Closed forensenellanebbia closed 2 years ago
I managed to create three test minidumps that I just uploaded to your storage share:
File: lsass_WS2012std_Build9200_no-patches.DMP
IMAGE_NAME: lsass.exe OS_VERSION: 6.2.9200.16384 IMAGE_VERSION: 6.2.9200.16384 pypykatz: OK, minidump parsed with no issues
File: lsass_WS2012std_Build9200_kb5003696.DMP
IMAGE_NAME: lsass.exe OS_VERSION: 6.2.9200.16384 IMAGE_VERSION: 6.2.9200.23376 pypykatz: Exception: All detection methods failed
File: lsass_WS2012std_Build9200_kb5003697.DMP
IMAGE_NAME: lsass.exe OS_VERSION: 6.2.9200.16384 IMAGE_VERSION: 6.2.9200.23376 pypykatz: Exception: All detection methods failed
Based on what I've found, it seems pypykatz is unable to parse lsass minidumps from Windows Server 2012 (default setup with no additional settings configured) when the patches kb5003696 and kb5003697 are installed.
Thank you for the dump files!
I checked them and it looks to me that the problem is not with the parsing code rather missing templates therefore mimikatz
also can't parse them.
I managed to get the correct AES and DES structure offsets using the latest ML/AI/blockchain/web3.0 methods (read: guessed them) but currently looking for the correct IV (which is weird because it half-works?!). Also the correct MSV structure type/offset is still not found.
Okay, I managed to construct a working template! Now I'm trying to integrate it somehow to the existing codebase
fix is now merged to master, please let me know if it works on your end!
I tried it against the original dump and it works even better than expected!! Awesome, thanks a lot!
Hi, I've got an LSASS memory dump (~140 MB) that I'm unable to parse with pypykatz. Unfortunately I can't share the file, but I can try to provide additional details if needed.
I installed the latest version available through cloning the repo and I'm running it on Ubuntu 20.04.3 LTS w/ Python 3.8.10. This is the message I get:
If I run minidump against the file, I get this output:
Is there anything else that I could check? Thanks