search

zblurx / dploot

DPAPI looting remotely and locally in Python
MIT License
420 stars 55 forks source link

Exception on machinetriage module when certificate has no SAN #20

Closed Macmod closed 3 months ago

Macmod commented 4 months ago

Command $ dploot machinetriage 192.168.100.105 -u XXX -p YYY -debug

Error

Traceback (most recent call last):
  File "/home/macmod/.local/pipx/venvs/dploot/lib/python3.11/site-packages/dploot/entry.py", line 79, in main
    actions[options.action](options)
  File "/home/macmod/.local/pipx/venvs/dploot/lib/python3.11/site-packages/dploot/action/machinetriage.py", line 117, in entry
    a.run()
  File "/home/macmod/.local/pipx/venvs/dploot/lib/python3.11/site-packages/dploot/action/machinetriage.py", line 90, in run
    certificates = certificate_triage.triage_system_certificates()
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/macmod/.local/pipx/venvs/dploot/lib/python3.11/site-packages/dploot/triage/certificates.py", line 92, in triage_system_certificates
    certificates = self.correlate_certificates_and_privatekeys(certs=certs, private_keys=pkeys, winuser='SYSTEM')
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/macmod/.local/pipx/venvs/dploot/lib/python3.11/site-packages/dploot/triage/certificates.py", line 213, in correlate_certificates_and_privatekeys
    username = self.get_id_from_certificate(certificate=cert)[1].replace('@','_')
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute 'replace'

On line 213, self.get_id_from_certificate(certificate=cert) comes up as (None, None) for one of my certificates, and this is because this certificate doesn't have a SAN, so get_extension_for_oid triggers an exception (cryptography.x509.extensions.ExtensionNotFound: No <ObjectIdentifier(oid=2.5.29.17, name=subjectAltName)> extension was found). I think either certificates.py should ignore this case or get_id_from_certificate should handle it instead of returning (None, None)?

zblurx commented 4 months ago

Hey ! Thanks for the issue, I will fix this soon