* preserve request-based ticket lifetime and add regression test
* tests: expand coverage for request-based ticket lifetime preservation
* Updated tests to comply with the code review
* Update examples/ticketer.py
* update description of the -duration parameter
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Modify ticketer and ccache logic
* ticketer now update existing ccache if KRB5CCNAME is specified
* ticketConverter now convert all TGS within the Kirbi or provided Ccache
* Fix a bug during the conversion from ccache to kirbi that does not correctly preserve ticket flags
* Update kirbi test cases. Improve Kirbi to Ccache conversion.
* raiseChild: fix PAC buffer preservation and add AES support for modern Windows
Two bugs fixed:
1. makeGolden() hardcoded exactly 4 PAC buffers, discarding all others.
Windows Server 2022 with CVE-2021-42287 patches requires PAC_REQUESTOR
(type 18) to be present. Stripping it causes KDC_ERR_TGT_REVOKED.
Fix: preserve all original PAC buffers, only update modified ones.
2. getKerberosTGT() called with aesKey=None hardcoded, ignoring -aesKey.
Fix: pass aesKey, try AES first then fall back to RC4.
Additional improvements:
- Auto-retry golden ticket with AES if RC4 is rejected by KDC
- Fix signature zeroing to use actual length instead of hardcoded 12/16
- Updated help text with AES key usage examples
Tested against Windows Server 2022 Build 20348. Backward compatible.
* krb5: share PAC rebuild and signing helpers
* krb5: share AES ticket key selection helpers
* Fix password fallback suppression and TGT re-acquisition on golden ticket retry
* raiseChild: fix credential retry flow
* raiseChild: pass normalized AES key to target exec login
---------
Co-authored-by: plur1bu5 <plur1bu5@users.noreply.github.com>
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Co-authored-by: Your Name <you@example.com>
* Standardized examples logger init method
* Fixing missing import
* Standardized examples init_ldap_session function #1
* Calling new shared function _ldap3_kerberos_login from example addcomputer
* Removed considering -debug in each example. Now it's handled in utils.
* Standardized EMPTY_LM_HASH in impacket.examples.utils
* Unify parse_identity function (phase 1)
* Standardized parse_identity
* Renamed "_ldap3_kerberos_login" to "ldap3_kerberos_login" (as it is called from outside)
* Standardize "logger" init in regsecrets.py
* Standardized LDAP login into a single function in utils.py:ldap_login
* fixed SyntaxWarnings due to invalid escape sequence
* fixed DeprecationWarning since datetime.datetime.utcnow() is deprecated in Python 3.12+
* fixed DeprecationWarning since datetime.datetime.utcfromtimestamp() is deprecated in Python 3.12+
- The default ticket structure contains the new PACs: PAC_ATTRIBUTES_INFO and PAC_REQUESTOR.
- Added option old-pac to forge tickets with the old structure. It will exclude PAC_ATTRIBUTES_INFO and PAC_REQUESTOR.
This was a pending change to:
- Use the same tagline, copyright and license notice across files.
- Remove authors' contacts that are no longer valid (due to affiliation changes).
- Update repository location.
- Update license file with missing licenses (althought those were already in source files).
This doesn't include any change on the source code, nor any change on current copyright or licenses. Just formatting and phrasing to make our and distro's maintainers life easier.
* When encrypting the kdcRep['enc-part']['cipher'] part you have to use the following Key Usages depending on
the type of answer being generated. Per RFC 4120, section 7.5.1:
If it is a AS-REP -> Key Usage 3
If it is a TGS-REP -> Key Usage 8
When silver tickets functionality was implemented [here](https://github.com/CoreSecurity/impacket/pull/354),
this wasn't taken into account that all the answers, regardless of being a AS-REP or TGS-REP were encrypted with Key Usage 3.
You might wonder why RC4 silver tickets where working?
RFC4757 section 3 has the answer. The Key Usages for RC4 are different by the ones defined in RFC4120 and,
for example, for the AS-REP the Key Usage to be used is 8 (instead of 3). Thus, all the RC4 testings were
passing, until @ropnop tested it with AES keys (where the Key Usage numbers to be used are the ones in
RFC 4120), causing the decryption checks when saving the ticket in ccache format to trigger and error
due to invalid checksum.
The issue in https://github.com/CoreSecurity/impacket/issues/443#issuecomment-384430424 should be fixed. Please test.
Replaced all instances of `#!/usr/bin/python` with `#!/usr/bin/env python` so impacket's examples and scripts can be run inside a virtualenv without having to call python.
alexisbalbachan