BC-SECURITY / Empire

Empire is a post-exploitation and adversary emulation framework that is used to aid Red Teams and Penetration Testers.
https://bc-security.gitbook.io/empire-wiki/
BSD 3-Clause "New" or "Revised" License
4.17k stars 570 forks source link

Mimikatz dsync hashump error #7

Closed Cx01N closed 4 years ago

Cx01N commented 4 years ago

Empire Version

Python3-hubble-1

OS Information (Linux flavor, Python version)

Kali Linux, Python 2.7

Expected behavior and description of the error, including any actions taken immediately prior to the error. The more detail the better.

Error when running dsync hashump from mimikatz. /credentials/mimikatz/dcsync_hashdump

Specified cast is not valid. At line:1877 char:13 if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_D ... CategoryInfo : OperationStopped: (:) [], InvalidCastException FullyQualifiedErrorId : `System.InvalidCastException

Specified cast is not valid. At line:1923 char:13 if (($PEInfo.DllCharacteristics -band $Win32Constants.IMAGE_D ... CategoryInfo : OperationStopped: (:) [], InvalidCastException FullyQualifiedErrorId : System.InvalidCastException

Exception calling "GetCurrentDomain" with "0" argument(s): "Current security context is not associated with an Active Directory domain or forest." At line:73 char:17 [System.DirectoryServices.ActiveDirectory.Domain]::GetCur ... CategoryInfo : NotSpecified: (:) [], MethodInvocationException FullyQualifiedErrorId : ActiveDirectoryOperationException

The property 'name' cannot be found on this object. Verify that the property exists. At line:2157 char:9 $TargetDomains = @( (Get-NetDomain).name ) CategoryInfo : NotSpecified: (:) [], PropertyNotFoundException FullyQualifiedErrorId : PropertyNotFoundStrict

Screenshot of error, embedded text output, or Pastebin link to the error

Any additional information

The error appears to originate in Powershell and not python.

Cx01N commented 4 years ago

Initial error fixed. The module returns a table of hashes, but gets a PowerShell error Specified cast is not valid.

image