Commit Graph

Select branches

Hide Pull Requests

change_expired_pw

credguard

fix_encoding

fix_x86_branch

logonsession-info

master

newpac_default

principal_types

rubeus-3.5

s4u2self_fix

#10

#101

#104

#105

#107

#108

#109

#11

#110

#112

#113

#115

#116

#118

#12

#121

#121

#122

#125

#126

#127

#128

#129

#129

#130

#130

#131

#132

#133

#133

#134

#135

#136

#137

#137

#138

#139

#141

#143

#144

#146

#146

#147

#149

#15

#152

#153

#154

#154

#156

#157

#159

#162

#162

#163

#163

#165

#166

#167

#167

#168

#170

#172

#174

#175

#176

#177

#178

#180

#182

#183

#183

#186

#187

#187

#188

#190

#190

#191

#193

#194

#197

#198

#199

#2

#200

#201

#203

#203

#204

#204

#206

#207

#207

#208

#209

#212

#212

#214

#214

#215

#216

#217

#217

#22

#221

#221

#26

#28

#29

#3

#30

#31

#36

#37

#39

#4

#40

#46

#49

#5

#52

#54

#56

#57

#58

#59

#6

#60

#61

#62

#64

#65

#66

#69

#7

#70

#72

#73

#79

#79

#8

#80

#82

#83

#84

#85

#87

#87

#88

#89

#9

#91

#92

#94

#95

#96

1.6.4

Mono Color

• 71b23d8bf2 complete overhaul of AuthorizationData Charlie Clark 2021-05-30 16:30:07 +01:00
• 9b141b6ac4 added ResourceGroup output to describe Charlie Clark 2021-05-29 03:08:25 +01:00
• 3f9134e6e6 added support for encoding/decoding S4UDelegationInfo and printing it using describe Charlie Clark 2021-05-29 02:28:38 +01:00
• 645e8cde8b added grabbing netbios from LDAP, along with the /netbios argument, /creduser and /credpassword arguments for authenticating to LDAP and /sids for extra sids Charlie Clark 2021-05-28 23:19:31 +01:00
• 20cd8f1409 Golden/Silver tickets now pass as valid by DC's :) CCob 2021-05-28 13:26:13 +01:00
• 5824610706 fixed some differences between genuine PACs and forged PACs Charlie Clark 2021-05-28 01:14:56 +01:00
• c4a272baf9 added golden command and fixed EncTicketPart to use DateTimeUtcNow Charlie Clark 2021-05-27 15:32:38 +01:00
• 9ff342ff0d inital code for /fromldap switch to the silver command Charlie Clark 2021-05-27 14:51:09 +01:00
• b55f63f252 Added managed helper constructors for NDR types CCob 2021-05-27 09:59:59 +01:00
• 34e7cc1010 got PAC signature validation working in EncTicketPart.cs ValidatePac and created some initial code for the silver command, just missing the LogonInfo PAC section for this to work Charlie Clark 2021-05-27 08:52:58 +01:00
• cc33d4a067 Split decryption of tickets and PAC decoding into logical functions inside EncTicketPart and Ticket CCob 2021-05-25 22:37:19 +01:00
• 56fc5c9099 Merge branch 'master' of gitlab.com:CCob/rubeus CCob 2021-05-25 21:52:03 +01:00
• 513a86aaac Added enums for UserAccountControl and UserFlags within the PAC, added Extra SIDs information to describe output and stopped describe from outputting a hash for krbtgt service Charlie Clark 2021-05-25 21:44:36 +01:00
• 358007d31c Merge branch 'master' of gitlab.com:CCob/rubeus CCob 2021-05-25 21:34:08 +01:00
• 2ae0044de9 removed PacSignatureType and replaced with Interop.KERB_CHECKSUM_ALGORITHM in SignatureData.cs Charlie Clark 2021-05-25 13:11:20 +01:00
• 663d6965dc Merge branch 'master' of gitlab.com:CCob/rubeus CCob 2021-05-25 10:18:58 +01:00
