Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add shadow spray action #6

Merged
merged 3 commits into from
Oct 13, 2022
Merged

Add shadow spray action #6

merged 3 commits into from
Oct 13, 2022

Conversation

snovvcrash
Copy link
Contributor

@snovvcrash snovvcrash commented Oct 11, 2022

Hey @ShutdownRepo, @p0dalirius!

I was already going to sleep when decided to scroll Twitter a bit and... I couldn't deny myself this PR after reading about ShadowSpray.

It's very quick and dirty and all it implements is a for loop and lack of info messages but I guess it could be helpful anyways c:

demo

P. S. Credits to @Dec0ne for the idea of Shadow Credentials spraying!

Copy link
Owner

@ShutdownRepo ShutdownRepo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Awesome addition! I have some change request though, in my opinion the for loop should take place after the KCL blob is created. That way, all users will be sprayed with the exact same key pair and the user won't have to keep track of what key belongs to what victim.
Also, line 417 could be changed to something like

logger.success(f"Updated the msDS-KeyCredentialLink attribute of the target objects: {",".join(targets)}")

What do you think?

@snovvcrash
Copy link
Contributor Author

That's a good point!

I've fixed that the following way: in the beginning of the spray we create a single certificate with a randomly chosen target from the list to be the owner of the certificate (its samname and dn are populated within the subject and owner properties of the certificate respectively).

Regarding the changes for line 417 - I still think we should keep pywhisker printing successful attempts line by line 'cause it's more like the spraying style I guess (like we're used to see it with kerbrute, for example). Moreover, in large environments it may take time for the spray to complete and we shall not see the results until it finishes. Here's how it looks like line by line ⏬

demo

But it's up to you to decide!

@ShutdownRepo
Copy link
Owner

Agreed 100%, merging, thank you @snovvcrash !

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants