Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

support multiple PEKs in Windows 2016 #618

Merged
merged 1 commit into from Apr 28, 2019

Conversation

mikeryan
Copy link
Contributor

__decryptHash was throwing IndexError on Windows 2016 if a hash was
encrypted with a PEK with a higher index than 0. This patch attempts to
extract all keys from the PEK list. The PEK list format was reverse
engineering by eyeball. YMMV.

If this bug is triggered in the existing code, it will output an error like this:

[-] Error while processing row for user *redacted*
[-] list index out of range

The traceback looks something like this (line numbers may vary):

Traceback (most recent call last):
  File ".../site-packages/impacket/examples/secretsdump.py", line 2380, in dump
    self.__decryptHash(record, outputFile=hashesOutputFile)
  File ".../site-packages/impacket/examples/secretsdump.py", line 2093, in __decryptHash
    tmpNTHash = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
IndexError: list index out of range

__decryptHash was throwing IndexError on Windows 2016 if a hash was
encrypted with a PEK with a higher index than 0. This patch attempts to
extract all keys from the PEK list. The PEK list format was reverse
engineering by eyeball. YMMV.
@asolino asolino merged commit cb7793b into fortra:master Apr 28, 2019
@asolino
Copy link
Collaborator

asolino commented Apr 28, 2019

Thanks a lot @mikeryan!, Merged!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants