This was a pending change to:
- Use the same tagline, copyright and license notice across files.
- Remove authors' contacts that are no longer valid (due to affiliation changes).
- Update repository location.
- Update license file with missing licenses (althought those were already in source files).
This doesn't include any change on the source code, nor any change on current copyright or licenses. Just formatting and phrasing to make our and distro's maintainers life easier.
Similar to and on top of #1053, this moves the credentials/account parsing regex to an utils module and reduces duplicated code in example scripts.
The expected credential format is:
`<DOMAIN></USERNAME><:PASSWORD>`
Note that the regular expression used in `exchanger.py` was different (excluded ':' from the hostname) but I didn't found any reason to keep it different from all other scripts.
This PR:
- Moved credentials parsing routine to an utils module.
- Added unit tests for the new function.
- Using the new function across example scripts that accept a credential/account.
* Added -usersfile flag to GetUserSPNs.py
* Handling of -usersfile flag in GetNPUsers.py is moved higher to skip unnecessary connections to SMB (BTW, it's weird that the script connects to SMB in Kerberoasting)
Added a column to GetUserSPNs.py that returns delegation information associated with the account. Useful to help identify accounts to target & to expose additional potential attack paths.
In order to maximize the probability of getting session tickets with RC4 etype, we will convert the
password to ntlm hashes (that will force to use RC4 for the TGT). If that doesn't work, we use the
cleartext password.
If no clear text password is provided, we just go with the defaults.
Replaced all instances of `#!/usr/bin/python` with `#!/usr/bin/env python` so impacket's examples and scripts can be run inside a virtualenv without having to call python.
* We're now asking for:
(&(servicePrincipalName=*)(UserAccountControl:1.2.840.113556.1.4.803:=UF_NORMAL_ACCOUNT)(!(UserAccountControl:1.2.840.113556.1.4.803:=UF_ACCOUNTDISABLE)))
Basically will return the normal accounts, not expired, that has an SPN set.
0xdeaddood