From d5a125d985a87a7f3fa3e90464ffd8ce7b232e10 Mon Sep 17 00:00:00 2001
From: Mike Salvatore <mike.s.salvatore@gmail.com>
Date: Mon, 18 Jul 2022 08:46:07 -0400
Subject: [PATCH] Agent: Capture username even if no secrets are associated
---
.../mimikatz_credential_collector.py | 3 +++
.../test_mimikatz_collector.py | 19 +++++++++++++++++++
2 files changed, 22 insertions(+)
diff --git a/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py b/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py
index a2a1d0423..e6bc04a31 100644
--- a/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py
+++ b/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py
@@ -45,4 +45,7 @@ class MimikatzCredentialCollector(ICredentialCollector):
ntlm_hash = NTHash(nt_hash=wc.ntlm_hash)
credentials.append(Credentials(identity, ntlm_hash))
+ if len(credentials) == 0 and identity is not None:
+ credentials.append(Credentials(identity, None))
+
return credentials
diff --git a/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py b/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py
index 47a6ead49..40d5728dd 100644
--- a/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py
+++ b/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py
@@ -91,3 +91,22 @@ def test_pypykatz_result_parsing_no_identities(monkeypatch):
collected_credentials = collect_credentials()
assert len(collected_credentials) == 2
assert collected_credentials == expected_credentials
+
+
+def test_pypykatz_result_parsing_no_secrets(monkeypatch):
+ username = "user3"
+ win_creds = [
+ WindowsCredentials(
+ username=username,
+ password="",
+ ntlm_hash="",
+ lm_hash="",
+ ),
+ ]
+ patch_pypykatz(win_creds, monkeypatch)
+
+ expected_credentials = [Credentials(Username(username), None)]
+
+ collected_credentials = collect_credentials()
+ assert len(collected_credentials) == 1
+ assert collected_credentials == expected_credentials