* ntlmrelayx: showing client ip when relay successful. standardized relay server prefixes (protocol). showin an incremental id for session relayed.
* reverting 'client_id' additions as are not important/valid in the context of this pr
* Added example script samedit.py
* Rebased with latest version
* Replaced instances of "options.hash" with "options.hashes"
---------
Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
* Add documentation in the comments for clearer use of NT_CREATE_ANDX flags.
Then sort out some mismatching flags.
* Change default shareAccessMode in the retr file methods to allow read, write and delete.
I found it out when capturing network traffic and seeing I can manage to read files with open handles.
This fixes SHARE_ACCESS_DENIED errors when trying to read files with handles on them.
This is the logical thing to do when we open files for reading.
We do not want to block other processes from interacting with the file.
This may raise problems when reading files that are being written into / being deleted.
I still think this is the right move since we usually want to read the files no matter what.
* Add ability to read files with open handles - this is related to my previous commits.
* Add ability to read files that have open handles to them.
This is related to my older commits on the subject.
* Update smbconnection.py
Add method parameters to `getFile` to easily communicate with the underlying SMB API.
* Fix `shareAccessMode` when opening files for writing.
We obviously do not want to allow others to write to the file while we are writing to it.
* Extend `SMBConnection`'s method parameters for `getFile` and `putFile` methods.
* Add comments for `DesiredAccess`, `ShareAccess` and `CreateDisposition` values in SMBv2.
* Update smb3structs.py
* Fix missing values.
* [SMB] Define CIFS SMB Date and SMB Time according to `2.2.1.4 Time`.
This is done to assist future development of SetInfo operations on files and directories.
```
Date Conversion Example - Year Component:
-----------------------------------------
2009 - 1980 = 29
| (convert to binary)
V
0001 1101
| (position data correctly by shifting)
V
0001 1101
<< 9
---------------------
= 0 0011 1010 0000 0000
| (trim to correct size with bitwise AND of correct mask)
V
0 0011 1010 0000 0000
& 1111 1110 0000 0000
---------------------
= 0011 1010 0000 0000
```
* [SMB] Added CIFS DateTime objects helper methods to convert values to classes.
* [SMB] Feature: added support for set_file_info method using trans2.
By doing so I also fixed a bad structure definition in the SMBSetFileBasicInfo structure.
Now we can modify file information remotely ;)
* [SMBServer] Moved FileTime Conversion methods to the base SMB library.
Also converted the SMB DATETIME methods to use my SMB_DATE and SMB_TIME implementations.
* [SMBConnection] Added type hinting for (almost) all methods.
Also implemented setInfo method to use for setting file information.
* [TEST_SMB] Add tests for new setInfo method.
* [TEST_SMB] This is causing errors so I will wait for now.
* [SMBConnection] add support for default info class type in queryInfo method.
* [SMBConnection] Fix queryInfo to allow retrieval of more
fileInformationClasses other than the default one.
* [attrib] Added attrib example to showcase file attribute modifications using SMB.
for now only implemented query.
* [smbserver] fix missing pack operation in getSMBTime method.
* [attrib] Finished set action, thus finishing the attrib example script.
* [attrib] Final touches, adding output to set action as well.
* [attrib] Add option to set connection timeout.
* [smbclient] Add reconnect command.
* [smb] Fix accidental SMB_TIME creation with removing `+ 1980` to hours.
* [examples] Implement filetime.py
An example script that allows querying and modifying file timestamps using SMB.
* After merge, fix some syntax issues.
* Actually show subparser's descriptions now.
* [SMB] Removed type annotations. Improved comments. Cleaned imports.
* [SMB] Removed type annotations, improved comments.
* [SMB] Comment changes.
* [examples] Add handling of empty action, even though argparse should catch it.
* refactor: Fix PR requests.
* Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend
* Revert "Added monkeypatches.py; contains a couple of functions to modify for specific usecases/issues: monkeypatch_ssl_create_default_context and monkeypatch_readline_backend"
This reverts commit 7049ded298.
* defining and running monkeypatch functions from the init of impacket.examples
* leveraging 'init_ldap_session' from addcomputer.py
* leveraging ssl monkeypatch in 'init_ldap_session'
* Fix mssql connection establishment
* Fix mssql connection establishment in mssqlrelayclient.py as well
* Apply suggestions from code review
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* [MSSQL] Improves version display
* [MSSQL] Patch file exists if language is not english
* Add impacket.mssql to setup.py
* Pass on KeyError exception
---------
Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com>
* Added functionality to the SAMHashes Class of the secrestdump.py library to be able to print the user status for SAM dumps. There was already a user-status flag for the NTDS dumps, but not for the SAM dumps. Now, when directly calling secretsdump.py to make a SAM dump, the user can specify the -user-status flag, just like with the NTDS dump. Alternatively, when other tools are using the Secretsdump library, they can simply initiate the SAMHashes class with the printUserStatus flag set to True. The default is False, so if you don't specify anything when calling the Secretsdump Library it will do exactly as it did before. This should not break any existing tools.
* Added some extra checks to make sure the account is no longer marked as "locked" when the lockout duration has passed. In the previous interation, the "locked" mark was only removed after the locked account was used at least once after being unlocked.
---------
Co-authored-by: Mark Bregman <mark.bregman@fox-it.com>
* Update mssqlrelay.py as in tds.py
* Manual fix for tds.py after dropping bad commit
* Reverted minor changes doublequote by singlequote for the sake of clarity in the review
* Reverted minor changes doublequote by singlequote for the sake of clarity in the review
* Reverted minor changes doublequote by singlequote for the sake of clarity in the review
* [TEST Commit] Adding debug log lines in tds.py to validate a scenario
* Fix issue receiving long messages from server. Reverted last [TEST Commit]
---------
Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com>
Co-authored-by: gabrielg5 <gabriel.gonzalez@fortra.com>
* SMBRelayServer: Fixing target processing when reaching end of target list; reload targets and then gather a new target to try to relay to
* HTTPRelayServer: Fixing target processing when reaching end of target list; reload targets and then gather a new target to try to relay to
* Added Support for LDAPS When Using Windows Server 2025
* set ldaps_flag as optional in ldap_login()
---------
Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* Added 'query' to the HTTP(s)RelayClient class and condition for sendNegotiate and sendAuth
* remove tab
* added conition (if query) for registerTarget
* forgot line 82
* Added condition for target.scheme contain http
* Fixing ldap login logic - affecting findDelegation and GetUserSPNs
* Fixing ldap login logic - considering those examples that do not have "target_domain" parameter.
* Fixing SMBConnection initialization in _get_machine_name
* Standardized examples logger init method
* Fixing missing import
* Standardized examples init_ldap_session function #1
* Calling new shared function _ldap3_kerberos_login from example addcomputer
* Removed considering -debug in each example. Now it's handled in utils.
* Standardized EMPTY_LM_HASH in impacket.examples.utils
* Unify parse_identity function (phase 1)
* Standardized parse_identity
* Renamed "_ldap3_kerberos_login" to "ldap3_kerberos_login" (as it is called from outside)
* Standardize "logger" init in regsecrets.py
* Standardized LDAP login into a single function in utils.py:ldap_login
* Update socksserver.py
Fixes https://github.com/fortra/impacket/issues/1575 by parsing the target hostname correctly from commands run through ntlmrelayx's socks5 proxy.
* Update socksserver.py
Fix hostname parsing
* Add support for LDAP and LDAPS in ntlmrelayx SOCKS
Should fix#514
* Use real NTLM Challenge message during LDAP socks relay
* Reply to generic LDAP messages that comes before authentication and drop unbind LDAP messages
* Fix missing imports
* LDAP socks code cleaning
* Better handling of initial LDAP bind request in ntlmrelayx LDAP socks
* Better handling of clients' closing connections in ntlmrelayx LDAP socks
* Adding SCCM Policies attack and SCCM Distribution Point attack
* Fixing typo in error log message
* Handle packages one at a time for DP attack ; uniformise coding style ; update requirements.txt
* fixed SyntaxWarnings due to invalid escape sequence
* fixed DeprecationWarning since datetime.datetime.utcnow() is deprecated in Python 3.12+
* fixed DeprecationWarning since datetime.datetime.utcfromtimestamp() is deprecated in Python 3.12+
* [ntlmrelayx] Dump ADCS: fix case when ACE has neither "ObjectType" nor "InheritedObjectType"
* [ntlmrelayx] Dump ADCS: fix issue when SID cannot be translated
* Printing a message when a WebDav request was received in HTTPRelayServer at NTLMRelayX (PROPFIND method)
* Opportunistic enhancement: showing listening ports for SMBRelayServer and WCFRelayServer
* Setting "log_file" property to "None" for smbserver configuration file ~ will print to console
* Setting "log_file" property to "None" for smbrelayx.py
* Starting remote 'Shadow Snapshot Method'
* Continue :)
* Added options
* Logic error hehe :)
* Ups :S
* Remote Shadow Snapshot Working. Path calculated well. Need to fix download
* Download not working. SMB access is protected. Run copy command remotely? Too much noise I think :S
* Could not find a way to copy using WMI using GLOBALROOT path. Failing back to RCE; noisy :(
* Working
* Working
* Working
* Added debug log
* Working without RCE, download from ShadowCopy using SMB
* Removed commented code and unused methods
* Delete ShadowCopy after downlodaing SAM/SYSTEM/SECURITY
---------
Co-authored-by: Pedro Gabaldon <peter@pgj11.com>
* * Record failed targets
* [MULTIRELAY][Default Behavior] The relay will cycle over its target list only once, this matches the behavior of the single relay mode
* [MULTIRELAY] Added a flag to cycle over the target list any time a new connection is established, essentially relaying against each target in the list for every incoming connection
* [MULTIRELAY] HTTP server will stop consuming targets after the first failed attempt, this matches the behavior of SMB server
* Fixed issue in HTTP server when an unhandled exception occurs while trying to establish a connection with the target. Now it is recorded as a failed attempt.
* * When a connection attempt fails (such as connection refused) the target is now (internally) marked as "failed"
* Bugfix: initclient-> unhandled return status of client.initconnection, now properly raises an exception when that call fails
* Bugfix: enable-retries now works with smbserver
* [REFACTOR] Renamed logTarget -> registerTarget
* Modified flag help text
* * Record failed targets
* [MULTIRELAY][Default Behavior] The relay will cycle over its target list only once, this matches the behavior of the single relay mode
* [MULTIRELAY] Added a flag to cycle over the target list any time a new connection is established, essentially relaying against each target in the list for every incoming connection
* [MULTIRELAY] HTTP server will stop consuming targets after the first failed attempt, this matches the behavior of SMB server
* Fixed issue in HTTP server when an unhandled exception occurs while trying to establish a connection with the target. Now it is recorded as a failed attempt.
* * When a connection attempt fails (such as connection refused) the target is now (internally) marked as "failed"
* Bugfix: initclient-> unhandled return status of client.initconnection, now properly raises an exception when that call fails
* Bugfix: enable-retries now works with smbserver
* [REFACTOR] Renamed logTarget -> registerTarget
* Modified flag help text
* * Renamed enable-retries flag to keep-relaying
* Set default value of keep-relaying flag to False
adrian manrique