* Add rget command for recursive file download
* rget no longer swallows listing or download failures. It now restores self.pwd with try/finally and lets real exceptions propagate, so partial recursive downloads don’t fail silently.
The local path calculation now uses ntpath.relpath() from the starting remote directory instead of raw string replacement, which preserves nested paths like subdir/dir_backup/...
correctly.
---------
Co-authored-by: TheFlamingCrab <96930137+TheFlamingCrab@users.noreply.github.com>
Co-authored-by: Kali <adrian.manrique@gmail.com>
* fix(smbrelayserver): guard missing SMBClient and handle NTLM negotiate failures
* fix(winrmrelayclient): handle connection errors and detect NTLMv2 to abort futile relay
* fix(winrmrelayclient): update logging message
* Enhancing a bit the NTLMv2 detection - and clean up logging
* Clean up log
* Fixing wrong var name
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Add support for TDS 8.0 when Force Strict Encryption = Yes
* Match log syntax
* Only use TDS 8.0 if Force Strict Encryption is set to Yes
* Add comments back and fix typos
* Use short timeout, remove excessive debug logs, add comments
* Testing changes to make TDS more broadly applicable by moving to tds.py
* Add TLS 1.2 cap and EPA channel binding for TDS 8.0
* Fix TDS 8.0 DONE parsing and TLS state handling
* Use negotiated TDS version for DONE rowcount parsing
* Align strict TDS login with modern LOGIN7 flow
* Keep relay TLS socket for strict TDS sessions
* Reassemble relay TDS packets over TLS
* tds: stop advertising UTF-8 support
* tds: fix relay login failure token packing
* mssqlrelay: fix PRELOGIN thread id encoding
* tds: preserve default LOGIN7 version in serializer
* tds: only retry strict fallback on connection close
* ntlmrelayx: support strict MSSQL SOCKS reuse
* Reassemble TDS frames on TLS-backed MSSQL reads
---------
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Add shell commands to enable and disable the 'rpc out' option for
linked SQL servers via sp_serveroption. This allows executing stored
procedures remotely on linked servers directly from the SQL shell.
* Added remove_sign_seal flag, drop seal flag when remove mic
* moved seal flag removal from sendauth/remove-mic and into sendauth/remove-sign-seal
* Added missing token regeneration after removing seal
When running secretsdump.py in offline mode (with -sam/-security/-system flags),
the $MACHINE.ACC secret was dumped as raw hex instead of showing the machine
account NTLM hash and Kerberos keys. This was because the machine name, domain,
and Kerberos salt were only retrieved via remoteOps (available in online mode).
Add __getMachineKerberosSaltOffline() to derive the Kerberos salt from the
SECURITY hive by reading Policy\PolDnDDN (domain FQDN) and Policy\PolAcDmN
(machine NetBIOS name), which are stored as LSA_UNICODE_STRING structures.
Use the same salt to resolve the machine name and domain for the NTLM hash
printout. This brings offline mode output to parity with online mode.
Co-authored-by: Croumi <Croumi>
* Added smbcacls
* Changed example script
* improve ACL manage
* improve acl manage
* improved acl
* Closing all handles
* fixed directory and handle is open bug in acl.py
* Changed help a little bit
* Ignore from empty ACL
* fix indentation
* removee example to different PR
---------
Co-authored-by: john57 <your_email_address@example.com>
If an SMB packet is incoming and wants to negotiate and smb2support is
enabled, before this would throw an exception while trying to parse the
SMB packet as an SMB2 packet:
```
Traceback (most recent call last):
File
"/Users/roman/.local/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/smbserver.py",
line 4191, in handle
resp = self.__SMB.processRequest(self.__connId, p.get_trailer())
File
"/Users/roman/.local/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/smbserver.py",
line 4865, in processRequest
respPacket['CreditRequestResponse'] =
packet['CreditRequestResponse']
~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^
File
"/Users/roman/.local/pipx/venvs/impacket/lib/python3.13/site-packages/impacket/structure.py",
line 186, in __getitem__
return self.fields[key]
~~~~~~~~~~~^^^^^
KeyError: 'CreditRequestResponse'
```
By sending the SMB2 packet response directly instead of the command,
this should now work properly.
* Add RDP Server
* fixing a typo
* Remove of an unnecessary log
* Fix RDP relay cookie and duplicate connection issues
* change log type
* refactor: restructure RDP server
* Remove second authentication blocking
* Revert accidental removal of debug print
* Added SAM history parsing to secretsdump.py and secretsdump.py
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/secretsdump.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/regsecrets.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update help message for -history argument
Clarified help message for -history argument to specify NTDS and SAM hashes.
* Clarify -history argument help text
Updated help text for the -history argument to clarify that it dumps NTDS and SAM hashes.
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* feat: Added MSSQL Relay Server to NTLMRelayx
* The PRELOGIN response was reified, instead than returning a hardcoded hex message. Several not needed imports were removed. The server name in the LOGIN request was changed to match the target.
* Updated ntlmrelayx.py to the current version, only lines related to MSSQLRelayServer added
* Added response to the client for NTLM authentication (imitate logon failure for unknown reasons)
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Changed the constant in NTLM authentication as requested, and added import struct
* Update impacket/examples/ntlmrelayx/servers/mssqlrelayserver.py
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Added login failed response for MSSQL server authentication
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Checking CommonName before setting in the CSR. Enhancing certificate name when username is empty
* Adding fallback to certificate name
* Fixing ICPRRPCAttack #2042
* Aligning ICPRRPCAttack with ADCSAttack
* Update rpcattack.py
* Added support for "export" hive format + compute bootkey from class names
* Fixing bug when key does not exist
* Better data extraction to avoid special characters errors
* Fix remote dumping errors
* Fix conflicts
* Reverting changes in examples/secretsdump and impacket/examples/secretsdump. Will be handled in a new PR
* Implemented Registry as an abstract class. Implemented winregistry.get_registry_parser as a factory function to instantiate right parser based in given hive parameter. Refactor registry-read and secretsdump to leverage this factory.
* Enhancing -system description in secretsdump\nClarifying that SYSTEM hive has to be in binary format
* Update the description of the `system` flag
---------
Co-authored-by: gabrielg5 <gabriel.gonzalez@fortra.com>
* reverted shareAccessMode default value in getFile implemntation
* added getFileEx method to smbconnection in order to be used to retrieved remote locked files
* Implemented also NTDS.dit download using ShadowSnapshot method via WMI
* Added some debug msgs
* Finished, but error when decrypting. Also with other methods. Found bug?
* Finished, but error when decrypting. Also with other methods. Found bug?
* Adding checks for correct options usage. https://github.com/fortra/impacket/pull/2021#pullrequestreview-3227404992
---------
Co-authored-by: Peter Gabaldon <peter@pgj11.com>
* Adding ID to each client. Logging it when relay succeeds. Showin it in 'socks' command
* Avoid crashing ntlmrelayx when 'socks' command has an invalid filter
* Showing relayed connection information when running attacks in context of relay
* Showing scheme in attacks logging. Fixing table printing in 'socks' command
* Add whitespace to standardize
* Code cleanup. Set 'target' and 'relay_client' as optional parameters in ProtocolAttack (backwards compatibilty)
* Format identity filter
* Adding IPv6 support to SMBServer
* Adding IPv6 support to NTLMRelayX (should update after #2023 - utils.get_address() -)
* Reusing utils.get_address to resolve the address on which each relay server will listen
* Update smbserver.py
Added a comment explaining why repeated code in SMBSERVER constructor
* Setting right address family for relay servers (ipv6)
* Fixing scope_id resolution in SMBSERVER class for IPv6
* use cryptography to generate pkcs12 certificate
* fixes
* removed pyopenssl version restriction
* handle asn1 certificate type as well
* updated PyOpenSSL version in setup.py. fixed typo in adcsattack
* Remove usage of `pkg_resources`
Currently, a warning is emitted on each run:
UserWarning: pkg_resources is deprecated as an API. See
https://setuptools.pypa.io/en/latest/pkg_resources.html. The
pkg_resources package is slated for removal as early as 2025-11-30.
Refrain from using this package or pin to Setuptools<81.
This patch removes all usage of that package.
Fixes#1645.
* Add necessary dependencies to setup.py and requirements.txt
* Remove fallback to `importlib_resources`
* Add new relay capabilities from and to WinRM(S)
* Remove winrm client
* Patch the winrmserver to add Negotiate parsing
* Patch the winrmsserver to add Negotiate parsing
* Add allow_reuse
---------
Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com>
* Adding IP address family detection and support for both IPv4/6 to rdp_check example
* Avoid using 'ipaddress' module. Add flag '-6'
* Don't repeat [address] definition
* Creating 'utils.get_socket' and 'utils.get_address' for reusing these common functions. Using them in rdp_check
* Fixed 'utils.get_connected_socket' function name
* Add ability to set the scope_id with interface name - not only by its indes
* ntlmrelayx: showing client ip when relay successful. standardized relay server prefixes (protocol). showin an incremental id for session relayed.
