ModuleNotFoundError for msldap when starting pypykatz

[Moneysac90]

When starting pypykatz i receive an ModuleNotFoundError for msldap. The package is of course installed.

──(kali㉿kali)-[/tmp]
└─$ pypykatz                                                  
Traceback (most recent call last):
  File "/usr/bin/pypykatz", line 33, in <module>
    sys.exit(load_entry_point('pypykatz==0.4.9', 'console_scripts', 'pypykatz')())
  File "/usr/lib/python3/dist-packages/pypykatz/__main__.py", line 16, in main
    from pypykatz.kerberos.cmdhelper import KerberosCMDHelper
  File "/usr/lib/python3/dist-packages/pypykatz/kerberos/cmdhelper.py", line 17, in <module>
    from pypykatz.kerberos.kerberos import get_TGS, get_TGT, generate_targets, \
  File "/usr/lib/python3/dist-packages/pypykatz/kerberos/kerberos.py", line 11, in <module>
    from msldap.commons.url import MSLDAPURLDecoder
ModuleNotFoundError: No module named 'msldap.commons.url'

This are my installed packages:

pip3 install minidump minikerberos aiowinreg msldap winacl
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: minidump in /usr/lib/python3/dist-packages (0.0.21)
Requirement already satisfied: minikerberos in /home/kali/.local/lib/python3.10/site-packages (0.3.5)
Requirement already satisfied: aiowinreg in /usr/lib/python3/dist-packages (0.0.7)
Requirement already satisfied: msldap in /usr/lib/python3/dist-packages (0.4.7)
Requirement already satisfied: winacl in /usr/lib/python3/dist-packages (0.1.5)
Requirement already satisfied: tqdm in /usr/lib/python3/dist-packages (from minikerberos) (4.64.1)
Requirement already satisfied: oscrypto>=1.2.1 in /usr/lib/python3/dist-packages (from minikerberos) (1.3.0)
Requirement already satisfied: asysocks>=0.2.2 in /usr/lib/python3/dist-packages (from minikerberos) (0.2.2)
Requirement already satisfied: unicrypto>=0.0.9 in /usr/lib/python3/dist-packages (from minikerberos) (0.0.9)
Requirement already satisfied: asn1crypto>=1.3.0 in /usr/lib/python3/dist-packages (from minikerberos) (1.5.1)
Requirement already satisfied: asyauth>=0.0.7 in /usr/lib/python3/dist-packages (from msldap) (0.0.9)

[skelsec]

based on your traceback, you are using pypykatz version 0.4.9. The current public version is 0.6.3.
Since you're on kali linux, I'd advise you to create a virtual environment for python using the venv module and install pypykatz from github.
Example:

sudo apt install python3-venv
python3 -m venv pypykatzenv
source pypykatzenv/bin/activate
git clone https://github/com/skelsec/pypykatz.git
cd pypykatz
pip install setup.py

This example might not be fully correct as I just wrote it based on memory, bu you get the idea

[Pentest0fu]

I have the same issue with version 0.6.3

[Pentest0fu]

└─$ pypykatz
Traceback (most recent call last):
File "/usr/bin/pypykatz", line 33, in
sys.exit(load_entry_point('pypykatz==0.4.9', 'console_scripts', 'pypykatz')())
File "/usr/local/lib/python3.10/dist-packages/pypykatz-0.6.3-py3.10.egg/pypykatz/main.py", line 17, in main
File "/usr/local/lib/python3.10/dist-packages/pypykatz-0.6.3-py3.10.egg/pypykatz/kerberos/cmdhelper.py", line 19, in
File "/usr/local/lib/python3.10/dist-packages/pypykatz-0.6.3-py3.10.egg/pypykatz/kerberos/kerberos.py", line 7, in
ImportError: cannot import name 'KerberosUserEnum' from 'minikerberos.security' (/usr/local/lib/python3.10/dist-packages/minikerberos/security.py)

[Pentest0fu]

Tried on a fresh ubuntu wsl installation.

[socksarethebest]

can confirm

[QU35T-code]

Hey everyone,

Minikerberos released a new version yesterday.

The problem is related to the new version.
In order to fix the bug, you must install minikerberos version 0.3.5 :

python3 -m pip install minikerberos==0.3.5

Or, you can use pipx !

