Skip to content

Conversation

@NeffIsBack
Copy link
Contributor

When using secrestdump SAM dump on Windows (e.g. --sam secdump or the backup_operator module) secretsdump crashes. This is due to the negative timestamp that is passed into datetime which can't be handled on windows:

# On Windows localtime_s throws an OSError for negative values,
# thus we can't perform fold detection for values of time less
# than the max time fold. See comments in _datetimemodule's
# version of this method for more details.
if t < max_fold_seconds and sys.platform.startswith("win"):
return result

This happens when the userAccountF['LastIncorrectPasswordTimestamp'] is zero in nt time and is then converted to a negative unixTimestamp integer. This can easily be fixed by manually returning the 0 nt timestamp on when the input is 0.

Before:
image
After:
image

@anadrianmanrique anadrianmanrique added the in review This issue or pull request is being analyzed label Nov 7, 2025
@anadrianmanrique anadrianmanrique self-assigned this Nov 7, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

in review This issue or pull request is being analyzed

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants