a profile on the Windows filesystem
4. chrome.py - Dump chrome history and login data of all users on the Windows filesystem
5. get_dpapi_masterkeys.py - Dump DPAPI master keys from the Windows filesystem
6. enum_unattend.py - Enumerate unattend files
7. memory_strings.py - Search through the memory of the computer to find data
8. startup.py - Inject a program into a user's startup directory
9. wifi.py - Get Wi-Fi passwords with DPAPI

Usage :

'list' : List all storage devices at /dev/ with a format of MSDOS, NTFS or -FVE-FS- (BITLOCKER) ; This will load the drive paths into memory
'usedrive' : Set the drive to use; can use numbers assigned from the 'list' command
'modules' : List modules ; This will load the module names into memory, so you need to run this command before selecting a module
'use' : Use the selected module

Setup :

(need to run as root because PyPyKatz' import path directory is dependent on the current user, and this needs to run as root)
sudo pip3 install -r requirements.txt
sudo python3 tofu.py

Built With :

PyCryptodome
PypyKatz

Warning : If you're writing a module, make sure it won't do any damage before running it