From 77d2c1c12af6813751cfb1d4fb6d30f0a94f59df Mon Sep 17 00:00:00 2001 From: Eliotsehr Date: Thu, 5 Mar 2026 13:01:25 +0100 Subject: [PATCH 1/3] Fix authentication from CCACHE when using kerberos S4U over SMB --- nxc/protocols/smb/kerberos.py | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/nxc/protocols/smb/kerberos.py b/nxc/protocols/smb/kerberos.py index d34795b6..c8a3d2ba 100644 --- a/nxc/protocols/smb/kerberos.py +++ b/nxc/protocols/smb/kerberos.py @@ -21,12 +21,13 @@ from nxc.logger import nxc_logger def kerberos_login_with_S4U(domain, hostname, username, password, nthash, lmhash, aesKey, kdcHost, impersonate, spn, use_cache, no_s4u2proxy=False): my_tgt = None if use_cache: - domain, _, tgt, _ = CCache.parseFile(domain, username, f"cifs/{hostname}") - if my_tgt is None: + domain, _, tgt, _ = CCache.parseFile(domain, username) + if tgt is None: raise my_tgt = tgt["KDC_REP"] cipher = tgt["cipher"] session_key = tgt["sessionKey"] + my_tgt = decoder.decode(my_tgt, asn1Spec=AS_REP())[0] if my_tgt is None: principal = Principal(username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) nxc_logger.debug("Getting TGT for user") From 011416bd0cde9d2c2dbf7fafc609e1fb392d7b48 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Wed, 11 Mar 2026 07:56:05 -0400 Subject: [PATCH 2/3] Get username from TGT/ST if not supplied --- nxc/connection.py | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/nxc/connection.py b/nxc/connection.py index 6d241820..062b91c1 100755 --- a/nxc/connection.py +++ b/nxc/connection.py @@ -22,6 +22,7 @@ from nxc.protocols.ldap.laps import laps_search from nxc.helpers.pfx import pfx_auth from impacket.dcerpc.v5 import transport +from impacket.krb5.ccache import CCache sem = BoundedSemaphore(1) global_failed_logins = 0 @@ -552,7 +553,7 @@ class connection: if self.args.use_kcache: self.logger.debug("Trying to authenticate using Kerberos cache") with sem: - username = self.args.username[0] if len(self.args.username) else "" + username = self.args.username[0] if len(self.args.username) else CCache.parseFile()[1] password = self.args.password[0] if len(self.args.password) else "" self.kerberos_login(self.domain, username, password, "", "", self.kdcHost, True) self.logger.info("Successfully authenticated using Kerberos cache") From d41ff46e1406ca3fa7a1fbedea5641038b772ffc Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Wed, 11 Mar 2026 07:58:45 -0400 Subject: [PATCH 3/3] Remove obsolete parsing for ccache inside ldap --- nxc/protocols/ldap.py | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/nxc/protocols/ldap.py b/nxc/protocols/ldap.py index d96b996d..635f8a48 100644 --- a/nxc/protocols/ldap.py +++ b/nxc/protocols/ldap.py @@ -319,7 +319,6 @@ class ldap(connection): self.domain = self.args.domain elif self.args.use_kcache: # Fixing domain trust, just pull the auth domain out of the ticket self.domain = CCache.parseFile()[0] - self.username = CCache.parseFile()[1] else: self.domain = self.targetDomain @@ -363,7 +362,7 @@ class ldap(connection): self.logger.fail("Simple bind and Kerberos authentication are mutually exclusive.") return False - self.username = username if not self.args.use_kcache else self.username # With ccache we get the username from the ticket + self.username = username self.password = password self.domain = domain self.kdcHost = kdcHost