* Added a switch not to force RC4-HMAC when requesting a TGT as newer servers (e.g., 2025) won't issue service tickets when provided with RC4-HMAC TGT.
* Update examples/GetUserSPNs.py
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* preserve request-based ticket lifetime and add regression test
* tests: expand coverage for request-based ticket lifetime preservation
* Updated tests to comply with the code review
* Update examples/ticketer.py
* update description of the -duration parameter
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Fixed TS_ALL_PROCESSES_INFO parsing for RpcWinStationGetAllProcesses
* Removed ldap3 dependency, fixed mismatched data type for rawsid, added missing test
* Removed unused imports, renamed imagenamesize -> imagename to match docs. Added missing test
* Modify ticketer and ccache logic
* ticketer now update existing ccache if KRB5CCNAME is specified
* ticketConverter now convert all TGS within the Kirbi or provided Ccache
* Fix a bug during the conversion from ccache to kirbi that does not correctly preserve ticket flags
* Update kirbi test cases. Improve Kirbi to Ccache conversion.
* Fix describe ticket
* fix describeTicket credential indexing after skipped decrypts
Use enumerate() when iterating ccache credentials so output keeps the
correct credential index even when a ticket is skipped due to missing or
invalid decryption material.
Also update the Kerberoast debug message to report the ticket encrypted
part etype, matching the value now used for the extraction decision.
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* raiseChild: fix PAC buffer preservation and add AES support for modern Windows
Two bugs fixed:
1. makeGolden() hardcoded exactly 4 PAC buffers, discarding all others.
Windows Server 2022 with CVE-2021-42287 patches requires PAC_REQUESTOR
(type 18) to be present. Stripping it causes KDC_ERR_TGT_REVOKED.
Fix: preserve all original PAC buffers, only update modified ones.
2. getKerberosTGT() called with aesKey=None hardcoded, ignoring -aesKey.
Fix: pass aesKey, try AES first then fall back to RC4.
Additional improvements:
- Auto-retry golden ticket with AES if RC4 is rejected by KDC
- Fix signature zeroing to use actual length instead of hardcoded 12/16
- Updated help text with AES key usage examples
Tested against Windows Server 2022 Build 20348. Backward compatible.
* krb5: share PAC rebuild and signing helpers
* krb5: share AES ticket key selection helpers
* Fix password fallback suppression and TGT re-acquisition on golden ticket retry
* raiseChild: fix credential retry flow
* raiseChild: pass normalized AES key to target exec login
---------
Co-authored-by: plur1bu5 <plur1bu5@users.noreply.github.com>
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Co-authored-by: Your Name <you@example.com>
* Added remove_sign_seal flag, drop seal flag when remove mic
* moved seal flag removal from sendauth/remove-mic and into sendauth/remove-sign-seal
* Added missing token regeneration after removing seal
* Added flag functionality to specify that a created registry key should be volatile, and changed the default behavior to instead create non-volatile keys
* Reverted to default behavior and clarified description
- Reverted default behavior back to volatile keys
- Changed --volatile flag to --persistent
- Moved flag verification to subkey creation section
- Added printed warning that key is volatile if --permanent is not set (only in subkey creation)
- Clarified flag description.
* Fixed files not being listed when in INDEX_ROOT
* Added support for sparse files
* Fix double VNC shift, causing incorrect reads.
