newline is an invalid keyword argument for this function about katzkatz

[voidnecron]

newline seems to be a python3 thing, but the script has been written for python2.

root@kali:~/tools/KatzKatz# python3 katzkatz.py -f /root/loot/lsass2.log                                                                                                        
Traceback (most recent call last):                                                                                                                                                                                                         
  File "katzkatz.py", line 14, in <module>                                                                                                                                                                                                 
    from colorlog import ColoredFormatter                                                                                                                                                                                                  
ModuleNotFoundError: No module named 'colorlog'         

If you install the deps for python3 it works fine (pip3 install -r requirements)

root@kali:~/tools/KatzKatz# pip3 install -r requirements.txt                                                                                                                                                                               
Collecting colorlog (from -r requirements.txt (line 1))                                                                                                                                                                                    
  Using cached https://files.pythonhosted.org/packages/00/0d/22c73c2eccb21dd3498df7d22c0b1d4a30f5a5fb3feb64e1ce06bc247747/colorlog-4.1.0-py2.py3-none-any.whl                                                                              
Collecting libmagic (from -r requirements.txt (line 2))                                                                                                                                                                                    
  Using cached https://files.pythonhosted.org/packages/83/86/419ddfc3879b4565a60e0c75b6d19baec48428cbc2f15aca5320b3d136f6/libmagic-1.0.tar.gz                                                                                              
Collecting argparse (from -r requirements.txt (line 4))
  Downloading https://files.pythonhosted.org/packages/f2/94/3af39d34be01a24a6e65433d19e107099374224905f1e0cc6bbe1fd22a2f/argparse-1.4.0-py2.py3-none-any.whl
Building wheels for collected packages: libmagic
  Running setup.py bdist_wheel for libmagic ... done
  Stored in directory: /root/.cache/pip/wheels/cc/87/c4/d46240df98e44f62bb75d8a6f2ea3f9d4f33ed1acad1d162a0
Successfully built libmagic
Installing collected packages: colorlog, libmagic, argparse
Successfully installed argparse-1.4.0 colorlog-4.1.0 libmagic-1.0
root@kali:~/tools/KatzKatz# python3 katzkatz.py -f /root/loot/lsass2.log

     /$$   /$$             /$$              /$$   /$$             /$$
    | $$  /$$/            | $$             | $$  /$$/            | $$
    | $$ /$$/   /$$$$$$  /$$$$$$  /$$$$$$$$| $$ /$$/   /$$$$$$  /$$$$$$  /$$$$$$$$
    | $$$$$/   |____  $$|_  $$_/ |____ /$$/| $$$$$/   |____  $$|_  $$_/ |____ /$$/
    | $$  $$    /$$$$$$$  | $$      /$$$$/ | $$  $$    /$$$$$$$  | $$      /$$$$/
    | $$\  $$  /$$__  $$  | $$ /$$ /$$__/  | $$\  $$  /$$__  $$  | $$ /$$ /$$__/
    | $$ \  $$|  $$$$$$$  |  $$$$//$$$$$$$$| $$ \  $$|  $$$$$$$  |  $$$$//$$$$$$$$
    |__/  \__/ \_______/   \___/ |________/|__/  \__/ \_______/   \___/ |________/
    

KatzKatz By @x_Freed0m

[10-03-2020 10:42] - All done! parsed 75 sets credentials, found 6 valid creds.
Unique sets: 6.                                                                                                                                                                                                                            
Saving them to the output file: /root/tools/KatzKatz\katzkatz.csv.    

[xFreed0m]

script is written for python3 and require installing the package using pip3, not sure i understand the issue.

[voidnecron]

Hi! Thanks for your response man, appriciated it, as well as your code! at your mainpage (https://github.com/xFreed0m/KatzKatz) you state it's tested for Python 2.7, not 3. You might need to change that in the Compatibility part. Furthermore, you state this for installation: pip install -r requirments.txt You might need to change this to pip3 install. And requirements is misspelled, missing an E. Lastly, your regex doesn't work when the Mimikatz logfile was created with Pypykatz. I'm currently working on this, but my coding skills are poor. Perhaps you're able to assist me? Cheers

[xFreed0m]

oh, you are right, i've updated the readme for python3 :)

regarding pypykatz, i would need to think about how to do it, if the output is different, we would need a different regex and to identify which log originates from which tool. i might be able to complete that in the future.

[voidnecron]

Yeah, difference are for instance this from Mimikatz:
* Username : something
* Domain : SOMEDOMAIN
* NTLM : 0af3e6sa4df27a4dbgfe24df540cb9e8

And this from Pypykatz:
Username: something
Domain: SOMEDOMAIN
LM: NA
NT: 0af3e6sa4df27a4dbgfe24df540cb9e8

Would you like me to create a new feature request for this?

[xFreed0m]

i'll try to find sometime in the near future to implement a solution.

…

On Tue, Mar 10, 2020 at 3:53 PM Vodi ***@***.***> wrote: Yeah, difference are for instance this from Mimikatz: * Username : something * Domain : SOMEDOMAIN * NTLM : 0af3e6sa4df27a4dbgfe24df540cb9e8 And this from Pypykatz: Username: something Domain: SOMEDOMAIN LM: NA NT: 0af3e6sa4df27a4dbgfe24df540cb9e8 — You are receiving this because you modified the open/close state. Reply to this email directly, view it on GitHub <#3?email_source=notifications&email_token=ADKUXUUJMLX5B6IKM57TVQDRGZA6BA5CNFSM4LE2XJJ2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEOLP2KY#issuecomment-597097771>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADKUXUWTNNPQB5VXWLQFRB3RGZA6BANCNFSM4LE2XJJQ> .

--

-Roei.