SAM Dump for accounts without secrets

[Dfte]

I realised that some defaults Windows accounts, like for example WDAGUtilityAccount, throw the following error:

However there is no error here. WDAGUtilisatyAccount does not have a NT hash in the SAM database because this is a virtual account used to contain applications in a sandbox (for example browsers) and these featuers are not used on windows servers. Considering I never saw secretsdump failing in dumping SAM database, I believe it is possible to switch the following liens from impacket/impacket/examples/secretsdump.py:

if userAccount['NTHashLength'] == 0:
    logging.error('SAM hashes extraction for user %s failed. The account doesn\'t have hash information.' % userName)
    continue

to

if userAccount['NTHashLength'] == 0:
    logging.debug('SAM hashes extraction for user %s failed. The account doesn\'t have hash information.' % userName)
    continue

That way most of tools using impacket secretsdump won't have a messed up output.

Let me know what you think about this :)

[gabrielg5]

Hi @Dfte,
Which configuration are you running on? I tried here with a Windows Server 2019 in azure and the account WDAGUtilityAccount has a hash that is printed when running secretsdump
Also rechecked that the account was disabled (according to #802), and it was

I'm running a Windows Server 2019 v1809

[Dfte]

I have tested this against a domain controller. Now it's ovbious that there are no hashes for such accounts in the SAM database which is disabled anyway for domain controllers. But is there really a reason to display an error for such use cases considering there is no way for a local account not to have at least a default LM/NT hash ?

[gabrielg5]

Hey,

mm I don't think so.
I wanted to better understand / replay that scenario to check if there's some property in those objects that could help us realize it's not an issue not having gathered the hash.
But yes, I agree with you that we shouldn't be showing this case as an error

Will be playing with it a bit more and can create a PR to change it