harmj0y / impdump Goto Github PK

When running impdump and pointing to the SYSTEM and output files it immediately returns this error.

Traceback (most recent call last):
File "impdump.py", line 246, in
decKrbtgt(sys.argv[1], sys.argv[2])
File "impdump.py", line 145, in decKrbtgt
print decUserHash(bootkey, rawPekKey, "krbtgt", rawRID, "", rawNTLMhash)
File "impdump.py", line 32, in decUserHash
rid = int(rawRID[48:],16)
TypeError: 'NoneType' object has no attribute 'getitem'

Hi,

I have no idea if this project is still maintained but here's an error I'm getting when running impdump.py.

Traceback (most recent call last):
  File "/root/Crack/ImpDump/impdump.py", line 241, in <module>
    decUserHashes(sys.argv[1], sys.argv[2])
  File "/root/Crack/ImpDump/impdump.py", line 190, in decUserHashes
    print decUserHash(bootkey, rawPekKey, name, rawRID, "", rawNTLMhash)
  File "/root/Crack/ImpDump/impdump.py", line 53, in decUserHash
    ntlm = ds_decrypt_single_hash(rid, encNTLM)
  File "/root/Crack/ImpDump/framework/win32/dshashdump.py", line 58, in ds_decrypt_single_hash
    hash = d1.decrypt(enc_hash[:8]) + d2.decrypt(enc_hash[8:])
  File "/usr/lib/python2.7/dist-packages/Crypto/Cipher/blockalgo.py", line 295, in decrypt
    return self._cipher.decrypt(ciphertext)
ValueError: Input strings must be a multiple of 8 in length

This is when I try to run it against a ntds.dit extract of a Windows Server 2016 DC, if it makes any difference. It worked fine with one from Windows Server 2008.

I can provide any information required to track down and fix this bug (other than the ntds.dit and SYSTEM files of course).

Thank you.