{"action":"created","issue":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5815","repository_url":"https://api.github.com/repos/rapid7/metasploit-framework","labels_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5815/labels{/name}","comments_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5815/comments","events_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5815/events","html_url":"https://github.com/rapid7/metasploit-framework/issues/5815","id":99878640,"number":5815,"title":"post/windows/gather/hashdump encoding problem","user":{"login":"bs-arod","id":7823175,"avatar_url":"https://avatars.githubusercontent.com/u/7823175?v=3","gravatar_id":"","url":"https://api.github.com/users/bs-arod","html_url":"https://github.com/bs-arod","followers_url":"https://api.github.com/users/bs-arod/followers","following_url":"https://api.github.com/users/bs-arod/following{/other_user}","gists_url":"https://api.github.com/users/bs-arod/gists{/gist_id}","starred_url":"https://api.github.com/users/bs-arod/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bs-arod/subscriptions","organizations_url":"https://api.github.com/users/bs-arod/orgs","repos_url":"https://api.github.com/users/bs-arod/repos","events_url":"https://api.github.com/users/bs-arod/events{/privacy}","received_events_url":"https://api.github.com/users/bs-arod/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/bug","name":"bug","color":"e11d21"},{"url":"https://api.github.com/repos/rapid7/metasploit-framework/labels/meterpreter","name":"meterpreter","color":"5319e7"}],"state":"closed","locked":false,"assignee":{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false},"assignees":[{"login":"bcook-r7","id":10031469,"avatar_url":"https://avatars.githubusercontent.com/u/10031469?v=3","gravatar_id":"","url":"https://api.github.com/users/bcook-r7","html_url":"https://github.com/bcook-r7","followers_url":"https://api.github.com/users/bcook-r7/followers","following_url":"https://api.github.com/users/bcook-r7/following{/other_user}","gists_url":"https://api.github.com/users/bcook-r7/gists{/gist_id}","starred_url":"https://api.github.com/users/bcook-r7/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bcook-r7/subscriptions","organizations_url":"https://api.github.com/users/bcook-r7/orgs","repos_url":"https://api.github.com/users/bcook-r7/repos","events_url":"https://api.github.com/users/bcook-r7/events{/privacy}","received_events_url":"https://api.github.com/users/bcook-r7/received_events","type":"User","site_admin":false}],"milestone":null,"comments":2,"created_at":"2015-08-09T09:26:37Z","updated_at":"2016-09-20T12:59:36Z","closed_at":"2016-05-25T10:38:35Z","body":"post/windows/gather/hashdump just fails with a french Windows. \r\n\r\nIt seems it fails with the guest account which is \"invité\" in french.\r\nIs there any bugfix to do on my system ? Or in metasploit ?\r\nThanks!\r\n\r\n```\r\n  meterpreter > sysinfo \r\n  Computer        : SRV2\r\n  OS              : Windows 7 (Build 7601, Service Pack 1).\r\n  Architecture    : x64\r\n  System Language : fr_FR\r\n  Domain          : BS\r\n  Logged On Users : 7\r\n  Meterpreter     : x64/win64\r\n```\r\n\r\n```\r\nmeterpreter > run post/windows/gather/hashdump \r\n\r\n[*] Obtaining the boot key...\r\n[*] Calculating the hboot key using SYSKEY be09014[...]75e64d83...\r\n[*] Obtaining the user list and keys...\r\n[*] Decrypting user keys...\r\n[*] Dumping password hints...\r\n[...]\r\n\r\n[*] Dumping password hashes...\r\n\r\n\r\nAdministrateur:500:aad3b435b51404eeaad3b435b51404ee:[some ntlm hash]:::\r\n[-] Post failed: ActiveRecord::StatementInvalid PG::CharacterNotInRepertoire: ERROR:  invalid byte sequence for encoding \"UTF8\": 0xe9 0x27 0x20\r\n: SELECT  \"metasploit_credential_publics\".* FROM \"metasploit_credential_publics\"  WHERE \"metasploit_credential_publics\".\"type\" IN ('Metasploit::Credential::Username') AND \"metasploit_credential_publics\".\"username\" = 'invit?'  ORDER BY \"metasploit_credential_publics\".\"id\" ASC LIMIT 1\r\n[-] Call stack:\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/postgresql_adapter.rb:798:in `async_exec'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/postgresql_adapter.rb:798:in `exec_no_cache'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/postgresql/database_statements.rb:138:in `block in exec_query'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/abstract_adapter.rb:442:in `block in log'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activesupport-4.0.13/lib/active_support/notifications/instrumenter.rb:20:in `instrument'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/abstract_adapter.rb:437:in `log'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/postgresql/database_statements.rb:137:in `exec_query'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/postgresql_adapter.rb:915:in `select'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/abstract/database_statements.rb:25:in `select_all'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/connection_adapters/abstract/query_cache.rb:64:in `select_all'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/querying.rb:36:in `find_by_sql'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation.rb:587:in `exec_queries'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation.rb:471:in `load'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation.rb:220:in `to_a'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation/finder_methods.rb:326:in `find_first'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation/finder_methods.rb:91:in `first'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-deprecated_finders-1.0.4/lib/active_record/deprecated_finders/relation.rb:129:in `first'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/activerecord-4.0.13/lib/active_record/relation.rb:137:in `first_or_create!'