Added Kerberos support for SMBPasswd.py, fixes #1156#1177
Closed
p0dalirius wants to merge 2 commits intofortra:masterfrom
p0dalirius:added_kerberos_support_smbpasswd
Closed
Added Kerberos support for SMBPasswd.py, fixes #1156#1177p0dalirius wants to merge 2 commits intofortra:masterfrom p0dalirius:added_kerberos_support_smbpasswd
p0dalirius wants to merge 2 commits intofortra:masterfrom
p0dalirius:added_kerberos_support_smbpasswd
Conversation
Co-authored-by: ShutdownRepo <nwodtuhs+github@pm.me>
Closed
Comment on lines
+49
to
+51
| def __init__(self, domain='', username='', oldPassword='', newPassword='', | ||
| oldPwdHashLM='', oldPwdHashNT='', newPwdHashLM='', newPwdHashNT='', | ||
| hostname='', doKerberos=False, kdcHost=None): |
Collaborator
There was a problem hiding this comment.
Default values for parameters are not necessary, all of the parameters are passed to SMBPasswd at main, SMBPasswd is not used anywhere else.
Comment on lines
+133
to
+136
| group = parser.add_mutually_exclusive_group() | ||
| group.add_argument('-oldpass', action='store', default=None, help='old SMB password') | ||
| group.add_argument('-oldhashes', action='store', default=None, metavar='LMHASH:NTHASH', help='old NTLM hashes, format is LMHASH:NTHASH (the user will be asked to change their password at next logon)') | ||
|
|
Collaborator
There was a problem hiding this comment.
- oldpass: Can be obtained through target flag (smbpasswd.py#L155)
- oldhashes: Can be obtained through hashes flag (smbpasswd.py#L169-171)
- Mutually exclusive password/hashes: SMBPasswd already prioritizes hashes over username/password (smbpasswd.py#L169-L177)
|
|
||
| group = parser.add_argument_group('authentication') | ||
| group.add_argument('-hashes', action='store', default=None, metavar='LMHASH:NTHASH', help='NTLM hashes, format is LMHASH:NTHASH') | ||
| group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)') |
Collaborator
There was a problem hiding this comment.
This argument is not being used, (am i missing something?)
| group.add_argument('-hashes', action='store', default=None, metavar='LMHASH:NTHASH', help='NTLM hashes, format is LMHASH:NTHASH') | ||
| group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)') | ||
| group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line') | ||
| group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)') |
Collaborator
There was a problem hiding this comment.
- aesKey is only being used to set doKerberos flag
- The actual aesKey value is not used when setting credentials of the SMBTransport: smbpasswd.py#L67-L70
Comment on lines
+157
to
+158
| if oldPassword == '' and options.oldpass is not None: | ||
| oldPassword = options.oldpass |
Collaborator
There was a problem hiding this comment.
Not necessary, see first comment
alexisbalbachan
requested changes
Feb 1, 2023
Collaborator
alexisbalbachan
left a comment
alexisbalbachan
left a comment
There was a problem hiding this comment.
The core functionality is OK
There are some conflicting parameters while others are not being used
alexisbalbachan
added
waiting for response
Alef-Burzmali
added a commit
to Alef-Burzmali/impacket
that referenced
this pull request
May 21, 2023
This example combines the different protocols that can change a user's password in an AD environment. - smbpasswd.py features from edef71f Authors: @snovvcrash, @bransh, @Alef-Burzmali - Kerberos authentication for smbpasswd.py from bbcd2d8 Author: @p0dalirius (PR fortra#1177) - MS-RPC transport for SAMR (rpcpasswd.py) from a1d0cc9 Author: @Oddvarmoe (PR fortra#1304) - Kerberos Change and Set Password (kpasswd.py) from 9aea200 Author: @Alef-Burzmali
Alef-Burzmali
added a commit
to Alef-Burzmali/impacket
that referenced
this pull request
May 29, 2023
This example combines the different protocols that can change a user's password in an AD environment. - smbpasswd.py features from edef71f Authors: @snovvcrash, @bransh, @Alef-Burzmali - Kerberos authentication for smbpasswd.py from bbcd2d8 Author: @p0dalirius (PR fortra#1177) - MS-RPC transport for SAMR (rpcpasswd.py) from a1d0cc9 Author: @Oddvarmoe (PR fortra#1304) - Kerberos Change and Set Password (kpasswd.py) from 9aea200 Author: @Alef-Burzmali
Alef-Burzmali
added a commit
to Alef-Burzmali/impacket
that referenced
this pull request
May 29, 2023
This example combines the different protocols that can change a user's password in an AD environment. - smbpasswd.py features from edef71f Authors: @snovvcrash, @bransh, @Alef-Burzmali - Kerberos authentication for smbpasswd.py from bbcd2d8 Author: @p0dalirius (PR fortra#1177) - MS-RPC transport for SAMR (rpcpasswd.py) from a1d0cc9 Author: @Oddvarmoe (PR fortra#1304) - Kerberos Change and Set Password (kpasswd.py) from 9aea200 Author: @Alef-Burzmali
Collaborator
|
Added to changepasswd.py. Closing. Thanks @p0dalirius for your contribution!! |
anadrianmanrique
removed
the
waiting for response
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
We checked with @ShutdownRepo, and it is not possible to perform a password change with SamrUnicodeChangePasswordUser2 using Kerberos when the current password is expired (
STATUS_PASSWORD_EXPIRED), since the bypass relies on a null session, which cannot be obtained through Kerberos.However we submitted a pull request to smbpasswd.py and it is now possible to authenticate using Kerberos (only when password is not expired).
Here is a demo: