impacket
impacket copied to clipboard
Improve VSS parsing: robust, language-agnostic handling and safe cleanup
Description
This PR improves the way secretsdump.py parses the output of vssadmin when retrieving shadow copies.
Previously, the code relied on English-specific keywords (e.g. "Shadow Copy ID:", "Volume:"), which caused failures on systems where vssadmin output is localized (e.g. French, German, Spanish).
This patch introduces a regex-based parsing mechanism that:
-
Extracts the GLOBALROOT path directly,
-
Searches for nearby GUIDs ({xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}),
-
Detects volume letters ((C:), (D:), …) independently of the language,
-
Adds fallbacks if parsing fails,
-
Improves error handling when deleting shadows.
This makes secretsdump more robust across non-English domain controllers.
Before :
After :