Fix lsa_secrets

2015-07-27 16:19:01 -05:00 · 2015-07-27 16:19:01 -05:00 · 704c8cadd9
parent 54a45ac80c
commit 704c8cadd9
1 changed files with 6 additions and 1 deletions
--- a/modules/post/windows/gather/lsa_secrets.rb
+++ b/modules/post/windows/gather/lsa_secrets.rb
@ -59,7 +59,12 @@ class Metasploit3 < Msf::Post
          decrypted = decrypt_lsa_data(encrypted_secret, lsa_key)
        else
          # and here
-          encrypted_secret = encrypted_secret[0xC..-1]
+          if sysinfo['Architecture'] =~ /wow64/i || sysinfo['Architecture'] =~ /x64/
+            encrypted_secret = encrypted_secret[0x10..-1]
+          else # 32 bits
+            encrypted_secret = encrypted_secret[0xC..-1]
+          end
+
          decrypted = decrypt_secret_data(encrypted_secret, lsa_key)
        end