From 460f1307ac19748c8f018624a057773ebd594637 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 7 Mar 2025 16:43:44 +0100 Subject: [PATCH 1/3] improve secret readability --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 50f4da30d..22a1a62e1 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -204,7 +204,7 @@ class Lsadump(interfaces.plugins.PluginInterface): else: secret = self.decrypt_aes(enc_secret, lsakey) - yield (0, (key.get_name(), secret.decode("latin1"), secret)) + yield (0, (key.get_name(), str(secret), secret)) def run(self): offset = self.config.get("offset", None) From f0235279a91287af60af165ef97beee520346028 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Fri, 7 Mar 2025 16:44:07 +0100 Subject: [PATCH 2/3] Bump: 1.0.0->1.0.1 --- volatility3/framework/plugins/windows/lsadump.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 22a1a62e1..051e55afe 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -22,7 +22,7 @@ class Lsadump(interfaces.plugins.PluginInterface): """Dumps lsa secrets from memory""" _required_framework_version = (2, 0, 0) - _version = (1, 0, 0) + _version = (1, 0, 1) @classmethod def get_requirements(cls): From 603ecbb48602d92d473f7437b153991a02457169 Mon Sep 17 00:00:00 2001 From: Abyss Watcher Date: Sat, 8 Mar 2025 12:29:34 +0100 Subject: [PATCH 3/3] render secret with HexBytes --- volatility3/framework/plugins/windows/lsadump.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/volatility3/framework/plugins/windows/lsadump.py b/volatility3/framework/plugins/windows/lsadump.py index 051e55afe..a3bf9300f 100644 --- a/volatility3/framework/plugins/windows/lsadump.py +++ b/volatility3/framework/plugins/windows/lsadump.py @@ -14,6 +14,7 @@ from volatility3.framework.layers import registry from volatility3.framework.symbols.windows import versions from volatility3.plugins.windows import hashdump from volatility3.plugins.windows.registry import hivelist +from volatility3.framework.renderers import format_hints vollog = logging.getLogger(__name__) @@ -204,7 +205,7 @@ class Lsadump(interfaces.plugins.PluginInterface): else: secret = self.decrypt_aes(enc_secret, lsakey) - yield (0, (key.get_name(), str(secret), secret)) + yield (0, (key.get_name(), format_hints.HexBytes(secret), secret)) def run(self): offset = self.config.get("offset", None) @@ -224,6 +225,6 @@ class Lsadump(interfaces.plugins.PluginInterface): sechive = hive return renderers.TreeGrid( - [("Key", str), ("Secret", str), ("Hex", bytes)], + [("Key", str), ("Secret", format_hints.HexBytes), ("Hex", bytes)], self._generator(syshive, sechive), )