• 31a4a4cb3e Support encoding the PACTYPE struct and all containing PAC's CCob 2021-05-25 10:17:54 +01:00
• c864a80d45 added /servicekey, /asrepkey, /serviceuser and /servicedomain arguments to describe command Charlie Clark 2021-05-25 04:10:31 +01:00
• f6a12893b1 Merge branch 'master' of https://github.com/GhostPack/Rubeus CCob 2021-05-23 14:11:23 +01:00
• e8e403f8ce Implemented support for PAC decryption with known service key (krbtgt for AS-REP and service key for TGS-REP) CCob 2021-05-23 14:11:13 +01:00
• 7049cf79f1 PKINIT supplemental creds (NTLM) now decrypted and dumped with tgtask CCob 2021-05-22 21:16:09 +01:00
• b5d09dfb13 Merge pull request #83 from mbinns/networkingloop Will 2021-05-21 16:44:50 -07:00
• 018cdcfd58 Update networking.cs sendbytes function to loop rather than set a timeout and wait. Mack 2021-05-21 14:56:07 -07:00
• 07a5fd8ee7 Initial support for PAC decryption. CCob 2021-05-21 22:14:49 +01:00
• c4e06fbdff Merge pull request #82 from 0xe7/additional-ticket Will 2021-05-14 08:59:23 -07:00
• d4e00a78a8 fixed typo in README 0xe7 2021-05-14 02:07:07 +01:00
• 54e0604b04 added support for /tgs: for the asktgs command and a /usesvcdomain switch for cross domain support when using /tgs: 0xe7 2021-05-14 02:03:25 +01:00
• 2e7256a331 Merge pull request #80 from rvrsh3ll/master Will 2021-04-12 09:30:58 -07:00
• dbed6691fc FIx Type 18 Hash Format Steve Borosh 2021-04-12 08:35:26 -04:00
• 6b0e97f879 fixed missing using statement leechristensen 2021-04-02 09:54:25 -07:00
• 7da3ec43a1 Wait to read data Lee Christensen 2021-04-01 09:41:16 -07:00
• 4bfe21fe8c added some error checking leechristensen 2021-03-30 06:47:46 -07:00
• 1b9d0d3f49 Replace README info HarmJ0y 2021-03-26 16:45:53 -07:00
• f12a6f1bb6 Added Rubeus.yar HarmJ0y 2021-03-12 10:01:38 -08:00
• 0c7e522edb Version 1.6.2 HarmJ0y 2021-03-12 09:45:00 -08:00
• 89c0bf6b07 Updated README.md harmj0y 2021-01-25 16:20:05 -08:00
• a684c3ceb5 Kerberoasting fixes harmj0y 2020-12-10 11:33:16 -08:00
• 753ff346fd Merge pull request #73 from 0xe7/CVE-2020-17049 Will 2020-12-10 10:34:10 -08:00
• d3180f752f updating documentation with /bronzebit switch and changed BuildTicket to ForgeTicket 0xe7 2020-12-10 16:42:57 +00:00
• 276c453e28 Merge pull request #72 from 0xe7/kerberoasting Will 2020-12-10 08:31:28 -08:00
• 819d3f4e3e included initial support for basic silver tickets, without a PAC 0xe7 2020-12-10 02:30:23 +00:00
• 40bfe34f78 added support for CVE-2020-17049 using the /bronzebit switch 0xe7 2020-12-09 22:30:53 +00:00
• 2b6c4ebaa7 bumping the build version number in Info.cs 0xe7 2020-12-07 15:52:29 +00:00
• 1a3f41434d removed port section from targetDomain when the SPN is in the form 'svc/domain.com:1234' 0xe7 2020-12-04 10:46:04 +00:00
• f419d6c12d fixed typo 0xe7 2020-12-04 00:44:17 +00:00
• 2cbd4233da fixed cross domain enterprise princiapl kerberoasting, fixed kerberoastring using the DC IP and supplying a TGT (by resolving the IP to a name for the LDAP service ticket) and added a /autoenterprise flag to automate retrying failed kerberoasting attempts 0xe7 2020-12-04 00:33:28 +00:00
• 577a591be3 Merge pull request #70 from GhostPack/bugfix-kerberoastlastpwdset Will 2020-11-12 08:13:13 -08:00
• 2cb23cacbc Fix for issue #71 harmj0y 2020-11-12 08:11:28 -08:00
