Skip to content

added support for KDC proxies to asktgt, asktgs and s4u#125

Merged
HarmJ0y merged 3 commits into
masterfrom
kkdcp
Feb 8, 2022
Merged

added support for KDC proxies to asktgt, asktgs and s4u#125
HarmJ0y merged 3 commits into
masterfrom
kkdcp

Conversation

@0xe7
Copy link
Copy Markdown
Contributor

@0xe7 0xe7 commented Jan 27, 2022

As requested by MichaelGrafnetter in issue #100. asktgt, asktgs and s4u can now be used through a KDC proxy using the /proxyurl:URL argument. If the /proxyurl argument isn't passed, Rubeus should behave as before. An example of using it to request a service ticket:

C:\Rubeus>.\Rubeus.exe asktgs /service:ldap/idc1.internal.zeroday.lab /nowrap /proxyurl:https://192.168.71.40/kdcproxy /ticket:doIFtDCCBbCg...mFsLnplcm9kYXkubGFi

   ______        _
  (_____ \      | |
   _____) )_   _| |__  _____ _   _  ___
  |  __  /| | | |  _ \| ___ | | | |/___)
  | |  \ \| |_| | |_) ) ____| |_| |___ |
  |_|   |_|____/|____/|_____)____/(___/

  v2.0.2

[*] Action: Ask TGS

[*] Requesting default etypes (RC4_HMAC, AES[128/256]_CTS_HMAC_SHA1) for the service ticket
[*] Building TGS-REQ request for: 'ldap/idc1.internal.zeroday.lab'
[*] Sending request via KDC proxy: https://192.168.71.40/kdcproxy
[+] TGS request successful!
[*] base64(ticket.kirbi):

      doIF/DCCBfigAwIBBaE...nplcm9kYXkubGFi

  ServiceName              :  ldap/idc1.internal.zeroday.lab
  ServiceRealm             :  INTERNAL.ZERODAY.LAB
  UserName                 :  internal.user
  UserRealm                :  INTERNAL.ZERODAY.LAB
  StartTime                :  27/01/2022 23:32:21
  EndTime                  :  28/01/2022 09:32:21
  RenewTill                :  04/02/2022 23:21:42
  Flags                    :  name_canonicalize, ok_as_delegate, pre_authent, renewable, forwardable
  KeyType                  :  aes256_cts_hmac_sha1
  Base64(key)              :  Y9MGx/TY77PBNMxo+z+3etq1fRSl2JPa4L1PlUlPhnU=

@HarmJ0y
Copy link
Copy Markdown
Member

HarmJ0y commented Feb 8, 2022

👍 landed

@HarmJ0y HarmJ0y merged commit 89f1d1a into master Feb 8, 2022
@HarmJ0y HarmJ0y deleted the kkdcp branch February 8, 2022 20:15
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants