mirror of
https://github.com/GhostPack/Rubeus
synced 2026-06-08 11:10:41 +00:00
harmj0y
e52cb87a58
-Added universal '/nowrap' flag to prevent base64-blobs from being line wrapped
-Added '/consoleoutfile' to output console output to a file
-Added public 'MainString("command")' function to invoke over PSRemoting
-"brute" action to perform password bruteforcing attacks using raw AS-REQs (from @Zer1t0)
-Standardized "/user","/LUID","/service","/server" targeting to triage/klist/dump actions
-Added to the "kerberoast" action:
-"/pwdsetafter", "/pwdsetbefore", and "/resultlimit" arguments for better targeting (from @pkb1s)
-"/stats" flag to list statistics of user accounts without actually roasting them
-"/ldapfilter" argument for adding custom LDAP filters to the user search query
-"/simple" argument for output file formatting but to the console
-Added "/ldapfilter" argument to the "asreproast" actions
-Added to the "asktgt"/"asktgs"/"s4u" actions the option to save the .kirbi file to disk (from @audrummer15)
-Added a "currentluid" command to display the current logon sesion ID
-Cross-domain s4u functionality (from @0xe7)
-Overhauled LSA.cs for reusability and flexibility (thanks for the help @leechristensen !)
-"kerberoast" action updated to exclude disabled accounts by default
-"harvest" mode's "/interval" argument is now in seconds, to match "/monitor"
-"harvest/"monitor" revamped to no longer depend on 4624 events, does full extraction on each round
-Fixed some timestamp converting code in the ticket extraction section
-KERB_RETRIEVE_TKT_REQUEST fix for x32 systems (from @0xRCA)
-Fixed AES salt generation (from @monoxgas)
-Fixed accidental ticket request behavior when dumping from LsaCallAuthenticationPackage
-Fixed "renew" command invocation
-Fixed "asreproast" LDAP querying
77 lines
2.3 KiB
C#
Executable File
77 lines
2.3 KiB
C#
Executable File
using System;
|
|
using System.Collections.Generic;
|
|
using System.IO;
|
|
|
|
|
|
namespace Rubeus.Commands
|
|
{
|
|
public class RenewCommand : ICommand
|
|
{
|
|
public static string CommandName => "renew";
|
|
|
|
public void Execute(Dictionary<string, string> arguments)
|
|
{
|
|
string outfile = "";
|
|
bool ptt = false;
|
|
string dc = "";
|
|
|
|
if (arguments.ContainsKey("/outfile"))
|
|
{
|
|
outfile = arguments["/outfile"];
|
|
}
|
|
|
|
if (arguments.ContainsKey("/ptt"))
|
|
{
|
|
ptt = true;
|
|
}
|
|
|
|
if (arguments.ContainsKey("/dc"))
|
|
{
|
|
dc = arguments["/dc"];
|
|
}
|
|
|
|
if (arguments.ContainsKey("/ticket"))
|
|
{
|
|
string kirbi64 = arguments["/ticket"];
|
|
byte[] kirbiBytes = null;
|
|
|
|
if (Helpers.IsBase64String(kirbi64))
|
|
{
|
|
kirbiBytes = Convert.FromBase64String(kirbi64);
|
|
}
|
|
else if (File.Exists(kirbi64))
|
|
{
|
|
kirbiBytes = File.ReadAllBytes(kirbi64);
|
|
}
|
|
|
|
if(kirbiBytes == null)
|
|
{
|
|
Console.WriteLine("\r\n[X] /ticket:X must either be a .kirbi file or a base64 encoded .kirbi\r\n");
|
|
}
|
|
else
|
|
{
|
|
KRB_CRED kirbi = new KRB_CRED(kirbiBytes);
|
|
if (arguments.ContainsKey("/autorenew"))
|
|
{
|
|
Console.WriteLine("[*] Action: Auto-Renew Ticket\r\n");
|
|
// if we want to auto-renew the TGT up until the renewal limit
|
|
Renew.TGTAutoRenew(kirbi, dc);
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine("[*] Action: Renew Ticket\r\n");
|
|
// otherwise a single renew operation
|
|
byte[] blah = Renew.TGT(kirbi, outfile, ptt, dc);
|
|
}
|
|
}
|
|
|
|
return;
|
|
}
|
|
else
|
|
{
|
|
Console.WriteLine("\r\n[X] A /ticket:X needs to be supplied!\r\n");
|
|
return;
|
|
}
|
|
}
|
|
}
|
|
} |