Import entire secretsdump library and switch log.error to log.debug
This PR fixes secretsdump printing an error log when it doesn't find any hash for an account in the SAM database:
This is because Windows uses default system accounts (such as WDAGUtilityAccount which is used by windows defender to test binaries in a virtual environment). Such accounts do not have authentication secrets and for a weird reason, impacket treats that as a LOG.error which results in the output of DonPAPI being messed up.
To remove this, I simply merged impacket/examples/secretsdump.py and impacket/impacket/examples/secretsdump.py together and switched the LOG.error to LOG.debug. I also removed the hexdump of the NL$KM value line 1661:
# Default print, hexdump
printableSecret = '%s:%s' % (name, hexlify(secretItem).decode('utf-8'))
self.__secretItems.append(printableSecret)
# If we're using the default callback (ourselves), we print the hex representation. If not, the
# user will need to decide what to do.
if self.__module__ == self.__perSecretCallback.__module__:
#hexdump(secretItem)
pass
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA_RAW, printableSecret)
This is a brutal fix so I also created an issue on Impacket to track this (https://github.com/fortra/impacket/issues/1839).