handle walk() returning None
null checks in do_cat
error handling in getINode
general refactor
* added tests for ntfs-read
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* smbserver.py: add signing support by using computer account with NetLogon
* Move kerberos key calculation into impacket.krb5.crypto for portability
* smbserver.py: Support Kerberos
* smbserver.py: NetLogon only works with sealing
* smbserver.py: Adjust fixme
* smbserver.py: Fix raw NTLM authentication
* smbserver.py: Fix signed computer account authentication in NetLogon
* smbserver.py: Add readonly, and options to disable NTLM or Kerberos
smbserver.py: More debugging logs
* fix missing fileName for logging
* fix smbv1 typo
* smbserver.py: Add user to logging, simplify log output
* fix broken log
* fix smbv1 logging
* smbserver.py: Adjust cli option descriptions
* generate_kerberos_keys: change debug message
* smbserver.py: Username logging also for kerberos
* smbserver.py: change defaults for signing
* smbserver.py: Fallback to no signing if ticket decryption fals or client does not support signing
* smbserver.py: provoding computer credentials ONLY authenticates the specified user, netLogon and kerberos are in this case not used
* smbserver.py: return STATUS_LOGON_FAILURE if the Kerberos ticket cannot be decrypted
* smbserver.py: Return correct error message
* smbserver.py: Change -dcip to -dc-ip
* smbserver.py: correct -computeraccountdomain argument description
* smbrelayserver.py: Disable KerberosSupport in smbserver
* smbserver.py: Use getter methods for NTLM/Kerberos support
* Add RDP Server
* fixing a typo
* Remove of an unnecessary log
* Fix RDP relay cookie and duplicate connection issues
* change log type
* refactor: restructure RDP server
* Remove second authentication blocking
* Revert accidental removal of debug print
* Added SAM history parsing to secretsdump.py and secretsdump.py
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update help message for -history argument
Clarified help message for -history argument to specify NTDS and SAM hashes.
* Clarify -history argument help text
Updated help text for the -history argument to clarify that it dumps NTDS and SAM hashes.
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* feat: Added MSSQL Relay Server to NTLMRelayx
* The PRELOGIN response was reified, instead than returning a hardcoded hex message. Several not needed imports were removed. The server name in the LOGIN request was changed to match the target.
* Updated ntlmrelayx.py to the current version, only lines related to MSSQLRelayServer added
* Added response to the client for NTLM authentication (imitate logon failure for unknown reasons)
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Changed the constant in NTLM authentication as requested, and added import struct
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Added login failed response for MSSQL server authentication
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Enhance MSSQL class to accept workstation ID and application name parameters
* Add timeout parameter to MSSQL connect method for improved socket handling
* Update impacket/tds.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/tds.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Defined --host-name and --app-name parameters in the mssqlclient example, leveraging workstation_id and application_name properties added to TDS
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* added RpcShadow2 function and prereqs. Modified tstool to include shadow function
* Resolved requested change: unnecessarily creating a second instance of TSTS.RpcShadow2Response
* add custom cbt_value
* add example script to check LDAP status
* applied code review changes
- make channel_bidinng_value variable public
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Added support for "export" hive format + compute bootkey from class names
* Fixing bug when key does not exist
* Better data extraction to avoid special characters errors
* Fix remote dumping errors
* Fix conflicts
* Reverting changes in examples/secretsdump and impacket/examples/secretsdump. Will be handled in a new PR
* Implemented Registry as an abstract class. Implemented winregistry.get_registry_parser as a factory function to instantiate right parser based in given hive parameter. Refactor registry-read and secretsdump to leverage this factory.
* Enhancing -system description in secretsdump\nClarifying that SYSTEM hive has to be in binary format
* Update the description of the `system` flag
---------
Co-authored-by: gabrielg5 <gabriel.gonzalez@fortra.com>
* Implemented also NTDS.dit download using ShadowSnapshot method via WMI
* Added some debug msgs
* Finished, but error when decrypting. Also with other methods. Found bug?
* Finished, but error when decrypting. Also with other methods. Found bug?
