admin/Pennyw0rth-NetExec
1
0
Fork 0
mirror of https://github.com/Pennyw0rth/NetExec synced 2026-06-06 16:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Factorize code

Browse Source
This commit is contained in:
Neoreo
2026-02-28 11:00:46 +01:00
parent d818235795
commit fa7706b807
1 changed files with 21 additions and 29 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nxc/protocols/ldap.py
+21 -29
View File
@@ -1382,25 +1382,28 @@ class ldap(connection):
passwd = "<no read permissions>"
aes256 = aes128 = None
if "msDS-ManagedPassword" in acc:
blob = MSDS_MANAGEDPASSWORD_BLOB()
blob.fromString(acc["msDS-ManagedPassword"])
currentPassword = blob["CurrentPassword"][:-2]
ntlm_hash = MD4.new()
ntlm_hash.update(currentPassword)
passwd = hexlify(ntlm_hash.digest()).decode("utf-8")
# Compute Kerberos AES keys
password = currentPassword.decode("utf-16-le", "replace").encode("utf-8")
sam = acc["sAMAccountName"]
salt = f"{self.domain.upper()}host{sam[:-1].lower()}.{self.domain.lower()}"
aes256 = hexlify(string_to_key(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value, password, salt).contents).decode()
aes128 = hexlify(string_to_key(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, password, salt).contents).decode()
self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} NTLM: {passwd:<36} PrincipalsAllowedToReadPassword: {principal_with_read}")
if aes256:
self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} aes256-cts-hmac-sha1-96: {aes256}")
if aes128:
passwd, aes128, aes256 = self.gmsa_compute_secrets(acc["msDS-ManagedPassword"], acc["sAMAccountName"])
self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} NTLM: {passwd:<36} PrincipalsAllowedToReadPassword: {principal_with_read}")
self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} aes128-cts-hmac-sha1-96: {aes128}")
self.logger.highlight(f"Account: {acc['sAMAccountName']:<20} aes256-cts-hmac-sha1-96: {aes256}")
return True
def gmsa_compute_secrets(self, data, sam):
# Compute NT Hash
blob = MSDS_MANAGEDPASSWORD_BLOB()
blob.fromString(data)
current_password = blob["CurrentPassword"][:-2]
ntlm_hash = MD4.new()
ntlm_hash.update(current_password)
passwd = hexlify(ntlm_hash.digest()).decode("utf-8")
# Compute Kerberos Keys
password = current_password.decode("utf-16-le", "replace").encode("utf-8")
sam_no_dollar = sam[:-1] if sam.endswith("$") else sam
salt = f"{self.domain.upper()}host{sam_no_dollar.lower()}.{self.domain.lower()}"
aes256 = hexlify(string_to_key(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value, password, salt).contents).decode()
aes128 = hexlify(string_to_key(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, password, salt).contents).decode()
return passwd, aes128, aes256
def decipher_gmsa_name(self, domain_name=None, account_name=None):
# https://aadinternals.com/post/gmsa/
gmsa_account_name = (domain_name + account_name).upper()
@@ -1459,21 +1462,10 @@ class ldap(connection):
if self.decipher_gmsa_name(self.domain.split(".")[0], acc["sAMAccountName"][:-1]) == gmsa_id:
gmsa_id = acc["sAMAccountName"]
break
# convert to ntlm
# Compute the password and keys
data = bytes.fromhex(gmsa_pass)
blob = MSDS_MANAGEDPASSWORD_BLOB()
blob.fromString(data)
currentPassword = blob["CurrentPassword"][:-2]
ntlm_hash = MD4.new()
ntlm_hash.update(currentPassword)
passwd = hexlify(ntlm_hash.digest()).decode("utf-8")
passwd, aes128, aes256 = self.gmsa_compute_secrets(data, gmsa_id)
self.logger.highlight(f"Account: {gmsa_id:<20} NTLM: {passwd}")
# Compute Kerberos AES keys
password = currentPassword.decode("utf-16-le", "replace").encode("utf-8")
sam_no_dollar = gmsa_id[:-1] if gmsa_id.endswith("$") else gmsa_id
salt = f"{self.domain.upper()}host{sam_no_dollar.lower()}.{self.domain.lower()}"
aes256 = hexlify(string_to_key(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value, password, salt).contents).decode()
aes128 = hexlify(string_to_key(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, password, salt).contents).decode()
self.logger.highlight(f"Account: {gmsa_id:<20} aes256-cts-hmac-sha1-96: {aes256}")
self.logger.highlight(f"Account: {gmsa_id:<20} aes128-cts-hmac-sha1-96: {aes128}")
else: