Merge pull request #155 from oxnan/main

Added windows 11 wDigest functionality
skelsec · May 13, 2024 · 61b839b · 61b839b
2 parents 6788030 + 59c90c4
commit 61b839b
Showing 1 changed file with 8 additions and 2 deletions.
diff --git a/pypykatz/lsadecryptor/packages/wdigest/templates.py b/pypykatz/lsadecryptor/packages/wdigest/templates.py
@@ -35,11 +35,17 @@ def get_template(sysinfo):
 				template.primary_offset = 48
 				template.list_entry = PWdigestListEntry
 
-			elif sysinfo.buildnumber >= WindowsMinBuild.WIN_VISTA.value:
+			elif WindowsMinBuild.WIN_VISTA.value <= sysinfo.buildnumber < WindowsMinBuild.WIN_11.value:
 				template.signature = b'\x48\x3b\xd9\x74'
 				template.first_entry_offset = -4
 				template.primary_offset = 48
 				template.list_entry = PWdigestListEntry
+
+			elif sysinfo.buildnumber >= WindowsMinBuild.WIN_11.value:
+				template.signature = b'\x48\x3b\xd8\x74'
+				template.first_entry_offset = -4
+				template.primary_offset = 48
+				template.list_entry = PWdigestListEntry
 
 			else:
 				raise Exception('Could not identify template! Architecture: %s sysinfo.buildnumber: %s' % (sysinfo.architecture, sysinfo.buildnumber))
@@ -114,4 +120,4 @@ def __init__(self, reader):
 		self.usage_count = ULONG(reader)
 		reader.align() #8?
 		self.this_entry = PWdigestListEntry(reader)
-		self.luid = LUID(reader).value
+		self.luid = LUID(reader).value