Skip to content

support multiple PEKs in Windows 2016 - #618

Merged
asolino merged 1 commit into
fortra:masterfrom
mikeryan:win2016-multiple-peks
Apr 28, 2019
Merged

support multiple PEKs in Windows 2016#618
asolino merged 1 commit into
fortra:masterfrom
mikeryan:win2016-multiple-peks

Conversation

@mikeryan

Copy link
Copy Markdown
Contributor

__decryptHash was throwing IndexError on Windows 2016 if a hash was
encrypted with a PEK with a higher index than 0. This patch attempts to
extract all keys from the PEK list. The PEK list format was reverse
engineering by eyeball. YMMV.

If this bug is triggered in the existing code, it will output an error like this:

[-] Error while processing row for user *redacted*
[-] list index out of range

The traceback looks something like this (line numbers may vary):

Traceback (most recent call last):
  File ".../site-packages/impacket/examples/secretsdump.py", line 2380, in dump
    self.__decryptHash(record, outputFile=hashesOutputFile)
  File ".../site-packages/impacket/examples/secretsdump.py", line 2093, in __decryptHash
    tmpNTHash = self.__cryptoCommon.decryptAES(self.__PEK[int(pekIndex[8:10])],
IndexError: list index out of range

__decryptHash was throwing IndexError on Windows 2016 if a hash was
encrypted with a PEK with a higher index than 0. This patch attempts to
extract all keys from the PEK list. The PEK list format was reverse
engineering by eyeball. YMMV.
@mikeryan
mikeryan force-pushed the win2016-multiple-peks branch from 1b71e95 to cb7793b Compare April 26, 2019 16:57
@asolino
asolino merged commit cb7793b into fortra:master Apr 28, 2019
@asolino

asolino commented Apr 28, 2019

Copy link
Copy Markdown
Collaborator

Thanks a lot @mikeryan!, Merged!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants