From d5a125d985a87a7f3fa3e90464ffd8ce7b232e10 Mon Sep 17 00:00:00 2001 From: Mike Salvatore Date: Mon, 18 Jul 2022 08:46:07 -0400 Subject: [PATCH] Agent: Capture username even if no secrets are associated --- .../mimikatz_credential_collector.py | 3 +++ .../test_mimikatz_collector.py | 19 +++++++++++++++++++ 2 files changed, 22 insertions(+) diff --git a/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py b/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py index a2a1d0423..e6bc04a31 100644 --- a/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py +++ b/monkey/infection_monkey/credential_collectors/mimikatz_collector/mimikatz_credential_collector.py @@ -45,4 +45,7 @@ class MimikatzCredentialCollector(ICredentialCollector): ntlm_hash = NTHash(nt_hash=wc.ntlm_hash) credentials.append(Credentials(identity, ntlm_hash)) + if len(credentials) == 0 and identity is not None: + credentials.append(Credentials(identity, None)) + return credentials diff --git a/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py b/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py index 47a6ead49..40d5728dd 100644 --- a/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py +++ b/monkey/tests/unit_tests/infection_monkey/credential_collectors/test_mimikatz_collector.py @@ -91,3 +91,22 @@ def test_pypykatz_result_parsing_no_identities(monkeypatch): collected_credentials = collect_credentials() assert len(collected_credentials) == 2 assert collected_credentials == expected_credentials + + +def test_pypykatz_result_parsing_no_secrets(monkeypatch): + username = "user3" + win_creds = [ + WindowsCredentials( + username=username, + password="", + ntlm_hash="", + lm_hash="", + ), + ] + patch_pypykatz(win_creds, monkeypatch) + + expected_credentials = [Credentials(Username(username), None)] + + collected_credentials = collect_credentials() + assert len(collected_credentials) == 1 + assert collected_credentials == expected_credentials