Use DCOMConnection in test_RemoteGetClassObject instead of a raw
DCE/RPC connection from self.connect(). RemoteGetClassObject returns an
interface whose RemRelease path expects the DCOMConnection PORTMAPS cache
to be initialized for the target; the raw connection path leaves that
cache empty and can raise KeyError keyed by the target address.
Wrap the interface use in a try/finally so the DCOM connection is always
disconnected after the test.
* Added a switch not to force RC4-HMAC when requesting a TGT as newer servers (e.g., 2025) won't issue service tickets when provided with RC4-HMAC TGT.
* Update examples/GetUserSPNs.py
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* preserve request-based ticket lifetime and add regression test
* tests: expand coverage for request-based ticket lifetime preservation
* Updated tests to comply with the code review
* Update examples/ticketer.py
* update description of the -duration parameter
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Fixed TS_ALL_PROCESSES_INFO parsing for RpcWinStationGetAllProcesses
* Removed ldap3 dependency, fixed mismatched data type for rawsid, added missing test
* Removed unused imports, renamed imagenamesize -> imagename to match docs. Added missing test
* Modify ticketer and ccache logic
* ticketer now update existing ccache if KRB5CCNAME is specified
* ticketConverter now convert all TGS within the Kirbi or provided Ccache
* Fix a bug during the conversion from ccache to kirbi that does not correctly preserve ticket flags
* Update kirbi test cases. Improve Kirbi to Ccache conversion.
* Fix describe ticket
* fix describeTicket credential indexing after skipped decrypts
Use enumerate() when iterating ccache credentials so output keeps the
correct credential index even when a ticket is skipped due to missing or
invalid decryption material.
Also update the Kerberoast debug message to report the ticket encrypted
part etype, matching the value now used for the extraction decision.
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Add rget command for recursive file download
* rget no longer swallows listing or download failures. It now restores self.pwd with try/finally and lets real exceptions propagate, so partial recursive downloads don’t fail silently.
The local path calculation now uses ntpath.relpath() from the starting remote directory instead of raw string replacement, which preserves nested paths like subdir/dir_backup/...
correctly.
---------
Co-authored-by: TheFlamingCrab <96930137+TheFlamingCrab@users.noreply.github.com>
Co-authored-by: Kali <adrian.manrique@gmail.com>
* fix(smbrelayserver): guard missing SMBClient and handle NTLM negotiate failures
* fix(winrmrelayclient): handle connection errors and detect NTLMv2 to abort futile relay
* fix(winrmrelayclient): update logging message
* Enhancing a bit the NTLMv2 detection - and clean up logging
* Clean up log
* Fixing wrong var name
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* raiseChild: fix PAC buffer preservation and add AES support for modern Windows
Two bugs fixed:
1. makeGolden() hardcoded exactly 4 PAC buffers, discarding all others.
Windows Server 2022 with CVE-2021-42287 patches requires PAC_REQUESTOR
(type 18) to be present. Stripping it causes KDC_ERR_TGT_REVOKED.
Fix: preserve all original PAC buffers, only update modified ones.
2. getKerberosTGT() called with aesKey=None hardcoded, ignoring -aesKey.
Fix: pass aesKey, try AES first then fall back to RC4.
Additional improvements:
- Auto-retry golden ticket with AES if RC4 is rejected by KDC
- Fix signature zeroing to use actual length instead of hardcoded 12/16
- Updated help text with AES key usage examples
Tested against Windows Server 2022 Build 20348. Backward compatible.
