DonPAPI icon indicating copy to clipboard operation
DonPAPI copied to clipboard

Import entire secretsdump library and switch log.error to log.debug

Open Dfte opened this issue 1 year ago • 0 comments

This PR fixes secretsdump printing an error log when it doesn't find any hash for an account in the SAM database:

image

This is because Windows uses default system accounts (such as WDAGUtilityAccount which is used by windows defender to test binaries in a virtual environment). Such accounts do not have authentication secrets and for a weird reason, impacket treats that as a LOG.error which results in the output of DonPAPI being messed up.

To remove this, I simply merged impacket/examples/secretsdump.py and impacket/impacket/examples/secretsdump.py together and switched the LOG.error to LOG.debug. I also removed the hexdump of the NL$KM value line 1661:

# Default print, hexdump
printableSecret  = '%s:%s' % (name, hexlify(secretItem).decode('utf-8'))
self.__secretItems.append(printableSecret)
# If we're using the default callback (ourselves), we print the hex representation. If not, the
# user will need to decide what to do.
if self.__module__ == self.__perSecretCallback.__module__:
    #hexdump(secretItem)
    pass
self.__perSecretCallback(LSASecrets.SECRET_TYPE.LSA_RAW, printableSecret)

This is a brutal fix so I also created an issue on Impacket to track this (https://github.com/fortra/impacket/issues/1839).

Dfte avatar Oct 21 '24 08:10 Dfte