Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SAM Dump for accounts without secrets #1839

Open
Dfte opened this issue Oct 20, 2024 · 0 comments
Open

SAM Dump for accounts without secrets #1839

Dfte opened this issue Oct 20, 2024 · 0 comments
Assignees
Labels
in review This issue or pull request is being analyzed

Comments

@Dfte
Copy link

Dfte commented Oct 20, 2024

I realised that some defaults Windows accounts, like for example WDAGUtilityAccount, throw the following error:

image

However there is no error here. WDAGUtilisatyAccount does not have a NT hash in the SAM database because this is a virtual account used to contain applications in a sandbox (for example browsers) and these featuers are not used on windows servers. Considering I never saw secretsdump failing in dumping SAM database, I believe it is possible to switch the following liens from impacket/impacket/examples/secretsdump.py:

if userAccount['NTHashLength'] == 0:
    logging.error('SAM hashes extraction for user %s failed. The account doesn\'t have hash information.' % userName)
    continue

to

if userAccount['NTHashLength'] == 0:
    logging.debug('SAM hashes extraction for user %s failed. The account doesn\'t have hash information.' % userName)
    continue

That way most of tools using impacket secretsdump won't have a messed up output.

Let me know what you think about this :)

@Dfte Dfte changed the title SAM Dump for accoutns without secrets SAM Dump for accounts without secrets Oct 20, 2024
@gabrielg5 gabrielg5 self-assigned this Nov 7, 2024
@anadrianmanrique anadrianmanrique added the in review This issue or pull request is being analyzed label Nov 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in review This issue or pull request is being analyzed
Projects
None yet
Development

No branches or pull requests

3 participants