pypykatz: 'AES' object has no attribute 'block_size'

I am getting an AttributeError when trying to decode blobs using master key. I installed pypykatz using pip. It looks like a problem with dependencies. Do I need to install any additional package(s) with pip?

pypykatz dpapi blob masterkey encrypted_key.blob

Traceback (most recent call last):
  File "/usr/sbin/pypykatz", line 8, in <module>
    sys.exit(main())
  File "/usr/lib/python3.10/site-packages/pypykatz/__main__.py", line 89, in main
    helper.execute(args)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/cmdhelper.py", line 121, in execute
    self.run(args)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/cmdhelper.py", line 233, in run
    dec_sec = dpapi.decrypt_securestring_file(args.blob)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py", line 541, in decrypt_securestring_file
    return self.decrypt_securestring_hex(data)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py", line 536, in decrypt_securestring_hex
    return self.decrypt_securestring_bytes(bytes.fromhex(hex_str))
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py", line 533, in decrypt_securestring_bytes
    return self.decrypt_blob_bytes(data)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py", line 449, in decrypt_blob_bytes
    return self.decrypt_blob(blob, key = key)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/dpapi.py", line 434, in decrypt_blob
    return dpapi_blob.decrypt(key)
  File "/usr/lib/python3.10/site-packages/pypykatz/dpapi/structures/blob.py", line 109, in decrypt
    cleartext = unpad(cipher.decrypt(self.data), cipher.block_size)
AttributeError: 'AES' object has no attribute 'block_size'

About this issue

Original URL
State: closed
Created 2 years ago
Comments: 19 (9 by maintainers)

Most upvoted comments

Try now with a clean environment, cloning master (new version uploaded)
There will be a new command for chrome like:
pypykatz dpapi chrome masterkey Local\ State --logindata Login\ Data

skelsec on May 20, 2022

The reason you get that message is that I like stack traces, don’t kink shame me.
You are using the incorrect decrypt function for chrome. Not your fault as I forgot to push the code for that part tho.
Please wait till I push the new code because it fixes another error which came in -again- because of the unicrypto lib.

skelsec on May 20, 2022

I’d suggest 0.5.2 That one is before unicrypto got added.

skelsec on May 20, 2022

This is a bug caused by the change of crypto library in the recent month and the lack of tests on the DPAPI module.

skelsec on May 20, 2022