From 3ea563bde87fa4c67f7b0bc4de4f216614096ec6 Mon Sep 17 00:00:00 2001
From: Mike Auty <mike.auty@gmail.com>
Date: Wed, 19 Feb 2025 18:48:32 +0000
Subject: [PATCH] Windows: Use built-in libraries where possible (idea from
 #1627)

---
 volatility3/framework/plugins/windows/hashdump.py | 3 +--
 volatility3/framework/plugins/windows/lsadump.py  | 6 +++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/volatility3/framework/plugins/windows/hashdump.py b/volatility3/framework/plugins/windows/hashdump.py
index 621b0ae53..1fea3d49d 100644
--- a/volatility3/framework/plugins/windows/hashdump.py
+++ b/volatility3/framework/plugins/windows/hashdump.py
@@ -8,7 +8,6 @@ from struct import pack, unpack
 from typing import List, Optional, Tuple
 
 from Crypto.Cipher import AES, ARC4, DES
-from Crypto.Hash import MD5
 
 from volatility3.framework import interfaces, renderers
 from volatility3.framework.configuration import requirements
@@ -529,7 +528,7 @@ class Hashdump(interfaces.plugins.PluginInterface):
         (des_k1, des_k2) = cls.sid_to_key(rid)
         des1 = DES.new(des_k1, DES.MODE_ECB)
         des2 = DES.new(des_k2, DES.MODE_ECB)
-        md5 = MD5.new()
+        md5 = hashlib.md5()
 
         md5.update(hbootkey[:0x10] + pack("<L", rid) + lmntstr)
         rc4_key = md5.digest()
diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py
index f3925f2a2..50f4da30d 100644
--- a/volatility3/framework/plugins/windows/lsadump.py
+++ b/volatility3/framework/plugins/windows/lsadump.py
@@ -4,9 +4,9 @@
 import logging
 from struct import unpack
 from typing import Optional
+import hashlib
 
 from Crypto.Cipher import ARC4, DES, AES
-from Crypto.Hash import MD5, SHA256
 
 from volatility3.framework import interfaces, renderers, exceptions
 from volatility3.framework.configuration import requirements
@@ -45,7 +45,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
         """
         Based on code from http://lab.mediaservice.net/code/cachedump.rb
         """
-        sha = SHA256.new()
+        sha = hashlib.sha256()
         sha.update(key)
         for _i in range(1, 1000 + 1):
             sha.update(secret[28:60])
@@ -89,7 +89,7 @@ class Lsadump(interfaces.plugins.PluginInterface):
         if not obf_lsa_key:
             return None
         if not vista_or_later:
-            md5 = MD5.new()
+            md5 = hashlib.md5()
             md5.update(bootkey)
             for _i in range(1000):
                 md5.update(obf_lsa_key[60:76])