Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Japanese Windows Security Log Encoding Issue #1788

Open
vvdanila opened this issue Aug 9, 2024 · 0 comments
Open

Japanese Windows Security Log Encoding Issue #1788

vvdanila opened this issue Aug 9, 2024 · 0 comments
Assignees
Labels
in review This issue or pull request is being analyzed

Comments

@vvdanila
Copy link

vvdanila commented Aug 9, 2024

Configuration

impacket version: 0.11.0
Python version: 3.10
Target OS: UBUNTU 22.04

Debug Output With Command String

We have adapted this for our needs, but it
is initiated by: pEnum = iEnum.Next(0xFFFFFFFF, 1)[0].

What we do, is to perform a query:

FROM Win32_NTLogEvent WHERE(LogFile='security') And (TimeGenerated>='SOME TIMESTAMP')

from NTLogEvent from security logfile.
The log files contains Japanese characters.

Traceback (most recent call last):
   File "/bin/wmic.py", line 132, in printReply
    pEnum = iEnum.Next(0xFFFFFFFF, 1)[0]
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 2950, in Next
    interfaces.append(IWbemClassObject(
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 2330, in __init__
    self.parseObject()
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 2369, in parseObject
    self.encodingUnit['ObjectBlock'].parseObject()
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 990, in parseObject
    self.ctCurrent = self.parseClass(ctCurrent, self['InstanceType'])
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 978, in parseClass
    classDict['values'] = cInstance.getValues(classDict['properties'])
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 843, in getValues
    value = ENCODED_VALUE.getValue( properties[key]['type'], itemValue, heap)
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 335, in getValue
    item = ENCODED_STRING(heapData)
  File "/usr/local/lib/python3.10/site-packages/impacket/dcerpc/v5/dcom/wmi.py", line 158, in __init__
    self.fromString(data)
  File "/usr/local/lib/python3.10/site-packages/impacket/structure.py", line 152, in fromString
    self[field[0]] = self.unpack(field[1], data[:size], dataClassOrCode = dataClassOrCode, field = field[0])
  File "/usr/local/lib/python3.10/site-packages/impacket/structure.py", line 370, in unpack
    raise Exception("%s 'u' field is not NUL-NUL terminated: %r" % (field, data))
Exception: ("Character 'u' field is not NUL-NUL terminated: b'\n\x00\t\x00ag\xf6N \x00I\x00D\x00:\x00\t\x00{\x00d\x007\x008\x00e\x001\x00e\x008\x007\x00-\x008\x006\x004\x004\x00-\x004\x00e\x00a\x005\x00-\x009\x004\x003\x007\x00-\x001\x002\x003\x00f\x00a\x00s\x00d\x001\x002\x003\x002\x00}\x00\n\x00\t\x00\x00N' "When unpacking field 'Character | u | ... (truncated on purpose)

Additional context

I have done myself an analysis and concluded that it could be a problem with utf-16-le encoding.
This is the string that causes the problem, decoded:
'\n\t条件 ID:\t{d78e1e87-8644-4ea5-9437-123fasd1232}\n\t一'.encode('utf_16_le')
If further I encode it as shown above, it results in the string caught in that error.

The encoding is in utf_16_le, and corresponding string should be: '\n\t条件 ID:\t{d78e1e87-8644-4ea5-9437-123fasd1232}\n\t一'

A naive solution would be to check for ending \x00\x00\N. Do you think this is an appropriate solution to support additional encodings?

@alexisbalbachan alexisbalbachan self-assigned this Aug 22, 2024
@anadrianmanrique anadrianmanrique added the in review This issue or pull request is being analyzed label Aug 22, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in review This issue or pull request is being analyzed
Projects
None yet
Development

No branches or pull requests

3 participants