* Adding checks for correct options usage. https://github.com/fortra/impacket/pull/2021#pullrequestreview-3227404992
---------
Co-authored-by: Peter Gabaldon <peter@pgj11.com>
* Adding ID to each client. Logging it when relay succeeds. Showin it in 'socks' command
* Avoid crashing ntlmrelayx when 'socks' command has an invalid filter
* Showing relayed connection information when running attacks in context of relay
* Showing scheme in attacks logging. Fixing table printing in 'socks' command
* Add whitespace to standardize
* Code cleanup. Set 'target' and 'relay_client' as optional parameters in ProtocolAttack (backwards compatibilty)
* Format identity filter
* Adding IPv6 support to SMBServer
* Adding IPv6 support to NTLMRelayX (should update after #2023 - utils.get_address() -)
* Reusing utils.get_address to resolve the address on which each relay server will listen
* Update smbserver.py
Added a comment explaining why repeated code in SMBSERVER constructor
* Setting right address family for relay servers (ipv6)
* Fixing scope_id resolution in SMBSERVER class for IPv6
* Add new relay capabilities from and to WinRM(S)
* Remove winrm client
* Patch the winrmserver to add Negotiate parsing
* Patch the winrmsserver to add Negotiate parsing
* Add allow_reuse
---------
Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com>
* Adding IP address family detection and support for both IPv4/6 to rdp_check example
* Avoid using 'ipaddress' module. Add flag '-6'
* Don't repeat [address] definition
* Creating 'utils.get_socket' and 'utils.get_address' for reusing these common functions. Using them in rdp_check
* Fixed 'utils.get_connected_socket' function name
* Add ability to set the scope_id with interface name - not only by its indes
* Added flag to drop SSP from Net-NTLMv1 auth
* Rebased with the latest version
* Removed whitespaces
* Removed duplicated code caused by merge
---------
Co-authored-by: Davide Ornaghi <ornaghi@intre.it>
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* Added example script samedit.py
* Rebased with latest version
* Replaced instances of "options.hash" with "options.hashes"
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* GetUserSPN's update to test machineonly flag
* Better naming of argument
* Better naming of argument
* Logging of machineOnly code
* Logging of machineOnly code
* ArgParse Description
* ArgParse Description
* ArgParse Description
* ArgParse Description
* Update examples/GetUserSPNs.py
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* Update examples/GetUserSPNs.py
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* Update GetUserSPNs.py
Added `or self.__requestMachine is not None`
* Update GetUserSPNs.py
Restore old formatting
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* added badsuccessor attack changes
* Added explicit error message for SUPERSEDED account in case of KDC_ERR_CLIENT_REVOKED error
* added a link to microsoft docs regarding dmsa set up; fixed a typo
* Added a prerequisite check with a message in case it is not met
* 1. Leveraged logging instead of prints
2. Unified ldaps parameters
3. Renamed PA_DMSA_KEY_PACKAGE to KRB_DMSA_KEY_PACKAGE
4. Refactored ldapConnection to utilize impacket.examples.utils.init_ldap_session
5. Removed "double try" for search_ous replacing with a single one with specified controls value
6. Additional minor fixes
* Adjusted argument handling for -allowed-principals and descriptions for other arguments
* 1. Modified build_security_descriptor function to fix permissions: previously modification of the entry was not impossible with INSUFF_RIGHTS
2. Added modify_dmsa function
3. Cleaned up unused imports
* Minor typo fix: KRB_DMSA_KEY_PACKAGE -> KERB_DMSA_KEY_PACKAGE
* Renamed PA_DMSA_KEY_PACKAGE -> KERB_DMSA_KEY_PACKAGE
* Changed security controls value in search_ous function from 0x15 -> 0x5
---------
Co-authored-by: fulc2um <autouser@localhost>
* Add documentation in the comments for clearer use of NT_CREATE_ANDX flags.
Then sort out some mismatching flags.
* Change default shareAccessMode in the retr file methods to allow read, write and delete.
I found it out when capturing network traffic and seeing I can manage to read files with open handles.
This fixes SHARE_ACCESS_DENIED errors when trying to read files with handles on them.
This is the logical thing to do when we open files for reading.
We do not want to block other processes from interacting with the file.
This may raise problems when reading files that are being written into / being deleted.
I still think this is the right move since we usually want to read the files no matter what.
* Add ability to read files with open handles - this is related to my previous commits.
