Secretsdump not dumping hashes with recent W10

[dirkjanm]

I've had this pop up a few times recently with newer setups:

Impacket v0.9.16-dev - Copyright 2002-2017 Core Security Technologies

[*] Running in relay mode to single host
[*] Config file parsed
[*] Setting up SMB Server
[*] Setting up HTTP Server

[*] Servers started, waiting for connections
[*] HTTPD: Received connection from 192.168.1.11, attacking target 192.168.1.10
[*] Authenticating against 192.168.1.10 as TEST\testuser SUCCEED
<snip>
[*] Service RemoteRegistry is in stopped state
[*] Service RemoteRegistry is disabled, enabling it
[*] Starting service RemoteRegistry
[*] Target system bootKey: 0x6ae85705a04b605873a6145092681ac0
[*] Dumping local SAM hashes (uid:rid:lmhash:nthash)
[-] hashedBootKey CheckSum failed, Syskey startup password probably in use! :(
[*] Stopping service RemoteRegistry
[*] Restoring the disabled state for service RemoteRegistry

This is on a new domain against a new Windows 10 VM. I've also seen this on recent 2012R2 and 2016 servers. The issue also occurs when running secretsdump standalone.

This is probably related to this:
rapid7/metasploit-framework#8582
gentilkiwi/mimikatz@823d376

Any chance we can get this in secretsdump as well? Should be a relatively simple change if I look at the msf code.

[asolino]

Hey @dirkjanm, thanks for the report.

Yes.. I've been aware of it for quite a long time already. But it only happened to me against 2016 Servers.. Never W10/2012R2 (That's why it had low priority for now). I know what needs to be changed so it shouldn't be that hard (thanks to @gentilkiwi actually :)). It's all AES instead of RC4 and a few structure changes. Stay tuned.

[asolino]

Hey @dirkjanm, please git pull and give it a try. Testing is needed to be sure both approaches work. Thanks!

Close this issue if working on your side.

[dirkjanm]

Thanks @asolino, works like a charm! My 2012R2 is actually using the old format, so maybe I was mistaken on that part, but dumping hashes from W10 is working perfectly again. Thanks for the quick reply and fix, much appreciated.