• 0eb8240b52 fixed kerberoast bug when lastpwdset doesn't exist leechristensen 2020-11-12 02:03:46 -08:00
• a354f6451e Updated version and changelog harmj0y 2020-11-06 12:57:30 -08:00
• a9c6c82cd8 Merge pull request #69 from 0xe7/opsec Will 2020-11-06 12:40:30 -08:00
• f2fb7d51dc updated Info.cs usage information with the new arguments and switches 0xe7 2020-11-05 23:32:58 +00:00
• 09c533edf6 modified README.md to including information about the various PR's I've done 0xe7 2020-10-30 11:15:33 +00:00
• 57a7ccf2c8 Added PA-DATA PA-PAC-OPTIONS to normal TGS-REQ when using /opsec 0xe7 2020-10-28 23:35:14 +00:00
• b789b8b201 made most of the changes for opsec S4U2Self and S4U2Proxy requests, only PA_S4U_X509_USER to get working properly, also removed CLSCompliant declarations from BigInteger.cs to fix compile warnings 0xe7 2020-10-15 00:27:33 +01:00
• e1b0476902 Resolved merge conflicts with certificate TGT updates 0xe7 2020-10-14 01:37:28 +01:00
• bef54518be Casing fix for salts harmj0y 2020-10-08 10:40:16 -07:00
• dbcf906e2e Fix for computer account salts harmj0y 2020-10-08 09:47:06 -07:00
• be6bd84d31 Merge pull request #66 from ringt/fipsfix Will 2020-10-08 09:37:24 -07:00
• 484cbda73e fix to switch to FIPS compliant algorithms/classes thomas ring 2020-10-06 11:07:29 -05:00
• a469f29950 Merge pull request #65 from CCob/master Will 2020-10-05 12:01:50 -07:00
• 2d5e977cd0 Typo fixes Will 2020-10-03 10:42:12 -07:00
• f1138ddadf Updated README.md harmj0y 2020-10-02 14:57:49 -07:00
• afa7ca11a0 Merge pull request #64 from CCob/master Will 2020-10-02 14:28:44 -07:00
• c46eac2004 Merge branch 'opsec' of github.com:0xe7/Rubeus into opsec 0xe7 2020-09-29 13:23:44 +01:00
• 05dbe31ceb adding automation of requesting forwarded TGT when requesting a service ticket for a system configured for unconstrained delegation and using the /opsec flag, also add initial changes for S4U /opsec changes 0xe7 2020-09-29 01:07:19 +01:00
• ba70b895a3 adding automation of requesting forwarded TGT when requesting a service ticket for a system configured for unconstrained delegation and using the /opsec flag 0xe7 2020-09-29 01:07:19 +01:00
• 72a5b660fd Smartcard PIN can now be set programatically using /password param CCob 2020-09-28 22:03:43 +01:00
• 3746efd67d Initial support for PKINIT TGT's CCob 2020-09-24 20:22:33 +01:00
• bf70ca20e4 changed .NET version back to 3.5 0xe7 2020-09-22 22:51:53 +01:00
• 352d3d7eaf fixed some small issues with kerberoasting when providing a TGT or referral TGT 0xe7 2020-09-22 22:50:25 +01:00
• 89cf473ec2 avoided sending AS-REQ when preauth is disabled, added some checks for specific requests, like adding authdata to TGS-REQs only when the request is for a remote system 0xe7 2020-09-21 02:51:58 +01:00
• 63218266e0 added enc-authorization-data to TGS-REQs when using /opsec 0xe7 2020-09-19 20:20:07 +01:00
• da836a9cc9 added checksum to TGS-REQs when using asktgs with /opsec, moved padata to the end to do this, also changed to use an enum for principal types rather than using ints everywhere 0xe7 2020-09-16 23:40:41 +01:00
• 16f782696d added random sequence number for TGS_REQs when using /opsec and added warning when using /opsec and not AES256 with an option to /force 0xe7 2020-09-13 01:14:47 +01:00
