* added badsuccessor attack changes
* Added explicit error message for SUPERSEDED account in case of KDC_ERR_CLIENT_REVOKED error
* added a link to microsoft docs regarding dmsa set up; fixed a typo
* Added a prerequisite check with a message in case it is not met
* 1. Leveraged logging instead of prints
2. Unified ldaps parameters
3. Renamed PA_DMSA_KEY_PACKAGE to KRB_DMSA_KEY_PACKAGE
4. Refactored ldapConnection to utilize impacket.examples.utils.init_ldap_session
5. Removed "double try" for search_ous replacing with a single one with specified controls value
6. Additional minor fixes
* Adjusted argument handling for -allowed-principals and descriptions for other arguments
* 1. Modified build_security_descriptor function to fix permissions: previously modification of the entry was not impossible with INSUFF_RIGHTS
2. Added modify_dmsa function
3. Cleaned up unused imports
* Minor typo fix: KRB_DMSA_KEY_PACKAGE -> KERB_DMSA_KEY_PACKAGE
* Renamed PA_DMSA_KEY_PACKAGE -> KERB_DMSA_KEY_PACKAGE
* Changed security controls value in search_ous function from 0x15 -> 0x5
---------
Co-authored-by: fulc2um <autouser@localhost>
* Standardized examples logger init method
* Fixing missing import
* Standardized examples init_ldap_session function #1
* Calling new shared function _ldap3_kerberos_login from example addcomputer
* Removed considering -debug in each example. Now it's handled in utils.
* Standardized EMPTY_LM_HASH in impacket.examples.utils
* Unify parse_identity function (phase 1)
* Standardized parse_identity
* Renamed "_ldap3_kerberos_login" to "ldap3_kerberos_login" (as it is called from outside)
* Standardize "logger" init in regsecrets.py
* Standardized LDAP login into a single function in utils.py:ldap_login
* fixed SyntaxWarnings due to invalid escape sequence
* fixed DeprecationWarning since datetime.datetime.utcnow() is deprecated in Python 3.12+
* fixed DeprecationWarning since datetime.datetime.utcfromtimestamp() is deprecated in Python 3.12+
This was a pending change to:
- Use the same tagline, copyright and license notice across files.
- Remove authors' contacts that are no longer valid (due to affiliation changes).
- Update repository location.
- Update license file with missing licenses (althought those were already in source files).
This doesn't include any change on the source code, nor any change on current copyright or licenses. Just formatting and phrasing to make our and distro's maintainers life easier.
Similar to and on top of #1053, this moves the credentials/account parsing regex to an utils module and reduces duplicated code in example scripts.
The expected credential format is:
`<DOMAIN></USERNAME><:PASSWORD>`
Note that the regular expression used in `exchanger.py` was different (excluded ':' from the hostname) but I didn't found any reason to keep it different from all other scripts.
This PR:
- Moved credentials parsing routine to an utils module.
- Added unit tests for the new function.
- Using the new function across example scripts that accept a credential/account.
Given a password, hash, aesKey or TGT in ccache, it will request a Service Ticket
and save it as ccache.
If the account has constrained delegation (with protocol transition) privileges
you will be able to use the -impersonate switch to request the ticket on behalf
other user (it will use S4U2Self/S4U2Proxy to request the ticket.)
Similar feature has been implemented already by Benjamin Delphi (@gentilkiwi) in Kekeo (s4u)
Examples:
./getST.py -hashes lm:nt -spn cifs/contoso-dc contoso.com/user
It will save the ticket in user.ccache
or
If you have tickets cached (run klist to verify) the script will use them
./getST.py -k -spn cifs/contoso-dc contoso.com/user
Be sure tho, that the cached TGT has the forwardable flag set (klist -f).
getTGT.py will ask forwardable tickets by default.
Also, if the account is configured with unconstrained delegation (and with protocol transition)
you can request service tickets for other users, assuming the target SPN is allowed for
delegation:
./getST.py -k -impersonate Administrator -spn cifs/contoso-dc contoso.com/user
The output of this script will be a service ticket for the Administrator user.
Once you have the ccache file, set it in the KRB5CCNAME variable and use it for fun and profit.
fulc2um