Fixed credential parsing bug

jinverar · Aug 24, 2015 · 32e95b4 · 32e95b4
1 parent b2cca2f
commit 32e95b4
Show file tree

Hide file tree

Showing 2 changed files with 5 additions and 3 deletions.
diff --git a/changelog b/changelog
@@ -5,6 +5,7 @@
 -Added /sids argument for credentials/mimikatz/golden_ticket
 -Added credential parsing for dcsync output
 -updated links for PowerTools
+-Fixed bug in credential parsing with ":" inside of the password,username, or domain
 
 8/20/2015
 ---------

diff --git a/lib/common/helpers.py b/lib/common/helpers.py
@@ -244,11 +244,12 @@ def parse_mimikatz(data):
             for line in lines2:
                 try:
                     if "Username" in line:
-                        username = line.split(":")[1].strip()
+                        username = line.split(":",1)[1].strip()
                     elif "Domain" in line:
-                        domain = line.split(":")[1].strip()
+                        domain = line.split(":",1)[1].strip()
                     elif "NTLM" in line or "Password" in line:
-                        password = line.split(":")[1].strip()
+                        print line.split(":")
+                        password = line.split(":",1)[1].strip()
                 except:
                     pass