Skip to content

Allow serviceaccount's name extraction with local secretsdump#2124

Open
laxa wants to merge 1 commit intofortra:masterfrom
laxa:secretsdump_local_serviceaccount
Open

Allow serviceaccount's name extraction with local secretsdump#2124
laxa wants to merge 1 commit intofortra:masterfrom
laxa:secretsdump_local_serviceaccount

Conversation

@laxa
Copy link
Contributor

@laxa laxa commented Feb 12, 2026

Currently, when running secretsdump.py on recovered hives, the LSASecrets for service accounts (starting with _SC_) does not handle retrieving the username:

$ secretsdump.py local -system SYSTEM -security SECURITY 
[...]
[*] _SC_wisvc 
(Unknown User):Password

This pull request fix this issue:

$ secretsdump.py local -system SYSTEM -security SECURITY 
[...]
[*] _SC_wisvc 
service1@TEST.LOCAL:Password

@anadrianmanrique anadrianmanrique added the medium Medium priority item label Feb 19, 2026
@anadrianmanrique anadrianmanrique self-assigned this Feb 19, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

medium Medium priority item

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants