Comments (6)
I deploy the exact same machine on Azure, and this time, the stacktrace is:
Process Process-5:
Traceback (most recent call last):
[...]
File "/home/aas/spraykatz/core/ParseDump.py", line 23, in parseDump
result = pypykatz.parse_minidump_external(dump)
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/pypykatz.py", line 96, in parse_minidump_external
mimi.start()
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/pypykatz.py", line 245, in start
self.get_logoncreds()
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/pypykatz.py", line 146, in get_logoncreds
logoncred_decryptor.start()
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 367, in start
self.walk_list(entry_ptr, self.add_entry)
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/lsadecryptor/package_commons.py", line 179, in walk_list
callback(entry)
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/lsadecryptor/packages/msv/decryptor.py", line 284, in add_entry
self.walk_list(entry.Credentials_list_ptr, self.add_credentials)
File "/home/aas/.local/lib/python3.6/site-packages/pypykatz/lsadecryptor/package_commons.py", line 174, in walk_list
entry = entry_ptr.read(self.reader)
File "/home/aas/.local/lib/python3.6/site-packages/minidump/win_datatypes.py", line 19, in read
reader.move(self.value)
File "/home/aas/.local/lib/python3.6/site-packages/minidump/minidumpreader.py", line 84, in move
self._select_segment(address)
File "/home/aas/.local/lib/python3.6/site-packages/minidump/minidumpreader.py", line 55, in _select_segment
raise Exception('Memory address 0x%08x is not in process memory space' % requested_position)
Exception: Memory address 0x00100010 is not in process memory space
Hope it helps...
from pypykatz.
Please send the dump file. (I guess you can upload to the link shown on the readme)
from pypykatz.
Hi,
I already did it. Tell me if you want me to upload it again.
Thanks.
from pypykatz.
I see 2 different dump files uploaded recently. One works with default parsing and with parse_external. The second one (which is win 2012) did not work at all, because of a parsing error in one of the structures. The error is fixed now in the GH version and should be working. Please confirm and close the issue.
As for the parse_minidump_external
part. I made some tests and it seems to be working well. Please use the attached script to check if it's in fact broken in the future. I took a look at how you are invoking the function in your code and while it looks okayish it kinda missing a lot of exception handling around the network/impacket side so I'd recommend double checking if all the SMB file handling and buffering working as it should. But this is not part of pypykatz so I'm going back curing my hangover.
Nah, just kiddingsince I hate being vague. Basically what is wrong with your Dump class is:
- you put a lot of network operations in the constructor, shouldn't be doing that. create an
open
function instead - The fileopen call tries to obtain ALL permissions to a file, but you just want to read it, and procdump might create a file that is not owned by the account you are using for SMB and might not be writable
- EXCEPTION HANDLING in almost all functions. This is a network operation thus you can't really control what will happen during reads/opens/etc.
from pypykatz.
Hi,
Indeed, you are right, I should be more rigorous. As I am not a good developper, I take every advices.
About the two dumps, I confirm it works as expected now.
Thank you for your hard work :).
from pypykatz.
Exception: Memory address 0x0a0007d0 is not in process memory space
from pypykatz.
Related Issues (20)
- AttributeError: 'collections.OrderedDict' object has no attribute 'kirbiobj' HOT 2
- LIVE DPAPI wiki mentions "chrome" but it isn't documented HOT 1
- LM Hash not being picked up. HOT 1
- pypykatz lsa minidump lsass.DMP (Exception: All detection methods failed) HOT 3
- The parsing password is hex, how should I use it?
- How to package it into exe? HOT 1
- Errors when 'pypykatz live lsa'
- Is it possible to get account password? HOT 3
- Kali Linux error LibraryNotFoundError: Error detecting the version of libcrypto HOT 10
- Exception: Could not find module! lsasrv.dll HOT 2
- load_rsa_private_numbers() missing 1 required positional argument: 'unsafe_skip_rsa_key_validation' HOT 1
- Win11: Incorrect minidump parse for DPAPI masterkeys
- kerberos brute: 'generator' object is not subscriptable HOT 3
- Exception: Could not find module! lsasrv.dll HOT 2
- Windows7 lsass.DMP under Pypykatz 069 HOT 1
- utf-8 nanodump + pypykatz HOT 2
- No module named 'winacl.dtyp.wcee.cryptoapikey' HOT 1
- LSA signature not found HOT 4
- how to use masterkey to Decrypting files
- Error C2065: 'FFI_STDCALL': undeclared identifier HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from pypykatz.