search

gentilkiwi / mimikatz

A little tool to play with Windows security
http://blog.gentilkiwi.com/mimikatz
19.48k stars 3.74k forks source link

Fix for out of order encrypted_key in local state #435

Open ChrisPritchard opened 1 year ago

ChrisPritchard commented 1 year ago

os_crypt can contain multiple fields, and encrypted_key is not guarenteed to be first

however, to my knowledge, encrypted_key as a field name is only in local state once so simply searching for that alone should suffice.

ChrisPritchard commented 1 year ago

discovered during a ctf where localstate os_crypt was like: "os_crypt":{"app_bound_fixed_data":"...","encrypted_key":"..."}