Red Team Consultant @ Google | MS in Cybersecurity @ NYU
● Notice //GitHub (@shehzade) is temporarily suspended pending an automated false-positive review. All tools are hosted on this Code Mirror and available on request (contact); GitHub links will return once reinstated.
repos / naa-dump-offline
PUBLIC MIRRORGo v1.0.0Misconfig Mgr PR #63 ↗

Offline extractor and decryptor for SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk WMI repositories and DPAPI master keys.

$ git clone https://shehzade.io/repos/naa-dump-offline.git Copy
Source ZIP (290.0 KB) Prebuilt Binaries
Code 15 Commits 3 Releases 5
docs: add demo screenshot to README
Abdullah Ansari · 2026-11-11 00:44 · 1435fe39d27e6705281761aeac11c5b3f7118ad0
+2 -0 ← All Commits
README.md
......@@ -2,6 +2,8 @@
22
33 Offline tool to carve and decrypt SCCM/MECM Network Access Account (NAA) credentials and policy secrets from dead-disk artifacts (`OBJECTS.DATA`, registry hives, and DPAPI master keys).
44
5+![naa-dump-offline demo](docs/images/naa-dump-offline-demo.png)
6+
57 ## Table of Contents
68
79 - [Why / The Gap This Fills](#why--the-gap-this-fills)