Fix lsass dump files deleting process when dump fail

Author: termanix

nxc/modules/handlekatz.py

@@ -78,6 +78,7 @@ def on_admin_login(self, context, connection):
 
         if not p or p == "None":
             context.log.fail("Failed to execute command to get LSASS PID")
+            self.delete_handlekatz_binary(connection, context)
             return
         # we get a CSV string back from `tasklist`, so we grab the PID from it
         pid = p.split(",")[1][1:-1]
@@ -113,11 +114,7 @@ def on_admin_login(self, context, connection):
                 except Exception as e:
                     context.log.fail(f"Error while get file: {e}")
 
-            try:
-                connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
-                context.log.success(f"Deleted handlekatz file on the {self.share} share")
-            except Exception as e:
-                context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")
+            self.delete_handlekatz_binary()
 
             try:
                 connection.conn.deleteFile(self.share, self.tmp_share + machine_name)
@@ -182,3 +179,13 @@ def on_admin_login(self, context, connection):
                         add_user_bh(credz_bh, None, context.log, connection.config)
                 except Exception as e:
                     context.log.fail(f"Error opening dump file: {e}")
+
+        else:
+            self.delete_handlekatz_binary(connection, context)
+
+    def delete_handlekatz_binary(self, connection, context):
+        try:
+            connection.conn.deleteFile(self.share, self.tmp_share + self.handlekatz)
+            context.log.success(f"Deleted handlekatz file on the {self.share} share")
+        except Exception as e:
+            context.log.fail(f"[OPSEC] Error deleting handlekatz file on share {self.share}: {e}")

nxc/modules/nanodump.py

@@ -252,6 +252,9 @@ def on_admin_login(self, context, connection):
                 except Exception as e:
                     self.context.log.fail(f"Error opening dump file: {e}")
 
+        else:
+            self.delete_nanodump_binary()
+    
     def delete_nanodump_binary(self):
         try:
             self.connection.execute(f"del {self.remote_tmp_dir + self.nano}")