* krb5: share PAC rebuild and signing helpers
* krb5: share AES ticket key selection helpers
* Fix password fallback suppression and TGT re-acquisition on golden ticket retry
* raiseChild: fix credential retry flow
* raiseChild: pass normalized AES key to target exec login
---------
Co-authored-by: plur1bu5 <plur1bu5@users.noreply.github.com>
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Co-authored-by: Your Name <you@example.com>
* Add support for TDS 8.0 when Force Strict Encryption = Yes
* Match log syntax
* Only use TDS 8.0 if Force Strict Encryption is set to Yes
* Add comments back and fix typos
* Use short timeout, remove excessive debug logs, add comments
* Testing changes to make TDS more broadly applicable by moving to tds.py
* Add TLS 1.2 cap and EPA channel binding for TDS 8.0
* Fix TDS 8.0 DONE parsing and TLS state handling
* Use negotiated TDS version for DONE rowcount parsing
* Align strict TDS login with modern LOGIN7 flow
* Keep relay TLS socket for strict TDS sessions
* Reassemble relay TDS packets over TLS
* tds: stop advertising UTF-8 support
* tds: fix relay login failure token packing
* mssqlrelay: fix PRELOGIN thread id encoding
* tds: preserve default LOGIN7 version in serializer
* tds: only retry strict fallback on connection close
* ntlmrelayx: support strict MSSQL SOCKS reuse
* Reassemble TDS frames on TLS-backed MSSQL reads
---------
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Add shell commands to enable and disable the 'rpc out' option for
linked SQL servers via sp_serveroption. This allows executing stored
procedures remotely on linked servers directly from the SQL shell.
* Added remove_sign_seal flag, drop seal flag when remove mic
* moved seal flag removal from sendauth/remove-mic and into sendauth/remove-sign-seal
* Added missing token regeneration after removing seal
* Added fixes and tests for #2092, #2093, and #2094
* do not use interal __iter__ interface for av_pairs tests
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
When running secretsdump.py in offline mode (with -sam/-security/-system flags),
the $MACHINE.ACC secret was dumped as raw hex instead of showing the machine
account NTLM hash and Kerberos keys. This was because the machine name, domain,
and Kerberos salt were only retrieved via remoteOps (available in online mode).
Add __getMachineKerberosSaltOffline() to derive the Kerberos salt from the
SECURITY hive by reading Policy\PolDnDDN (domain FQDN) and Policy\PolAcDmN
(machine NetBIOS name), which are stored as LSA_UNICODE_STRING structures.
Use the same salt to resolve the machine name and domain for the NTLM hash
printout. This brings offline mode output to parity with online mode.
Co-authored-by: Croumi <Croumi>
* Fixed fragment_by_list() crash when child protocol is None
* removed the inline
* Added a regression test for IP.fragment_by_list() with Data payload
---------
Co-authored-by: herbenderbler <herbenderbler@users.noreply.github.com>
get_length() handles two BER definite-length forms:
- Short form (< 128): length is a single byte
- Long form (>= 128): length spans multiple bytes
The long form correctly advances past the length bytes by returning
data[1+bytes_count:], but the short form returned data without
advancing past the length byte. This caused a misalignment in the
parsed mechanism token data, shifting all subsequent field offsets
and producing garbage when unwrapping GSS tokens with inner lengths
below 128 bytes.
Fix: return data[1:] in the short form path, matching the long form
behavior of advancing past the length encoding.
* Added flag functionality to specify that a created registry key should be volatile, and changed the default behavior to instead create non-volatile keys
* Reverted to default behavior and clarified description
- Reverted default behavior back to volatile keys
- Changed --volatile flag to --persistent
- Moved flag verification to subkey creation section
- Added printed warning that key is volatile if --permanent is not set (only in subkey creation)
- Clarified flag description.
* Fixed files not being listed when in INDEX_ROOT
* Added support for sparse files
* Fix double VNC shift, causing incorrect reads.
handle walk() returning None
null checks in do_cat
error handling in getINode
general refactor
* added tests for ntfs-read
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* add wmi ObjectFlags to improve human-readability
* Fix handling of empty buffer in CLASS_AND_METHODS_PART to prevent errors
* implement PutClass and DeleteClass functions in wmi
* bugfix: replace CIM_CLASS with CIM_INSTANCE
* unittest: add test cases for PutClass and DeleteClass
* improved wmi testcases
* Fix PutClass
- Preserve existing class properties (ndTable, valueTable, name ref)
when updating a class via PutClass
- Use correct propIndex (existingCount + i) for DeclarationOrder
and ndTable bit offsets on newly added properties
* uncommented failing case
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Added smbcacls
* Changed example script
* improve ACL manage
* improve acl manage
* improved acl
* Closing all handles
* fixed directory and handle is open bug in acl.py
* Changed help a little bit
* Ignore from empty ACL
* fix indentation
* removee example to different PR
---------
Co-authored-by: john57 <your_email_address@example.com>
adrian manrique