WEBDIENSTE/volatility3
1
0
Fork 0
mirror of https://github.com/volatilityfoundation/volatility3.git synced 2026-09-13 21:27:39 +02:00
Code Issues Packages Projects Releases Wiki Activity

fixed issues

Browse Source
This commit is contained in:
Jack Wenger
2020-08-23 21:32:27 +01:00
committed by ikelos
parent cd78958161
commit 20e4df0bf6
4 changed files with 12 additions and 30 deletions
Download Patch File Download Diff File Expand all files Collapse all files
volatility/framework/plugins/windows/cachedump.py
+4 -4
View File
@@ -81,7 +81,7 @@ class Cachedump(interfaces.plugins.PluginInterface):
def _generator(self, syshive, sechive):
bootkey = hashdump.Hashdump.get_bootkey(syshive)
if not bootkey:
raise Exception('Unable to find bootkey')
raise ValueError('Unable to find bootkey')
is_vista_or_later = poolscanner.os_distinguisher(version_check = lambda x: x >= (6, 0),
fallback_checks = [("KdCopyDataBlock", None, True)])
@@ -89,15 +89,15 @@ class Cachedump(interfaces.plugins.PluginInterface):
lsakey = lsadump.Lsadump.get_lsa_key(sechive, bootkey, vista_or_later)
if not lsakey:
raise Exception('Unable to find lsa key')
raise ValueError('Unable to find lsa key')
nlkm = self.get_nlkm(sechive, lsakey, vista_or_later)
if not nlkm:
raise Exception('Unable to find nlkma key')
raise ValueError('Unable to find nlkma key')
cache = sechive.get_key("Cache")
if not cache:
raise Exception('Unable to find cache key')
raise ValueError('Unable to find cache key')
for cache_item in cache.get_values():
volatility/framework/plugins/windows/hashdump.py
+1 -1
View File
@@ -277,7 +277,7 @@ class Hashdump(interfaces.plugins.PluginInterface):
rid = int(str(user.get_name()), 16)
yield (0, (name, rid, lmout, ntout))
else:
raise Exception("Hbootkey is not valid")
raise ValueError("Hbootkey is not valid")
def run(self):
offset = self.config.get('offset', None)
volatility/framework/plugins/windows/lsadump.py
+7 -7
View File
@@ -94,7 +94,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
try:
enc_secret_key = sechive.get_key("Policy\\Secrets\\" + name + "\\CurrVal")
except KeyError:
raise Exception("Unable to read cache from memory")
raise ValueError("Unable to read cache from memory")
enc_secret_value = next(enc_secret_key.get_values())
@@ -118,7 +118,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
Decrypts a block of data with DES using given key.
Note that key can be longer than 7 bytes."""
decrypted_data = ''
decrypted_data = b''
j = 0 # key index
for i in range(0, len(secret), 8):
@@ -145,14 +145,14 @@ class Lsadump(interfaces.plugins.PluginInterface):
bootkey = hashdump.Hashdump.get_bootkey(syshive)
lsakey = self.get_lsa_key(sechive, bootkey, vista_or_later)
if not bootkey:
raise Exception('Unable to find bootkey')
raise ValueError('Unable to find bootkey')
if not lsakey:
raise Exception('Unable to find lsa key')
raise ValueError('Unable to find lsa key')
secrets_key = sechive.get_key('Policy\\Secrets')
if not secrets_key:
raise Exception('Unable to find secrets key')
raise ValueError('Unable to find secrets key')
for key in secrets_key.get_subkeys():
@@ -171,10 +171,10 @@ class Lsadump(interfaces.plugins.PluginInterface):
if not vista_or_later:
secret = self.decrypt_secret(enc_secret[0xC:], lsakey)
else:
secret = self.decrypt_aes(enc_secret, lsakey).decode('latin1')
secret = self.decrypt_aes(enc_secret, lsakey)
yield (0,(key.get_name()+'\n', secret+'\n', secret.encode('latin1')))
yield (0,(key.get_name(), secret.decode('latin1'), secret))