{"action":"created","issue":{"url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/61","repository_url":"https://api.github.com/repos/gentilkiwi/mimikatz","labels_url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/61/labels{/name}","comments_url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/61/comments","events_url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/61/events","html_url":"https://github.com/gentilkiwi/mimikatz/issues/61","id":173053970,"number":61,"title":"lsadump::sam on Win10 1607 appears broken","user":{"login":"brandoncasaba","id":9833019,"avatar_url":"https://avatars.githubusercontent.com/u/9833019?v=3","gravatar_id":"","url":"https://api.github.com/users/brandoncasaba","html_url":"https://github.com/brandoncasaba","followers_url":"https://api.github.com/users/brandoncasaba/followers","following_url":"https://api.github.com/users/brandoncasaba/following{/other_user}","gists_url":"https://api.github.com/users/brandoncasaba/gists{/gist_id}","starred_url":"https://api.github.com/users/brandoncasaba/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/brandoncasaba/subscriptions","organizations_url":"https://api.github.com/users/brandoncasaba/orgs","repos_url":"https://api.github.com/users/brandoncasaba/repos","events_url":"https://api.github.com/users/brandoncasaba/events{/privacy}","received_events_url":"https://api.github.com/users/brandoncasaba/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2016-08-24T20:45:59Z","updated_at":"2016-08-24T22:36:53Z","closed_at":"2016-08-24T22:36:53Z","body":"Hey Benjamin, thanks for keeping up all the good work. I don't remember seeing your name at Defcon this year, did we miss you? \r\n\r\nI'm having a hell of a time getting all my tools to work for local accounts on Win10 Anniversary. I've been debugging a few and I know some crypto changes were made, but I figured I'd share my issues with you... \r\n\r\nBlank VM installed from scratch using  Win10 Anniversary ISO with x64 Pro. Same issue using the binaries from you or built from source and using within PowerShell. \r\n\r\n```\r\nMicrosoft Windows [Version 10.0.14393]\r\n(c) 2016 Microsoft Corporation. All rights reserved.\r\n\r\nC:\\Windows\\system32>whoami /groups\r\n\r\nGROUP INFORMATION\r\n-----------------\r\n\r\nGroup Name                                                    Type             SID          Attributes                  \r\n============================================================= ================ ============ ===============================================================\r\nEveryone                                                      Well-known group S-1-1-0      Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\Local account and member of Administrators group Well-known group S-1-5-114    Mandatory group, Enabled by default, Enabled group\r\nBUILTIN\\Administrators                                        Alias            S-1-5-32-544 Mandatory group, Enabled by default, Enabled group, Group owner\r\nBUILTIN\\Users                                                 Alias            S-1-5-32-545 Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\INTERACTIVE                                      Well-known group S-1-5-4      Mandatory group, Enabled by default, Enabled group\r\nCONSOLE LOGON                                                 Well-known group S-1-2-1      Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\Authenticated Users                              Well-known group S-1-5-11     Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\This Organization                                Well-known group S-1-5-15     Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\Local account                                    Well-known group S-1-5-113    Mandatory group, Enabled by default, Enabled group\r\nLOCAL                                                         Well-known group S-1-2-0      Mandatory group, Enabled by default, Enabled group\r\nNT AUTHORITY\\NTLM Authentication                              Well-known group S-1-5-64-10  Mandatory group, Enabled by default, Enabled group\r\nMandatory Label\\High Mandatory Level                          Label            S-1-16-12288                             \r\n\r\nC:\\Windows\\system32>cd \\users\\admin\\Desktop\r\n\r\nC:\\Users\\admin\\Desktop>mimikatz.exe\r\n\r\n  .#####.   mimikatz 2.1 (x64) built on Aug 22 2016 00:57:48\r\n .## ^ ##.  \"A La Vie, A L'Amour\"\r\n ## / \\ ##  /* * *\r\n ## \\ / ##   Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )\r\n '## v ##'   http://blog.gentilkiwi.com/mimikatz             (oe.eo)\r\n  '#####'                                     with 20 modules * * */\r\n\r\nmimikatz # lsadump::sam\r\nDomain : DESKTOP-LM61VKV\r\nSysKey : 69761fc49bef23eae7b8d14cea15fddc\r\nERROR kull_m_registry_OpenAndQueryWithAlloc ; kull_m_registry_RegOpenKeyEx KO\r\nERROR kuhl_m_lsadump_getUsersAndSamKey ; kull_m_registry_RegOpenKeyEx SAM Accounts (0x00000005)\r\n\r\nmimikatz #\r\n```"},"comment":{"url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/comments/242230056","html_url":"https://github.com/gentilkiwi/mimikatz/issues/61#issuecomment-242230056","issue_url":"https://api.github.com/repos/gentilkiwi/mimikatz/issues/61","id":242230056,"user":{"login":"gentilkiwi","id":2307945,"avatar_url":"https://avatars.githubusercontent.com/u/2307945?v=3","gravatar_id":"","url":"https://api.github.com/users/gentilkiwi","html_url":"https://github.com/gentilkiwi","followers_url":"https://api.github.com/users/gentilkiwi/followers","following_url":"https://api.github.com/users/gentilkiwi/following{/other_user}","gists_url":"https://api.github.com/users/gentilkiwi/gists{/gist_id}","starred_url":"https://api.github.com/users/gentilkiwi/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gentilkiwi/subscriptions","organizations_url":"https://api.github.com/users/gentilkiwi/orgs","repos_url":"https://api.github.com/users/gentilkiwi/repos","events_url":"https://api.github.com/users/gentilkiwi/events{/privacy}","received_events_url":"https://api.github.com/users/gentilkiwi/received_events","type":"User","site_admin":false},"created_at":"2016-08-24T22:36:53Z","updated_at":"2016-08-24T22:36:53Z","body":"All is possible ;)\r\nBut if I remember well, RegSaveKey(Ex) requires **a real file on disk**, even with its low level API (handle required).\r\n**I tend to avoid that.**\r\nBut this is exactly same as with https://github.com/gentilkiwi/mimikatz/wiki/module-~-lsadump#offline ;)"}}
{"actor":{"display_login":"gentilkiwi"}}