* In those cases where a list of items was parsed, there were some inconsistencies
* Should address https://github.com/CoreSecurity/impacket/issues/304
* Further testing is needed to be sure we're not breaking anything else.
* Use -socks switch when running smbrelayx.py
* SOCKS4 and SOCKS5 should work
* Bypass logoff attempts and sends keep alive packets to keep connections open
* Lots of things to improve, mainly dynamic subscriptions of port handlers so we
can add protocol handlers easier (e.g. MSSQL, HTTP, etc)
* Testing needed. Porting to ntlmrelayx.py soon.
* In those versions, the first byte is stripped, hence we're sending a '/' extra at the beginning of the buffer
* Doesn't seem to affect 4.x versions
* Also, have in mind that in 3.5.x you need to create a .so exporting init_samba_module(), whereas in 4.x it is samba_init_module()
* Allows to chose different exec methods when -use-vss mode is chosen:
1. smbexec (default): Creates a service executing the desired commands
2. wmiexec: Executes commands through Win32Process.Create() API
3. mmcexec: Executes commands through DCOM MMC object (Kerberos not supported here)
This script will exploit CVE-2017-7494, uploading and executing the shared library specified by the user through
the -so parameter.
The script will use SMB1 or SMB2/3 depending on the target's availability. Also, the target share pathname is
retrieved by using NetrShareEnum() API with info level 2.
Example:
./sambaPipe.py -so poc/libpoc.linux64.so bill@10.90.1.1
It will upload the libpoc.linux64.so file located in the poc directory against the target 10.90.1.1. The username
to use for authentication will be 'bill' and the password will be asked.
./sambaPipe.py -so poc/libpoc.linux64.so 10.90.1.1
Same as before, but anonymous authentication will be used.
This script will connect against a target (or list of targets) machine/s and gather the OS architecture type
installed.
The trick has been discovered many years ago and is actually documented by Microsoft here:
https://msdn.microsoft.com/en-us/library/cc243948.aspx#Appendix_A_53
and doesn't require any authentication at all.
Have in mind this trick will *not* work if the target system is running Samba. Don't know what happens with macOS.
* Sets encoding used (codec) from the target's output (default "ascii").
If errors are detected, run chcp.com at the target, map the result with
https://docs.python.org/2.4/lib/standard-encodings.html and then execute
wmiexec.py again with -codec and the corresponding codec.
Especially useful when running this script against non-english systems.
This script will get the PAC of the specified target user just having a normal authenticated user credentials.
It does so by using a mix of [MS-SFU]'s S4USelf + User to User Kerberos Authentication.
Original idea (or accidental discovery :) ) of adding U2U capabilities inside a S4USelf by Benjamin Delphi (@gentilkiwi)
References:
U2U: https://tools.ietf.org/html/draft-ietf-cat-user2user-02
[MS-SFU]: https://msdn.microsoft.com/en-us/library/cc246071.aspx
Replaced all instances of `#!/usr/bin/python` with `#!/usr/bin/env python` so impacket's examples and scripts can be run inside a virtualenv without having to call python.
* Changing the (current-disabled) to (status=Enabled/Disabled)
* Moving that data to the end of the line, in alignment to the pwd-last-set display option
* Only supportted in VSS mode. DRSUAPI coming soon
* Minimalistic MQTT implementation, just focused on connecting, subscribing and publishing
basic messages on topics.
* Simple MQTT example aimed at playing with different login options. Can be converted into
a account/password brute forcer quite easily.
This script will gather data about the domain's users and their corresponding email addresses. It will also
include some extra information about last logon and last password set attributes.
You can enable or disable the the attributes shown in the final table by changing the values in line 184 and
headers in line 190.
If no entries are returned that means users don't have email addresses specified.
asolino