• 2b063e9280 made some initial changes to TGS-REQs for opsec, still need to make a few more changes, also change the kerb message type to an enum rather than using ints everywhere 0xe7 2020-09-12 22:32:02 +01:00
• 3ba36be14f fixed padding code for hostnames and added addresses code to the final AS-REQ 0xe7 2020-09-12 00:42:22 +01:00
• 2f49583d26 added /opsec switch to asktgt build requests more realistic, still potentially some work to do on addresses 0xe7 2020-09-11 23:51:58 +01:00
• 075453288a Merge pull request #62 from 0xe7/kerberoast Will 2020-09-08 17:21:08 -07:00
• f047b1d429 fixing kerberoasting when using TGT to authenticate but not supplying SPNs 0xe7 2020-09-07 21:16:20 +01:00
• 8c8762367e Merge pull request #61 from 0xe7/code-cleanup Will 2020-09-05 21:00:33 -07:00
• d6e059a3ac some code cleanup and added support for S4U2Self referral tickets to request an S4U2Self 0xe7 2020-09-03 22:45:04 +01:00
• fbebfb2600 Merge pull request #60 from 0xe7/enterprise Will 2020-08-21 13:14:56 -07:00
• 76c8c6145b Added support for /spns option when kerberoasting which can be a comma separated list or a file containing one SPN per line, also fixed an issue when kerberoasting SPNs that aren't valid on the current domain which was broken by the cross domain service ticket request code 0xe7 2020-08-21 13:47:37 +01:00
• bfc0f5309d Added support for NT-Enterprise principals for service ticket requests on both the asktgs and kerberoast commands 0xe7 2020-08-21 11:36:53 +01:00
• 7a33cf8376 Fix for #21 harmj0y 2020-08-18 11:20:46 -07:00
• a9b86b315e Fix for #34 harmj0y 2020-08-18 11:15:26 -07:00
• a44c47551f Fix for issue #43 harmj0y 2020-08-18 10:49:37 -07:00
• 294fd5ccd2 Merge pull request #39 from iontodd/master Will 2020-08-18 10:45:35 -07:00
• fac7010467 Updated documentation to fix issue #55 harmj0y 2020-08-18 10:36:41 -07:00
• c443942ae9 Merge pull request #56 from G0ldenGunSec/runFor Will 2020-08-18 10:33:47 -07:00
• 437b3e9e7b Merge pull request #59 from ZeroDayLab/s4u2self-altservice Will 2020-08-18 10:28:18 -07:00
• dbdda140af Merge pull request #58 from ZeroDayLab/cross-tgs Will 2020-08-18 10:27:41 -07:00
• 968afdd0a7 Adding support for modifying S4U2Self tickets to be able to impersonate any user on the requesting machine 0xe7 2020-08-16 12:47:32 +01:00
• 9248716b70 Code Cleanup: Removed CrossDomainKRBTGT function and instead use Ask.TGS with the correct arguments to retrieve the cross-domain TGT 0xe7 2020-06-18 23:14:53 +01:00
• 198b46f328 adding check for krbtgt service so that cross domain TGT's can be requested properly 0xe7 2020-06-17 21:22:05 +01:00
• 002d6ada9d Even though a service ticket was returned, the KRB_CRED was not usable, this was due to the prealm being incorrect, fixed this by using the rep.crealm instead of encRepPart.realm, which is should always be the local domain, rather than the target domain 0xe7 2020-06-17 01:28:39 +01:00
• 78152be3d9 included support for cross domain ask tgs by getting target domain from the sname argument to NewTGSReq 0xe7 2020-06-17 00:01:33 +01:00
• 1e9fe7c3c2 Merge pull request #54 from VbScrub/master Will 2020-06-16 10:53:01 -07:00
• 9209134218 Merge pull request #57 from r3motecontrol/master Will 2020-06-16 10:52:06 -07:00