Use DCOMConnection in test_RemoteGetClassObject instead of a raw
DCE/RPC connection from self.connect(). RemoteGetClassObject returns an
interface whose RemRelease path expects the DCOMConnection PORTMAPS cache
to be initialized for the target; the raw connection path leaves that
cache empty and can raise KeyError keyed by the target address.
Wrap the interface use in a try/finally so the DCOM connection is always
disconnected after the test.
* preserve request-based ticket lifetime and add regression test
* tests: expand coverage for request-based ticket lifetime preservation
* Updated tests to comply with the code review
* Update examples/ticketer.py
* update description of the -duration parameter
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Fixed TS_ALL_PROCESSES_INFO parsing for RpcWinStationGetAllProcesses
* Removed ldap3 dependency, fixed mismatched data type for rawsid, added missing test
* Removed unused imports, renamed imagenamesize -> imagename to match docs. Added missing test
* Modify ticketer and ccache logic
* ticketer now update existing ccache if KRB5CCNAME is specified
* ticketConverter now convert all TGS within the Kirbi or provided Ccache
* Fix a bug during the conversion from ccache to kirbi that does not correctly preserve ticket flags
* Update kirbi test cases. Improve Kirbi to Ccache conversion.
* raiseChild: fix PAC buffer preservation and add AES support for modern Windows
Two bugs fixed:
1. makeGolden() hardcoded exactly 4 PAC buffers, discarding all others.
Windows Server 2022 with CVE-2021-42287 patches requires PAC_REQUESTOR
(type 18) to be present. Stripping it causes KDC_ERR_TGT_REVOKED.
Fix: preserve all original PAC buffers, only update modified ones.
2. getKerberosTGT() called with aesKey=None hardcoded, ignoring -aesKey.
Fix: pass aesKey, try AES first then fall back to RC4.
Additional improvements:
- Auto-retry golden ticket with AES if RC4 is rejected by KDC
- Fix signature zeroing to use actual length instead of hardcoded 12/16
- Updated help text with AES key usage examples
Tested against Windows Server 2022 Build 20348. Backward compatible.
* krb5: share PAC rebuild and signing helpers
* krb5: share AES ticket key selection helpers
* Fix password fallback suppression and TGT re-acquisition on golden ticket retry
* raiseChild: fix credential retry flow
* raiseChild: pass normalized AES key to target exec login
---------
Co-authored-by: plur1bu5 <plur1bu5@users.noreply.github.com>
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
Co-authored-by: Your Name <you@example.com>
* Add support for TDS 8.0 when Force Strict Encryption = Yes
* Match log syntax
* Only use TDS 8.0 if Force Strict Encryption is set to Yes
* Add comments back and fix typos
* Use short timeout, remove excessive debug logs, add comments
* Testing changes to make TDS more broadly applicable by moving to tds.py
* Add TLS 1.2 cap and EPA channel binding for TDS 8.0
* Fix TDS 8.0 DONE parsing and TLS state handling
* Use negotiated TDS version for DONE rowcount parsing
* Align strict TDS login with modern LOGIN7 flow
* Keep relay TLS socket for strict TDS sessions
* Reassemble relay TDS packets over TLS
* tds: stop advertising UTF-8 support
* tds: fix relay login failure token packing
* mssqlrelay: fix PRELOGIN thread id encoding
* tds: preserve default LOGIN7 version in serializer
* tds: only retry strict fallback on connection close
* ntlmrelayx: support strict MSSQL SOCKS reuse
* Reassemble TDS frames on TLS-backed MSSQL reads
---------
Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
* Added fixes and tests for #2092, #2093, and #2094
* do not use interal __iter__ interface for av_pairs tests
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Fixed fragment_by_list() crash when child protocol is None
* removed the inline
* Added a regression test for IP.fragment_by_list() with Data payload
---------
Co-authored-by: herbenderbler <herbenderbler@users.noreply.github.com>
* Fixed files not being listed when in INDEX_ROOT
* Added support for sparse files
* Fix double VNC shift, causing incorrect reads.
handle walk() returning None
null checks in do_cat
error handling in getINode
general refactor
* added tests for ntfs-read
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* add wmi ObjectFlags to improve human-readability
* Fix handling of empty buffer in CLASS_AND_METHODS_PART to prevent errors
* implement PutClass and DeleteClass functions in wmi
* bugfix: replace CIM_CLASS with CIM_INSTANCE
* unittest: add test cases for PutClass and DeleteClass
* improved wmi testcases
* Fix PutClass
- Preserve existing class properties (ndTable, valueTable, name ref)
when updating a class via PutClass
- Use correct propIndex (existingCount + i) for DeclarationOrder
and ndTable bit offsets on newly added properties
* uncommented failing case
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Added smbcacls
* Changed example script
* improve ACL manage
* improve acl manage
* improved acl
* Closing all handles
* fixed directory and handle is open bug in acl.py
* Changed help a little bit
* Ignore from empty ACL
* fix indentation
* removee example to different PR
---------
Co-authored-by: john57 <your_email_address@example.com>
* Fix calcUnpackSize for unicode format 'u' by searching for the real NULL-NULL terminator
Changed documentation about the 'u' format to clarify that it is UTF16-le
* Precompile regex and keep it cached.
* added test for #1992 , #1788
---------
Co-authored-by: Kali <adrian.manrique@gmail.com>
* Add documentation in the comments for clearer use of NT_CREATE_ANDX flags.
Then sort out some mismatching flags.
* Change default shareAccessMode in the retr file methods to allow read, write and delete.
I found it out when capturing network traffic and seeing I can manage to read files with open handles.
This fixes SHARE_ACCESS_DENIED errors when trying to read files with handles on them.
This is the logical thing to do when we open files for reading.
We do not want to block other processes from interacting with the file.
This may raise problems when reading files that are being written into / being deleted.
I still think this is the right move since we usually want to read the files no matter what.
* Add ability to read files with open handles - this is related to my previous commits.
* Add ability to read files that have open handles to them.
This is related to my older commits on the subject.
* Update smbconnection.py
Add method parameters to `getFile` to easily communicate with the underlying SMB API.
* Fix `shareAccessMode` when opening files for writing.
We obviously do not want to allow others to write to the file while we are writing to it.
* Extend `SMBConnection`'s method parameters for `getFile` and `putFile` methods.
* Add comments for `DesiredAccess`, `ShareAccess` and `CreateDisposition` values in SMBv2.
* Update smb3structs.py
* Fix missing values.
* [SMB] Define CIFS SMB Date and SMB Time according to `2.2.1.4 Time`.
This is done to assist future development of SetInfo operations on files and directories.
```
Date Conversion Example - Year Component:
-----------------------------------------
2009 - 1980 = 29
| (convert to binary)
V
0001 1101
| (position data correctly by shifting)
V
0001 1101
<< 9
---------------------
= 0 0011 1010 0000 0000
| (trim to correct size with bitwise AND of correct mask)
V
0 0011 1010 0000 0000
& 1111 1110 0000 0000
---------------------
= 0011 1010 0000 0000
```
* [SMB] Added CIFS DateTime objects helper methods to convert values to classes.
* [SMB] Feature: added support for set_file_info method using trans2.
By doing so I also fixed a bad structure definition in the SMBSetFileBasicInfo structure.
Now we can modify file information remotely ;)
* [SMBServer] Moved FileTime Conversion methods to the base SMB library.
Also converted the SMB DATETIME methods to use my SMB_DATE and SMB_TIME implementations.
* [SMBConnection] Added type hinting for (almost) all methods.
Also implemented setInfo method to use for setting file information.
* [TEST_SMB] Add tests for new setInfo method.
* [TEST_SMB] This is causing errors so I will wait for now.
* [SMBConnection] add support for default info class type in queryInfo method.
* [SMBConnection] Fix queryInfo to allow retrieval of more
fileInformationClasses other than the default one.
* [attrib] Added attrib example to showcase file attribute modifications using SMB.
for now only implemented query.
* [smbserver] fix missing pack operation in getSMBTime method.
* [attrib] Finished set action, thus finishing the attrib example script.
* [attrib] Final touches, adding output to set action as well.
* [attrib] Add option to set connection timeout.
* [smbclient] Add reconnect command.
* [smb] Fix accidental SMB_TIME creation with removing `+ 1980` to hours.
* [examples] Implement filetime.py
An example script that allows querying and modifying file timestamps using SMB.
* After merge, fix some syntax issues.
* Actually show subparser's descriptions now.
* [SMB] Removed type annotations. Improved comments. Cleaned imports.
* [SMB] Removed type annotations, improved comments.
* [SMB] Comment changes.
* [examples] Add handling of empty action, even though argparse should catch it.
* refactor: Fix PR requests.
* bugfix in NBNodeStatusResponse() marshalling
* fix unused parameter 'servport' in NetBIOS constructor
* remove unused parameter 'timeout' in _setup_connection() of NetBIOS class
* unittest: add local test cases for nmb
* Update build_and_test.yml
added python 3.13
removed python 3.8
* workaround delying thread initialization to avoid python3.13 bug
* workaround delaying thread initialization to avoid python3.13 bug
* avoid running Process instances beacuse of a bug in python3.13 https://github.com/python/cpython/issues/134381
* removed hack
* make helper servers run as daemon in order to make testecases not to get stuck
* add EvtRpcRegisterControllableOperation and EvtRpcClearLog to even6 protocol
* add EvtRpcExportLog request to even6
* add tests for even6 EvtRpcClearLog and EvtRpcExportLog requests
* minor changes in even6
* Implemented LDAP channel binding as cleanly as I could, based on https://github.com/ly4k/ldap3.
* Set channel binding to bytes value as requested in the review
* Fix test sessionBaseKey
* Fix test ntResponse
* Fix test encryptedSessionKey
* Fix test ntlmChallengeResponse
* Fix test ntlmChallengeResponse
* Removing leftover print statement
* Remove unnecessary AV_EOL, this is done by impackets struct anyway
---------
Co-authored-by: frank <frank.spierings@warpnet.nl>
- Parsing v3 and v4 ccache files to check #1106 (and not support for v1 and v2)
- Parsing creds from kirbi to check #1254
- Checking #1166 parseFile function
- Updated the Netlogon Authenticator computation.
- Modified the authenticate function. Now, the user's machine connects to the server.
- Marked some tests as Xfail due to the Zerologon patch.
- If a previous test run broke, the services was left on the target and thus create calls will fail. Implemented an open or create helper function to solve that.
Kali