Par : gentilkiwi

Hi Michel,

Services passwords, computers passwords, and some others are not necessary « human readable ». Nobody type them ! so in some cases Windows generates random « binary » passwords !

In your case b2 28 3b f5 [...] d6 ec 35 b6 is the real binary passwords =)

const BYTE pwd[] = {0xb2, 0x28, 0x3b, 0xf5, [...], 0xd6, 0xec, 0x35, 0xb6};
SHA_CTX shactxInput;
SHA_DIGEST shaInput;

A_SHAInit(&shactxInput);
A_SHAUpdate(&shactxInput, pwd, sizeof(pwd));
A_SHAFinal(&shactxInput, &shaInput);

kull_m_string_wprintf_hex(shaInput.digest, SHA_DIGEST_LENGTH, 1);

Output is : 3b 62 64 00 1f eb c9 91 7d 70 0c b0 4f 13 07 66 7f cf b0 50, your SHA1 ;)
mimikatz credentials output routine try to detect if the password is a printable string, if not, it display it in hex.