Lsaas process finder fails

skelsec / pypykatz

Mimikatz implementation in pure Python

MIT License

2.81k stars 371 forks source link

Lsaas process finder fails #90

Closed VakarisZ closed 2 years ago

VakarisZ commented 3 years ago

The line in live_reader_ctypes.py:68:

pid_to_name[pid] = QueryFullProcessImageNameW(process_handle)

fails to me with an error (WinError 31) A device attached to the system is not functioning. This fails the whole mimikatz collection, even though the lsass process was already found and is in pid_to_name dict.

I've seen the stale #69 PR that also addresses this. @skelsec @ebfe90 let me know if you intend to fix it. If not, I'll open up my own PR.

skelsec commented 3 years ago

Hello! Can you please send some more info so I can try to track down this issue? Windows version/pypykatz version/is there Av running/other stuff you feel relevant

VakarisZ commented 3 years ago

I'm using windows 10, tried versions 0.3.12 and the latest (0.5.2). AV is running. But none of this is relevant, because the error is thrown from the lower level function windll.kernel32.QueryFullProcessImageNameW. The issue of your package is that this error is not handled even though the lsass process was already found. Simply moving the pid_to_name[pid] = QueryFullProcessImageNameW(process_handle) into the try block solved this issue for me (the error gets caught and the code continues).