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/metasploit-credential-1.0.0/lib/metasploit/credential/creation.rb:426:in `block in create_credential_public'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/metasploit-credential-1.0.0/lib/metasploit/credential/creation.rb:532:in `retry_transaction'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/metasploit-credential-1.0.0/lib/metasploit/credential/creation.rb:422:in `create_credential_public'\r\n[-]   /home/arod/.rvm/gems/ruby-2.1.5/gems/metasploit-credential-1.0.0/lib/metasploit/credential/creation.rb:134:in `create_credential'\r\n[-]   /opt/metasploit-framework/lib/msf/core/auxiliary/report.rb:34:in `create_credential'\r\n[-]   /opt/metasploit-framework/modules/post/windows/gather/hashdump.rb:98:in `block in run'\r\n[-]   /opt/metasploit-framework/modules/post/windows/gather/hashdump.rb:90:in `each'\r\n[-]   /opt/metasploit-framework/modules/post/windows/gather/hashdump.rb:90:in `run'\r\n```"},"comment":{"url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/comments/248293974","html_url":"https://github.com/rapid7/metasploit-framework/issues/5815#issuecomment-248293974","issue_url":"https://api.github.com/repos/rapid7/metasploit-framework/issues/5815","id":248293974,"user":{"login":"jvoisin","id":325724,"avatar_url":"https://avatars.githubusercontent.com/u/325724?v=3","gravatar_id":"","url":"https://api.github.com/users/jvoisin","html_url":"https://github.com/jvoisin","followers_url":"https://api.github.com/users/jvoisin/followers","following_url":"https://api.github.com/users/jvoisin/following{/other_user}","gists_url":"https://api.github.com/users/jvoisin/gists{/gist_id}","starred_url":"https://api.github.com/users/jvoisin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jvoisin/subscriptions","organizations_url":"https://api.github.com/users/jvoisin/orgs","repos_url":"https://api.github.com/users/jvoisin/repos","events_url":"https://api.github.com/users/jvoisin/events{/privacy}","received_events_url":"https://api.github.com/users/jvoisin/received_events","type":"User","site_admin":false},"created_at":"2016-09-20T12:59:36Z","updated_at":"2016-09-20T12:59:36Z","body":"I can still reproduce it, with the latest (27018b421c1cd7eae58e9bed46ccfd4597c44730) git version:\r\n\r\n```ruby\r\nmeterpreter > run post/windows/gather/credentials/credential_collector \r\n\r\n[*] Running module against XXXXX\r\n[+] Collecting hashes...\r\n    Extracted: Administrateur:XXXX:XXX\r\n[-] Post failed: ActiveRecord::StatementInvalid PG::CharacterNotInRepertoire: ERROR:  invalid byte sequence for encoding \"UTF8\": 0xe9\r\n: SELECT  \"metasploit_credential_publics\".* FROM \"metasploit_credential_publics\" WHERE \"metasploit_credential_publics\".\"type\" IN ('Metasploit::Credential::Username') AND \"metasploit_credential_publics\".\"username\" = $1  ORDER BY \"metasploit_credential_publics\".\"id\" ASC LIMIT 1\r\n[-] Call stack:\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/postgresql_adapter.rb:602:in `exec_prepared'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/postgresql_adapter.rb:602:in `block in exec_cache'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/abstract_adapter.rb:484:in `block in log'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activesupport-4.2.7.1/lib/active_support/notifications/instrumenter.rb:20:in `instrument'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/abstract_adapter.rb:478:in `log'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/postgresql_adapter.rb:601:in `exec_cache'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/postgresql_adapter.rb:585:in `execute_and_clear'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/postgresql/database_statements.rb:160:in `exec_query'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/abstract/database_statements.rb:356:in `select'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/abstract/database_statements.rb:32:in `select_all'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/connection_adapters/abstract/query_cache.rb:70:in `select_all'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/querying.rb:39:in `find_by_sql'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation.rb:639:in `exec_queries'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation.rb:515:in `load'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation.rb:243:in `to_a'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation/finder_methods.rb:500:in `find_nth_with_limit'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation/finder_methods.rb:484:in `find_nth'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation/finder_methods.rb:127:in `first'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/activerecord-4.2.7.1/lib/active_record/relation.rb:159:in `first_or_create!'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/metasploit-credential-2.0.3/lib/metasploit/credential/creation.rb:426:in `block in create_credential_public'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/metasploit-credential-2.0.3/lib/metasploit/credential/creation.rb:532:in `retry_transaction'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/metasploit-credential-2.0.3/lib/metasploit/credential/creation.rb:422:in `create_credential_public'\r\n[-]   /opt/msf/vendor/ruby/2.3.0/gems/metasploit-credential-2.0.3/lib/metasploit/credential/creation.rb:134:in `create_credential'\r\n[-]   /opt/msf/lib/msf/core/auxiliary/report.rb:34:in `create_credential'\r\n[-]   /opt/msf/modules/post/windows/gather/credentials/credential_collector.rb:76:in `block in run'\r\n[-]   /opt/msf/modules/post/windows/gather/credentials/credential_collector.rb:55:in `each'\r\n[-]   /opt/msf/modules/post/windows/gather/credentials/credential_collector.rb:55:in `run'\r\nmeterpreter > \r\n```"}}
{"actor":{"display_login":"jvoisin"}}