POC :

root@41ba79158f1b:/# python3 -m pipx install pypykatz
  installed package pypykatz 0.6.3, installed using Python 3.9.2
  These apps are now globally available
    - pypykatz
⚠️  Note: '/root/.local/bin' is not on your PATH environment variable. These apps will not be globally accessible
    until your PATH is updated. Run `pipx ensurepath` to automatically add it, or manually modify your PATH in your
    shell's config file (i.e. ~/.bashrc).
done! ✨ 🌟 ✨
root@41ba79158f1b:/# python3 -m pipx inject pypykatz minikerberos==0.3.5
  injected package minikerberos into venv pypykatz
done! ✨ 🌟 ✨
root@41ba79158f1b:/# /root/.local/bin/pypykatz
usage: pypykatz [-h] [-v] {live,lsa,registry,crypto,kerberos,dpapi,ldap,rdp,parser,smb,version,banner,logo} ...
pypykatz: error: the following arguments are required: command
root@41ba79158f1b:/#

ImportError: cannot import name 'KerberosUserEnum' from 'minikerberos.security' (/usr/local/lib/python3.9/dist-packages/minikerberos-0.4.0-py3.9.egg/minikerberos/security.py)

root@41ba79158f1b:/pypykatz# python3 -m pip install minikerberos==0.3.5
Collecting minikerberos==0.3.5

[...TRUNCATED DATA...]

Successfully installed minikerberos-0.3.5

root@41ba79158f1b:/pypykatz# pypykatz
usage: pypykatz [-h] [-v] {live,lsa,registry,crypto,kerberos,dpapi,ldap,rdp,parser,smb,version,banner,logo} ...
pypykatz: error: the following arguments are required: command

[Pentest0fu]

Thank you very much @QU35T-code. Also the hint with pipx - tried it out and works like a charm.

[skelsec]

Hello everyone!
I did the thing where I updated a module and went on a conference.
What is happening is the following: minikerberos module got updated to a breaking API version and since none of my modules have an upper cap on the required module versions that one slid in on new installs. Reason I haven't noticed is that mainline pypykatz is hosted on Porchetta Industries' git servers and my test version is also there.
I'm happy to see many ppl jumped in here with solutions, that's awesome! The official solution will be that I'll push the current private version of pypykatz here as well.
Some users might not be aware, but I'm also publishing the latest version of pypykatz bundled with a tool called octopwn which is WASM based, so it runs in your browser. When you have problems with LSASS parsing you can simply visit octopwn's website and parse your LSASS dumps there.

[InfiniteBSOD]

based on your traceback, you are using pypykatz version 0.4.9. The current public version is 0.6.3. Since you're on kali linux, I'd advise you to create a virtual environment for python using the venv module and install pypykatz from github. Example:

sudo apt install python3-venv
python3 -m venv pypykatzenv
source pypykatzenv/bin/activate
git clone https://github/com/skelsec/pypykatz.git
cd pypykatz
pip install setup.py

This example might not be fully correct as I just wrote it based on memory, bu you get the idea

Disclaimer:
I'm new to using Python so please bear with me

Windows 10 22H2
Python 3.11.2

Using Windows Terminal (PowerShell):

To create a virtual environment called "pypykatz_venv"
python -m venv pypykatz_venv
To activate aforementioned virtual environment
.\pypykatz_venv\Scripts\activate
To clone the pypykatz GitHub repo
git clone https://github.com/skelsec/pypykatz.git
To enter the cloned pypykatz directory
cd .\pypykatz\
To install pypykatz
pip install setup.py
^ Above fails with

ERROR: Could not find a version that satisfies the requirement setup.py (from versions: none)
ERROR: No matching distribution found for setup.py

Err...I googled around a bit and found the command:
python .\setup.py develop
which returns A LOT of output however it still seems to install "minikerberos" 0.4.0 even though it searches for 0.3.5 and 0.3.5 seems to be available:
https://pypi.org/simple/minikerberos/

Checking "pip list" returns:
minikerberos 0.4.0

Any ideas?

[skelsec]

@InfiniteBSOD the issue is not on your end, what you did looks good. I was planning on uploading the new version of pypykatz when minikerberos package was released but that didn't happen until now.
Please try it again, it should fix everything.

[skelsec]

Now with the new version is up on both pyp and github (and in the releases) pls someone on this thread verify it is solved so I can close this.

[QU35T-code]

Tests with the new release seems to works fine. We can close this issue !
Thanks @skelsec !