* In those cases where a list of items was parsed, there were some inconsistencies
* Should address https://github.com/CoreSecurity/impacket/issues/304
* Further testing is needed to be sure we're not breaking anything else.
- There a base class called SocksRelay that should be used as base class for SOCKS protocol plugins
- Any new plugin should be added to the impacket/examples/ntlmrelayx/servers/socksplugins directory
- These plugins will be automatically loaded when the SOCKS proxy is loaded.
- The idea is to add SockRelay plugins for any protocol we want (e.g. MSSQL, LDAP, HTTP, etc)
- Lots of testing needed.
* Use -socks switch when running smbrelayx.py
* SOCKS4 and SOCKS5 should work
* Bypass logoff attempts and sends keep alive packets to keep connections open
* Lots of things to improve, mainly dynamic subscriptions of port handlers so we
can add protocol handlers easier (e.g. MSSQL, HTTP, etc)
* Testing needed. Porting to ntlmrelayx.py soon.
* In those versions, the first byte is stripped, hence we're sending a '/' extra at the beginning of the buffer
* Doesn't seem to affect 4.x versions
* Also, have in mind that in 3.5.x you need to create a .so exporting init_samba_module(), whereas in 4.x it is samba_init_module()
* Allows to chose different exec methods when -use-vss mode is chosen:
1. smbexec (default): Creates a service executing the desired commands
2. wmiexec: Executes commands through Win32Process.Create() API
3. mmcexec: Executes commands through DCOM MMC object (Kerberos not supported here)
This script will exploit CVE-2017-7494, uploading and executing the shared library specified by the user through
the -so parameter.
The script will use SMB1 or SMB2/3 depending on the target's availability. Also, the target share pathname is
retrieved by using NetrShareEnum() API with info level 2.
Example:
./sambaPipe.py -so poc/libpoc.linux64.so bill@10.90.1.1
It will upload the libpoc.linux64.so file located in the poc directory against the target 10.90.1.1. The username
to use for authentication will be 'bill' and the password will be asked.
./sambaPipe.py -so poc/libpoc.linux64.so 10.90.1.1
Same as before, but anonymous authentication will be used.
This script will connect against a target (or list of targets) machine/s and gather the OS architecture type
installed.
The trick has been discovered many years ago and is actually documented by Microsoft here:
https://msdn.microsoft.com/en-us/library/cc243948.aspx#Appendix_A_53
and doesn't require any authentication at all.
Have in mind this trick will *not* work if the target system is running Samba. Don't know what happens with macOS.
* Sets encoding used (codec) from the target's output (default "ascii").
If errors are detected, run chcp.com at the target, map the result with
https://docs.python.org/2.4/lib/standard-encodings.html and then execute
wmiexec.py again with -codec and the corresponding codec.
Especially useful when running this script against non-english systems.
This script will get the PAC of the specified target user just having a normal authenticated user credentials.
It does so by using a mix of [MS-SFU]'s S4USelf + User to User Kerberos Authentication.
Original idea (or accidental discovery :) ) of adding U2U capabilities inside a S4USelf by Benjamin Delphi (@gentilkiwi)
References:
U2U: https://tools.ietf.org/html/draft-ietf-cat-user2user-02
[MS-SFU]: https://msdn.microsoft.com/en-us/library/cc246071.aspx
asolino