* Add ability to read files that have open handles to them.
This is related to my older commits on the subject.
* Update smbconnection.py
Add method parameters to `getFile` to easily communicate with the underlying SMB API.
* Fix `shareAccessMode` when opening files for writing.
We obviously do not want to allow others to write to the file while we are writing to it.
* Extend `SMBConnection`'s method parameters for `getFile` and `putFile` methods.
* Add comments for `DesiredAccess`, `ShareAccess` and `CreateDisposition` values in SMBv2.
* Update smb3structs.py
* Fix missing values.
* [SMB] Define CIFS SMB Date and SMB Time according to `2.2.1.4 Time`.
This is done to assist future development of SetInfo operations on files and directories.
```
Date Conversion Example - Year Component:
-----------------------------------------
2009 - 1980 = 29
| (convert to binary)
V
0001 1101
| (position data correctly by shifting)
V
0001 1101
<< 9
---------------------
= 0 0011 1010 0000 0000
| (trim to correct size with bitwise AND of correct mask)
V
0 0011 1010 0000 0000
& 1111 1110 0000 0000
---------------------
= 0011 1010 0000 0000
```
* [SMB] Added CIFS DateTime objects helper methods to convert values to classes.
* [SMB] Feature: added support for set_file_info method using trans2.
By doing so I also fixed a bad structure definition in the SMBSetFileBasicInfo structure.
Now we can modify file information remotely ;)
* [SMBServer] Moved FileTime Conversion methods to the base SMB library.
Also converted the SMB DATETIME methods to use my SMB_DATE and SMB_TIME implementations.
* [SMBConnection] Added type hinting for (almost) all methods.
Also implemented setInfo method to use for setting file information.
* [TEST_SMB] Add tests for new setInfo method.
* [TEST_SMB] This is causing errors so I will wait for now.
* [SMBConnection] add support for default info class type in queryInfo method.
* [SMBConnection] Fix queryInfo to allow retrieval of more
fileInformationClasses other than the default one.
* [attrib] Added attrib example to showcase file attribute modifications using SMB.
for now only implemented query.
* [smbserver] fix missing pack operation in getSMBTime method.
* [attrib] Finished set action, thus finishing the attrib example script.
* [attrib] Final touches, adding output to set action as well.
* [attrib] Add option to set connection timeout.
* [smbclient] Add reconnect command.
* [smb] Fix accidental SMB_TIME creation with removing `+ 1980` to hours.
* [examples] Implement filetime.py
An example script that allows querying and modifying file timestamps using SMB.
* After merge, fix some syntax issues.
* Actually show subparser's descriptions now.
* [SMB] Removed type annotations. Improved comments. Cleaned imports.
* [SMB] Removed type annotations, improved comments.
* [SMB] Comment changes.
* [examples] Add handling of empty action, even though argparse should catch it.
* refactor: Fix PR requests.
* Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend
* Revert "Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend"
This reverts commit 7049ded298.
* defining and running monkeypatch functions from the init of impacket.examples
* leveraging 'init_ldap_session' from addcomputer.py
* leveraging ssl monkeypatch in 'init_ldap_session'
* Added functionality to the SAMHashes Class of the secrestdump.py library to be able to print the user status for SAM dumps. There was already a user-status flag for the NTDS dumps, but not for the SAM dumps. Now, when directly calling secretsdump.py to make a SAM dump, the user can specify the -user-status flag, just like with the NTDS dump. Alternatively, when other tools are using the Secretsdump library, they can simply initiate the SAMHashes class with the printUserStatus flag set to True. The default is False, so if you don't specify anything when calling the Secretsdump Library it will do exactly as it did before. This should not break any existing tools.
* Added some extra checks to make sure the account is no longer marked as "locked" when the lockout duration has passed. In the previous interation, the "locked" mark was only removed after the locked account was used at least once after being unlocked.
---------
Co-authored-by: Mark Bregman <mark.bregman@fox-it.com>
alexisbalbachan