* reverting 'client_id' additions as are not important/valid in the context of this pr
* Added example script samedit.py
* Rebased with latest version
* Replaced instances of "options.hash" with "options.hashes"
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* Add documentation in the comments for clearer use of NT_CREATE_ANDX flags.
Then sort out some mismatching flags.
* Change default shareAccessMode in the retr file methods to allow read, write and delete.
I found it out when capturing network traffic and seeing I can manage to read files with open handles.
This fixes SHARE_ACCESS_DENIED errors when trying to read files with handles on them.
This is the logical thing to do when we open files for reading.
We do not want to block other processes from interacting with the file.
This may raise problems when reading files that are being written into / being deleted.
I still think this is the right move since we usually want to read the files no matter what.
* Add ability to read files with open handles - this is related to my previous commits.
* Add ability to read files that have open handles to them.
This is related to my older commits on the subject.
* Update smbconnection.py
Add method parameters to `getFile` to easily communicate with the underlying SMB API.
* Fix `shareAccessMode` when opening files for writing.
We obviously do not want to allow others to write to the file while we are writing to it.
* Extend `SMBConnection`'s method parameters for `getFile` and `putFile` methods.
* Add comments for `DesiredAccess`, `ShareAccess` and `CreateDisposition` values in SMBv2.
* Update smb3structs.py
* Fix missing values.
* [SMB] Define CIFS SMB Date and SMB Time according to `2.2.1.4 Time`.
This is done to assist future development of SetInfo operations on files and directories.
```
Date Conversion Example - Year Component:
-----------------------------------------
2009 - 1980 = 29
| (convert to binary)
V
0001 1101
| (position data correctly by shifting)
V
0001 1101
<< 9
---------------------
= 0 0011 1010 0000 0000
| (trim to correct size with bitwise AND of correct mask)
V
0 0011 1010 0000 0000
& 1111 1110 0000 0000
---------------------
= 0011 1010 0000 0000
```
* [SMB] Added CIFS DateTime objects helper methods to convert values to classes.
* [SMB] Feature: added support for set_file_info method using trans2.
By doing so I also fixed a bad structure definition in the SMBSetFileBasicInfo structure.
Now we can modify file information remotely ;)
* [SMBServer] Moved FileTime Conversion methods to the base SMB library.
Also converted the SMB DATETIME methods to use my SMB_DATE and SMB_TIME implementations.
* [SMBConnection] Added type hinting for (almost) all methods.
Also implemented setInfo method to use for setting file information.
* [TEST_SMB] Add tests for new setInfo method.
* [TEST_SMB] This is causing errors so I will wait for now.
* [SMBConnection] add support for default info class type in queryInfo method.
* [SMBConnection] Fix queryInfo to allow retrieval of more
fileInformationClasses other than the default one.
* [attrib] Added attrib example to showcase file attribute modifications using SMB.
for now only implemented query.
* [smbserver] fix missing pack operation in getSMBTime method.
* [attrib] Finished set action, thus finishing the attrib example script.
* [attrib] Final touches, adding output to set action as well.
* [attrib] Add option to set connection timeout.
* [smbclient] Add reconnect command.
* [smb] Fix accidental SMB_TIME creation with removing `+ 1980` to hours.
* [examples] Implement filetime.py
An example script that allows querying and modifying file timestamps using SMB.
* After merge, fix some syntax issues.
* Actually show subparser's descriptions now.
* [SMB] Removed type annotations. Improved comments. Cleaned imports.
* [SMB] Removed type annotations, improved comments.
* [SMB] Comment changes.
* [examples] Add handling of empty action, even though argparse should catch it.
* refactor: Fix PR requests.
* Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend
* Revert "Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend"
This reverts commit 7049ded298.
* defining and running monkeypatch functions from the init of impacket.examples
* leveraging 'init_ldap_session' from addcomputer.py
* leveraging ssl monkeypatch in 'init_ldap_session'
* Fix mssql connection establishment
* Fix mssql connection establishment in mssqlrelayclient.py as well
* Apply suggestions from code review
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* [MSSQL] Improves version display
* [MSSQL] Patch file exists if language is not english
* Add impacket.mssql to setup.py
* Pass on KeyError exception
---------
Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com>
alexisbalbachan