Impossible to find Pek-List attribute in ntds file

[quentinhardy]

Hello,

I am trying to use secretsdump.py for extracting hashes from a big ntds.dit file which has been copied with vssadmin.

When I run secretsdump.py, it seems the script doesn't find the Pek-List attribute:

Impacket v0.9.17-dev - Copyright 2002-2018 Core Security Technologies

[*] Target system bootKey: 0x****************************
[*] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[*] Searching for pekList, be patient
[-] Error while calling getNextRow(), trying the next one
[-] Error while calling getNextRow(), trying the next one
[-] Error while calling getNextRow(), trying the next one
[-] Error while calling getNextRow(), trying the next one
[-] Error while calling getNextRow(), trying the next one
[-] Error while calling getNextRow(), trying the next one
[...]
Killed

This attribute is required for decrypting hashes.

I have the same bug with impdump project (HarmJ0y/ImpDump#5) wich uses the impacket project (e.g. esentutl.py).

Notice esedbexport is running on this same ntds file (from some days) and there is an "ATTk590689" (Pek-List) attribute in database file (database.4 file). It is not finish but if I take this "ATTk590689" value from database.4 file and I use it directly in source code of https://github.com/HarmJ0y/ImpDump/blob/master/impdump.py, it works! : I can extract decrypted hashes.

So I think it is a bug in impacket -:(

Do you known if it a well known problem?

Thanks in advance for your help,

[asolino]

Hey @quentinhardy

First time I hear about this issue.

According to your tests, looks like there's a bug in the getNextRow() code.

Now, without a way to reproduce this bug, it is almost imposible to determine where the problem is (in particular due to the complexity of the ESE format). Can you provide the DIT and registry hives to reproduce it?

If not, another alternative is for you to figure out where the problem is.

thanks,

[quentinhardy]

Hello,

Unfortunately, I can't send you the ntds.dit file with the SYSTEM file.

I will try to search the problem.

[echobb8]

Any resolution to this? @quentinhardy how did you discover the Pek-List value? I'm getting the same issues as you reported in the OP on two ntds.dit files.

[asolino]

Should be fixed in 9efa50f