hi, just a feed back on a capture, no issue when using Decode.py but having error when using mimkatz to get login passwords

mimikatz # sekurlsa::minidump toto Switch to MINIDUMP : 'toto'

mimikatz # sekurlsa::logonPasswords Opening : 'toto' file for minidump... ERROR kuhl_m_sekurlsa_acquireLSA ; Key import

mimikatz #

Did another capture on another computer, no error but mimkatz does fc after a while without giving results

for --pid: using lssas.exe pid for the capture.

hi, just did a new pull for try to compile on windows getting this error now, seems a that adjustack.o is missing

PS C:\Users\nocomp\Documents\tools\HandleKatz> make all nasm -f win64 src/adjuststack.asm -o adjuststack.o process_begin: CreateProcess(NULL, nasm -f win64 src/adjuststack.asm -o adjuststack.o, ...) failed. make (e=2): Le fichier spÚcifiÚ est introuvable. make: *** [makefile:34: adjuststack.o] Error 2 PS C:\Users\nocomp\Documents\tools\HandleKatz> ls

Répertoire : C:\Users\nocomp\Documents\tools\HandleKatz

Mode LastWriteTime Length Name

d----- 22/10/2021 08:13 bin d----- 22/10/2021 08:13 imgs d----- 22/10/2021 08:13 loader d----- 22/10/2021 08:13 src -a---- 22/10/2021 08:13 953 Decoder.py -a---- 22/10/2021 08:13 131 extract.sh -a---- 22/10/2021 08:13 1398 makefile -a---- 22/10/2021 08:13 1551926 PICYourMalware.pdf -a---- 22/10/2021 08:13 3802 readme.md

PS C:\Users\nocomp\Documents\tools\HandleKatz> ls .\src\

Répertoire : C:\Users\nocomp\Documents\tools\HandleKatz\src

Mode LastWriteTime Length Name

-a---- 22/10/2021 08:13 344 adjuststack.asm -a---- 22/10/2021 08:13 7215 ApiResolve.c -a---- 22/10/2021 08:13 16215 APIResolve.h -a---- 22/10/2021 08:13 62 chkstk_ms.asm -a---- 22/10/2021 08:13 23845 DumpTools.c -a---- 22/10/2021 08:13 3720 DumpTools.h -a---- 22/10/2021 08:13 140 HandleKatz.h -a---- 22/10/2021 08:13 4805 HandleKatzPIC.c -a---- 22/10/2021 08:13 4863 HandleTools.c -a---- 22/10/2021 08:13 261 HandleTools.h -a---- 22/10/2021 08:13 102 linker.ld -a---- 22/10/2021 08:13 7917 Misc.c -a---- 22/10/2021 08:13 1612 Misc.h -a---- 22/10/2021 08:13 31567 syscalls.asm -a---- 22/10/2021 08:13 1721 syscalls.h

PS C:\Users\nocomp\Documents\tools\HandleKatz>

hi, just gave it a try and having an issue creating exe i guess, any tip?

here are the logs, hope it ll help:

nasm -f win64 src/adjuststack.asm -o adjuststack.o nasm -f win64 src/chkstk_ms.asm -o chkstk_ms.o nasm -f win64 src/syscalls.asm -o syscalls.o x86_64-w64-mingw32-gcc src/ApiResolve.c -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o ApiResolve.o -Wl,-Tlinker.ld,--no-seh -DC2 x86_64-w64-mingw32-gcc src/HandleKatzPIC.c -masm=intel -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o HandleKatzPIC.o -Wl,-Tlinker.ld,--no-seh -DC2 x86_64-w64-mingw32-gcc src/Misc.c -masm=intel -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o Misc.o -Wl,-Tlinker.ld,--no-seh -DC2 x86_64-w64-mingw32-gcc src/HandleTools.c -masm=intel -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o HandleTools.o -Wl,-Tlinker.ld,--no-seh -DC2 x86_64-w64-mingw32-gcc src/DumpTools.c -masm=intel -Wall -m64 -ffunction-sections -fno-asynchronous-unwind-tables -nostdlib -fno-ident -O2 -c -o DumpTools.o -Wl,-Tlinker.ld,--no-seh -DC2 x86_64-w64-mingw32-ld -s adjuststack.o ApiResolve.o Misc.o HandleKatzPIC.o HandleTools.o DumpTools.o syscalls.o chkstk_ms.o -o bin/HandleKatzPIC.exe x86_64-w64-mingw32-ld : ne peut ouvrir le fichier de sortie bin/HandleKatzPIC.exe : Aucun fichier ou dossier de ce type make: *** [makefile:10 : make] Erreur 1

br

The for loop processes handles for the in_pid process. It creates a couple handles in the process (h_process, dupHandle). On any error encountered it continues the loop and overwrites those handle values, causing the handles to be leaked.

HANDLE check_handles(PSYSTEM_HANDLE_INFORMATION handle_info, DWORD in_pid, char* ptr_output, struct fPtrs* ptr_functions) {

    ...
    HANDLE dupHandle = NULL, h_process = NULL, h_return = NULL;
    ...

    for (idx_handle = 0; idx_handle < handle_info->HandleCount; idx_handle++) {

        entry_info = &handle_info->Handles[idx_handle];

        if (in_pid && in_pid != entry_info->ProcessId)
            continue;

        // Checking some granted access. The internet says, NtDuplicateObject() might hang on these rights
        if (entry_info->GrantedAccess != 0x0012019f && entry_info->GrantedAccess != 0x001a019f && entry_info->GrantedAccess != 0x00120189 && entry_info->GrantedAccess != 0x00100000) {

            if (objectTypeInfo != NULL) {
                ptr_functions->_VirtualFree(objectTypeInfo, 0, MEM_RELEASE);
                objectTypeInfo = NULL;
            }

            uPid.UniqueProcess = entry_info->ProcessId;
            uPid.UniqueThread = 0;

!            NtOpenProcess(&h_process, PROCESS_QUERY_INFORMATION | PROCESS_DUP_HANDLE, &ObjectAttributes, &uPid);   <<<< overwrites any previous h_process handle
!            NtDuplicateObject(h_process, (HANDLE)(uint64_t)entry_info->Handle, NtCurrentProcess(), &dupHandle, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, 0, 0);   <<<<  overwrites previous dupHandle value

            objectTypeInfo = (POBJECT_TYPE_INFORMATION)ptr_functions->_VirtualAlloc(0, 0x1000, MEM_COMMIT, PAGE_READWRITE);
            if (objectTypeInfo == NULL)
                continue;

            status = NtQueryObject(dupHandle, (OBJECT_INFORMATION_CLASS)ObjectTypeInformation, objectTypeInfo, 0x1000, NULL);
            if (!NT_SUCCESS(status)){
!                continue;      <<< dupHandle, h_process leaked as they get overwritten on the next iteration
            }

            if (ptr_functions->_strcmpW(objectTypeInfo->TypeName.pBuffer, str_process))
!                continue;      <<< dupHandle, h_process leaked as they get overwritten on the next iteration

            if (!ptr_functions->_GetModuleFileNameExA(dupHandle, NULL, handle_name, MAX_PATH))
!                continue;      <<< dupHandle, h_process leaked as they get overwritten on the next iteration

            if (!ptr_functions->_GetProcessImageFileNameA(h_process, process_path, MAX_PATH))
!                continue;      <<< dupHandle, h_process leaked as they get overwritten on the next iteration

            ....
        }

    }

    if (h_process != NULL)
        ptr_functions->_CloseHandle(h_process);
 
   if (objectTypeInfo != NULL)
        ptr_functions->_VirtualFree(objectTypeInfo, 0, MEM_RELEASE);

    return h_return;

}

See https://github.com/codewhitesec/HandleKatz/blob/5e18f107694aaeb591c10fa9ec392cf9a7c1bf2b/src/HandleTools.c#L75 and related

I wanted to build everything from source before kicking it around in our detection lab. The changes should make the Makefile a bit more robust, too.

Thanks for the great work. Really looking forward to seeing variants of this in the wild again soon. ;-)

On Windows 11 there is a problem that most times the dumping code does not work when compiled to PIC.

The fix is to set nstreams to 6 instead of 3.

With this fix Handlekatz should work again for Win11 :).

Hello! I tried running it on windows 10, and it's working perfectly. so I decided to run it also on other OS. I took Windows Server 2008 R2 (6.1.7601) and tested it on it - I don't know why, but it's crashing :(. after a bit debugging the code I saw that it's crashing in the getDllBase. and the crash is because dll_name->pBuffer is 0x400.

Why should it not work on Windows Server 2008? and how can I 'Patch' it so it will work? looks like all the dlls are existing...

Thank you !