Merge pull request #1135 from Eliotsehr/fix_krb_S4U

Fix authentication from CCACHE when using kerberos S4U over SMB

nxc/connection.py

@@ -22,6 +22,7 @@ from nxc.protocols.ldap.laps import laps_search
 from nxc.helpers.pfx import pfx_auth
 
 from impacket.dcerpc.v5 import transport
+from impacket.krb5.ccache import CCache
 
 sem = BoundedSemaphore(1)
 global_failed_logins = 0
@@ -552,7 +553,7 @@ class connection:
         if self.args.use_kcache:
             self.logger.debug("Trying to authenticate using Kerberos cache")
             with sem:
-                username = self.args.username[0] if len(self.args.username) else ""
+                username = self.args.username[0] if len(self.args.username) else CCache.parseFile()[1]
                 password = self.args.password[0] if len(self.args.password) else ""
                 self.kerberos_login(self.domain, username, password, "", "", self.kdcHost, True)
                 self.logger.info("Successfully authenticated using Kerberos cache")

nxc/protocols/ldap.py

@@ -319,7 +319,6 @@ class ldap(connection):
             self.domain = self.args.domain
         elif self.args.use_kcache:  # Fixing domain trust, just pull the auth domain out of the ticket
             self.domain = CCache.parseFile()[0]
-            self.username = CCache.parseFile()[1]
         else:
             self.domain = self.targetDomain
 
@@ -363,7 +362,7 @@ class ldap(connection):
             self.logger.fail("Simple bind and Kerberos authentication are mutually exclusive.")
             return False
 
-        self.username = username if not self.args.use_kcache else self.username    # With ccache we get the username from the ticket
+        self.username = username
         self.password = password
         self.domain = domain
         self.kdcHost = kdcHost

nxc/protocols/smb/kerberos.py

@@ -21,12 +21,13 @@ from nxc.logger import nxc_logger
 def kerberos_login_with_S4U(domain, hostname, username, password, nthash, lmhash, aesKey, kdcHost, impersonate, spn, use_cache, no_s4u2proxy=False):
     my_tgt = None
     if use_cache:
-        domain, _, tgt, _ = CCache.parseFile(domain, username, f"cifs/{hostname}")
-        if my_tgt is None:
+        domain, _, tgt, _ = CCache.parseFile(domain, username)
+        if tgt is None:
             raise
         my_tgt = tgt["KDC_REP"]
         cipher = tgt["cipher"]
         session_key = tgt["sessionKey"]
+        my_tgt = decoder.decode(my_tgt, asn1Spec=AS_REP())[0]
     if my_tgt is None:
         principal = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
         nxc_logger.debug("Getting TGT for user")