search

mlgualtieri / NTLMRawUnHide

NTLMRawUnhide.py is a Python3 script designed to parse network packet capture files and extract NTLMv2 hashes in a crackable format. The following binary network packet capture formats are supported: *.pcap *.pcapng *.cap *.etl
MIT License
316 stars 65 forks source link

Recursion Error #3

Open spinone opened 1 year ago

spinone commented 1 year ago

This works well, and it runs for a while using python NTLMRawUnHide.py -i tsharkoutput.pcapng -f -o tsharkhashes.txt It finds and saves some hashes, but eventually fails with the following:

Traceback (most recent call last): File "c:\apps\NTLM\NTLMRawUnHide.py", line 413, in main(sys.argv[1:]) File "c:\apps\NTLM\NTLMRawUnHide.py", line 408, in main searchCaptureFile(infile, outfile, verbose, follow, quiet, 0) File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte) File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte) File "c:\apps\NTLM\NTLMRawUnHide.py", line 263, in searchCaptureFile searchCaptureFile(infile, outfile, verbose, follow, quiet, last_byte) [Previous line repeated 990 more times] File "c:\apps\NTLM\NTLMRawUnHide.py", line 92, in searchCaptureFile with open(infile, 'rb') as fp: RecursionError: maximum recursion depth exceeded while calling a Python object.

packets are captured in a separate (root) terminal using tshark -a filesize:1000000 -i 7 -f "tcp port 445" -F pcapng -w tsharkoutput.pcapng

mlgualtieri commented 1 year ago

Oh interesting. I didn't actually know there were recursion limits in Python. I think it would be pretty simple to restructure this to be iterative and use a loop. I will look into this soon when I get a chance.

Based on a couple quick searches I just did, I think the default recursion limit in Python is 1000, and it can be changed like so:

sys.setrecursionlimit(2000)

I'm not sure the implications of changing this, but if you add a line like this at the top you can extend out the recursion limit. This may be a quick workaround for you in the meantime.