KeyError: 'HashRecords'

[amit-xai]

facing some error
[*] Connected to 192.168.0.104 as marvel.local\amit.prajapati (admin)

[*] Triage SYSTEM masterkeys

[-] Got error: 'HashRecords'
Traceback (most recent call last):
File "/usr/local/lib/python3.11/dist-packages/dploot/entry.py", line 74, in main
actionsoptions.action
File "/usr/local/lib/python3.11/dist-packages/dploot/action/machinecertificates.py", line 86, in entry
a.run()
File "/usr/local/lib/python3.11/dist-packages/dploot/action/machinecertificates.py", line 50, in run
self.masterkeys = triage.triage_system_masterkeys()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.11/dist-packages/dploot/triage/masterkeys.py", line 64, in triage_system_masterkeys
LSA.dumpSecrets()
File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 1721, in dumpSecrets
value = self.getValue('\Policy\Secrets\{}\{}\default'.format(key,valueType))
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/impacket/examples/secretsdump.py", line 1192, in getValue
value = self.__registryHive.getValue(keyValue)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 460, in getValue
key = self.findKey(regKey)
^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 378, in findKey
res = self.__findSubKey(parentKey, subKey)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/impacket/winregistry.py", line 299, in __findSubKey
data = lf['HashRecords']
~~^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/impacket/structure.py", line 169, in getitem
return self.fields[key]
~~~~~~~~~~~^^^^^
KeyError: 'HashRecords'

[zblurx]

Hey, the error seems to be in secretsdump part.
Did the machine had an EDR ? If so, which one ?

[amit-xai]

I am using trend micro apex one edr , should i tried this without edr system?

[zblurx]

If you can try without it would be great, just to see if it mess up with secretsdump
Anyway i'm planning to redo the full LSA dump part.

[zblurx]

Hey, I've been able to reproduce, seems like the problem is in secretsdump, in SECURITY key "DSREGCMD".
As a temporary fix, you can add:

if key == 'DSREGCMD':
                    continue

in line 1758 in impacket/examples/secretsdump.py file

[fgeek]

Same problem nowadays, but it seems that secretsdump has changed.