admin/sploutchy-impacket
1
0
Fork 0
mirror of https://github.com/sploutchy/impacket synced 2026-06-08 17:32:01 +00:00
Code Issues Packages Projects Releases Wiki Activity

Forgot to switch to Kerberos (in the right way) when -k is specified

Browse Source 
* Also, when possible, use ncacn_np
This commit is contained in:
asolino
2017-03-21 16:47:35 -03:00
parent f62fc5c394
commit e9ed12e6aa
1 changed files with 17 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files
examples/mimikatz.py
+17 -6
View File
@@ -22,7 +22,7 @@ import sys
from impacket import version
from impacket.dcerpc.v5 import epm, mimilib
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY
from impacket.dcerpc.v5.rpcrt import RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY
from impacket.dcerpc.v5.transport import DCERPCTransportFactory
from impacket.examples import logger
@@ -61,7 +61,9 @@ class MimikatzShell(cmd.Cmd):
self.last_output = None
self.dce = rpcTransport.get_dce_rpc()
self.dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
self.dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY)
if rpcTransport.get_kerberos() is True:
self.dce.set_auth_type(RPC_C_AUTHN_GSS_NEGOTIATE)
self.dce.connect()
self.dce.bind(mimilib.MSRPC_UUID_MIMIKATZ)
@@ -149,8 +151,6 @@ def main():
group.add_argument('-target-ip', action='store', metavar="ip address",
help='IP Address of the target machine. If ommited it will use whatever was specified as target. '
'This is useful when target is the NetBIOS name and you cannot resolve it')
group.add_argument('-port', choices=['139', '445'], nargs='?', default='445', metavar="destination port",
help='Destination port to connect to SMB Server')
if len(sys.argv)==1:
parser.print_help()
@@ -192,12 +192,23 @@ def main():
nthash = ''
try:
stringBinding = epm.hept_map(address, mimilib.MSRPC_UUID_MIMIKATZ, protocol = 'ncacn_ip_tcp')
if username != '':
try:
stringBinding = epm.hept_map(address, mimilib.MSRPC_UUID_MIMIKATZ, protocol = 'ncacn_np')
except Exception, e:
if str(e).find('ept_s_not_registered') >=0:
# Let's try ncacn_ip_tcp
stringBinding = epm.hept_map(address, mimilib.MSRPC_UUID_MIMIKATZ, protocol = 'ncacn_ip_tcp')
else:
raise
else:
stringBinding = epm.hept_map(address, mimilib.MSRPC_UUID_MIMIKATZ, protocol = 'ncacn_ip_tcp')
rpctransport = DCERPCTransportFactory(stringBinding)
if options.k is True:
rpctransport.set_credentials(username, password, domain, lmhash, nthash, options.aesKey)
rpctransport.set_kerberos(options.dc_ip)
rpctransport.set_kerberos(True, options.dc_ip)
else:
rpctransport.set_credentials(username, password, domain, lmhash, nthash)