12-18-2022, 02:57 AM
(This post was last modified: 12-18-2022, 02:59 AM by rodrigo.Brasil.
Edit Reason: litle mistake
)
(12-18-2022, 01:27 AM)marc1n Wrote: https://github.com/CiscoCXSecurity/creddump7
Thanks for your time, but you don't understand. This program CAN get the hash from the registry, but ONLY if it in original format (the binary). With the reg export command I get the same data but in a text way. It shows the binary content, but with hex value in text format.
The creddump7 only work with the binary format. (Or am I wrong?)
Anyway, because you confirm this data was in supplementalCredentials attribute, I thought I was in a correct path and could get it myself reading it's format. This is not easy as I thought, but I will get it.