Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update handlekatz.py pypykatz import #389

Merged
merged 1 commit into from
Jul 27, 2024
Merged

Conversation

3ldidi94
Copy link
Contributor

Fix pypykatz import in handlekatz

Fix pypykatz import in handlekatz

Signed-off-by: 3ldidi94 <18704024+3ldidi94@users.noreply.github.com>
@3ldidi94 3ldidi94 changed the title Update handlekatz.py Update handlekatz.py pypykatz import Jul 27, 2024
@NeffIsBack
Copy link
Contributor

Hey thanks again for the bug fix PR!
Somehow i can't get handlekatz to dumpy the process, even when executing the binary manually on the system. Any idea why this is? No AV present
image

@NeffIsBack NeffIsBack added the bug-fix This Pull Request fixes a bug label Jul 27, 2024
@3ldidi94
Copy link
Contributor Author

3ldidi94 commented Jul 27, 2024

Hey ! No problem, I had an error while parsing my dump "pypykatz has no attribute parse_minidum_external" and I don't have this when I am using the nanodump module.

About your issue using handlekatz, I am using this module but not the handlekatz binary in order to dump the lsass process. I will try it on my side and let you know if I have the same issue

@NeffIsBack
Copy link
Contributor

Well, doing a manual dump and parsing it still doesn't work for some reason, but atleast the pypykatz import is fixed with this PR
image

Copy link
Contributor

@NeffIsBack NeffIsBack left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@NeffIsBack NeffIsBack merged commit c0adbf1 into Pennyw0rth:main Jul 27, 2024
5 checks passed
@3ldidi94 3ldidi94 deleted the patch-1 branch July 28, 2024 10:54
@3ldidi94
Copy link
Contributor Author

3ldidi94 commented Jul 28, 2024

Hey thanks again for the bug fix PR! Somehow i can't get handlekatz to dumpy the process, even when executing the binary manually on the system. Any idea why this is? No AV present image

I am not using handlkatz, I have adapted another lsass dumper to make it work with the handlekatz module. Did you fill the variable handlekatz_b64 in the HandleKatz.h file?

@NeffIsBack
Copy link
Contributor

I didn't pack the file myself. @mpgn wrote the module, not sure what you need to fill in. Maybe we should just repackage the binary though

@mpgn mpgn added this to the v1.3.0 milestone Sep 29, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug-fix This Pull Request fixes a bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants