pypykatz lsa minidump lsass.DMP (Exception: All detection methods failed)

[sudo-joe]

Hello

used the following command on Kali Linux 'pypykatz lsa minidump lsass.DMP' (collected with the Windows10 Taskmanager as Admin:) but get the following error message:

Am I doing something wrong? Thank's for your help!

└─$ pypykatz lsa minidump lsass.DMP INFO:root:Parsing file lsass.DMP INFO:pypykatz:===== BASIC INFO. SUBMIT THIS IF THERE IS AN ISSUE ===== INFO:pypykatz:pypyKatz version: 0.4.9 INFO:pypykatz:CPU arch: X64 INFO:pypykatz:OS: Windows 10 INFO:pypykatz:BuildNumber: 22621 INFO:pypykatz:MajorVersion: 6 INFO:pypykatz:MSV timestamp: 4168883897 INFO:pypykatz:===== BASIC INFO END ===== ERROR:root:Error while parsing file lsass.DMP Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 261, in get_lsa lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor.py", line 20, in choose return LsaDecryptor_NT6(reader, decryptor_template, sysinfo) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 22, in init self.acquire_crypto_material() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 30, in acquire_crypto_material self.iv = self.get_IV(sigpos) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 58, in get_IV self.reader.move(ptr_iv) File "/usr/lib/python3/dist-packages/minidump/minidumpreader.py", line 136, in move self._select_segment(address) File "/usr/lib/python3/dist-packages/minidump/minidumpreader.py", line 104, in _select_segment raise Exception('Memory address 0x%08x is not in process memory space' % requested_position) Exception: Memory address 0x7ffd571c8e58 is not in process memory space

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/cmdhelper.py", line 230, in run mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 150, in parse_minidump_file raise e File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 146, in parse_minidump_file mimi.start(packages) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 350, in start self.lsa_decryptor = self.get_lsa() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 267, in get_lsa raise Exception('All detection methods failed.') Exception: All detection methods failed. Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 261, in get_lsa lsa_dec = LsaDecryptor.choose(self.reader, lsa_dec_template, self.sysinfo) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor.py", line 20, in choose return LsaDecryptor_NT6(reader, decryptor_template, sysinfo) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 22, in init self.acquire_crypto_material() File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 30, in acquire_crypto_material self.iv = self.get_IV(sigpos) File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/lsa_decryptor_nt6.py", line 58, in get_IV self.reader.move(ptr_iv) File "/usr/lib/python3/dist-packages/minidump/minidumpreader.py", line 136, in move self._select_segment(address) File "/usr/lib/python3/dist-packages/minidump/minidumpreader.py", line 104, in _select_segment raise Exception('Memory address 0x%08x is not in process memory space' % requested_position) Exception: Memory address 0x7ffd571c8e58 is not in process memory space

During handling of the above exception, another exception occurred:

Traceback (most recent call last): File "/usr/lib/python3/dist-packages/pypykatz/lsadecryptor/cmdhelper.py", line 230, in run mimi = pypykatz.parse_minidump_file(args.memoryfile, packages=args.packages) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 150, in parse_minidump_file raise e File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 146, in parse_minidump_file mimi.start(packages) File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 350, in start self.lsa_decryptor = self.get_lsa() File "/usr/lib/python3/dist-packages/pypykatz/pypykatz.py", line 267, in get_lsa raise Exception('All detection methods failed.') Exception: All detection methods failed.

[sudo-joe]

Hi,

-> # pypykatz lsa minidump lsass.DMP ->Exception: All detection methods failed Is this more likely a technical issue or is the op(me:) the problem ?

Thank you very much!

[valerable]

The error you are receiving is likely related to a parsing error by pypykatz. Judging by the version of Windows from your dump (Build 22621 aka. Windows 11), pypykatz can not parse the dump since the correct signature and offsets for the AES and TDES keys in the LSASS dump have changed in that version of Windows.

I was facing a similar issue, but I found success when updating pypykatz to version 6.8 for dumps from Windows 11. Try updating to 6.8 and parsing again?

[sudo-joe]

Thank you very much valerable for the help!

After updating Pypykatz to version 6.8 it looks much better, but surprisingly the entire TSPKG-section (just after Kerberos) with the password is missing.

Any idea what going wrong?

Thank's!