Added `-self`, `-altservice` and `-u2u` to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

ShutdownRepo · 2021-11-01T16:07:31Z

My previous PR #1183 allowed getST to accept a custom ticket for S4U2Proxy and basically run S4U2Proxy without S4U2Self..
This edit allows to run S4U2Self only, with the -self flag, without having S4U2Proxy being engaged right after. This allows researchers to conduct S4U2Self separately but also allows for privilege escalation: https://exploit.ph/revisiting-delegate-2-thyself.html, https://cyberstoph.org/posts/2021/06/abusing-kerberos-s4u2self-for-local-privilege-escalation/

When running getST with the -self flag, the -spn becomes optional. In this case, the target principal is set to the user running getST. But when -spn is set, the S4U2Self request is attempted for that SPN, sometimes allowing lateral movement between services of a same account.

On a side note, what was previously possible in one step can now be run in two commands.

Nothing new here, it's already possible with Rubeus, but now Impacket's getST can do it.

Oh, also I changed the header from python to python3

Previous searchFilter resulted in a list of accounts missing vulnerable users

If `-self` (== no S4U2Proxy) is set, the `-spn` is now optional. If SPN is set, the S4U2Self request is made for that SPN. Else, the SPN is set to the requesting user

ShutdownRepo · 2021-12-14T12:18:48Z

This PR can now be used along other tools for sAMAccountName spoofing attacks 👍

Removing searchfilter for DCs to allow RBCD and Unconstrained to be shown

# Conflicts: # examples/Get-GPPPassword.py

# Conflicts: # impacket/examples/ntlmrelayx/attacks/ldapattack.py

# Conflicts: # examples/ticketer.py # impacket/krb5/pac.py

# Conflicts: # impacket/smbserver.py

[getST.py] adding -u2u support in combination to -self for SPN-less RBCD

ShutdownRepo · 2022-09-25T22:06:42Z

Adding -u2u capabilities (when used along -self), for SPN-less RBCD.

In 2022, Jame Forshaw demonstrated that the SPN requirement wasn't completely mandatory and RBCD could be operated without: Exploiting RBCD using a normal user. While this technique is a bit trickier and should absolutely be avoided on regular user accounts (the technique renders them unusable for normal people), it allows to abuse RBCD even if the MachineAccountQuota is set to 0. In this case, the first (edit the "rbcd" attribute) and last ("Pass-the-ticket") steps are the same. (thehacker.recipes)

Fix parameter merge

anadrianmanrique · 2023-12-11T12:47:40Z

@ShutdownRepo Hi! do you think this could be revamped in the context of the current version?

ShutdownRepo · 2023-12-11T20:34:05Z

I think I messed up somewhere, as this PR changes 26 files, and this wasn't intended.
From the comment log here, this PR should only introduce

the -self, -altservice, -u2u args for getST.py
ticketer.py for service substitution outside of getST.py
the renameMachine.py script for sAMAccountName spoofing

Everything else should be ignored, I will fix this PR accordingly

ShutdownRepo · 2023-12-11T21:27:40Z

I think I fixed the PR but it seems there are now conflicts on two files that are not changed, why...
Anything you can do on your end to fix that?
Do you think there are other things to adjust in getST/tgssub/renameMachine itself ?

anadrianmanrique · 2023-12-12T12:30:19Z

yeah, those conflicts related to this branch might be because of those files (ticketer.py, pac.py) got super outdated.
Anyway, I didn't spot those new examples :D. I think it would be better to split this PR into 2, and have getST.py changes and new examples in different PRs. What do you think?

ShutdownRepo · 2023-12-12T14:21:21Z

yeah, those conflicts related to this branch might be because of those files (ticketer.py, pac.py) got super outdated. Anyway, I didn't spot those new examples :D. I think it would be better to split this PR into 2, and have getST.py changes and new examples in different PRs. What do you think?

I have no preference on this matter, feel free to split the PR if you prefer it that way 😉

anadrianmanrique · 2023-12-12T21:53:15Z

ok tgssub is in its own PR #1256
same for renameMachine.py #1224
so it makes no sense to have them in the context of this PR. Lets remove them from here, follow them up in their own PR's ( as it should be) and continue with this one for further testing and integration. Thanks

ShutdownRepo · 2023-12-13T13:14:43Z

ok tgssub is in its own PR #1256 same for renameMachine.py #1224 so it makes no sense to have them in the context of this PR. Lets remove them from here, follow them up in their own PR's ( as it should be) and continue with this one for further testing and integration. Thanks

Ah! Forgot about them, well done

ShutdownRepo · 2023-12-13T13:25:01Z

@anadrianmanrique done, but the ticketer.py and pac.py still seem to be modified for some reason.. Don't know how to fix that

anadrianmanrique · 2023-12-27T19:07:08Z

@ShutdownRepo ok, I've been testing the changes, so far everything looks ok. I would need you to resolve the conflicts in ticketer.py in your branch, in order to be able to merge this PR. Because of #1411, ticketer.py should be rebased to the latest version. Also ticketer.py and pac.py should be removed from the PR. Thanks

anadrianmanrique · 2023-12-27T19:14:51Z

either that, or create a new PR with getST.py changes ( we will link it to this one later ). Whichever works best for you

anadrianmanrique · 2024-01-30T18:48:41Z

now merged in #1691. Thanks!

ShutdownRepo and others added 23 commits August 2, 2021 14:52

Improved searchFilter

9df91ae

Previous searchFilter resulted in a list of accounts missing vulnerable users

Patching SID query of the incoming user

a39d8db

Merge branch 'SecureAuthCorp:master' into aclattack

46f2aa9

Added user filter and changed a string

48adfe3

Adding describeTicket base

5276230

Adding "only S4U2Self" switch

71f6586

Changing getST header to python3

224901d

SPN argument optional when No S4U2Proxy is done

eba8475

If `-self` (== no S4U2Proxy) is set, the `-spn` is now optional. If SPN is set, the S4U2Self request is made for that SPN. Else, the SPN is set to the requesting user

Started implementing Ticket decryption

09717a6

Update describeTicket.py

386e50f

Added PAC structures

ad5b10c

Improved PAC parsing and printing

ccdb6a2

Fixing the PAC_CLIENT_INFO structure

214c356

Fixes dates, improved errors, prepared for PR

ccec4a1

Added PAC Credentials structure, improved code

1c385cc

Reverting getST edit

e74f485

Cleaning imports and overall code

31d18cf

Reverting ALL getST changes, wrong dev branch

37df098

Debugging some keys calculation

428e56e

Merge branch 'SecureAuthCorp:master' into getST

b4774d6

Merge branch 'SecureAuthCorp:master' into findDelegation

4bc842d

Added renameMachine.py

b4fbcf9

Improved error handling and expected behavior for patched envs

9d0158b

ShutdownRepo and others added 6 commits December 16, 2021 00:12

Fixed small if elif order for debug messages

4206def

Modified searchFilter to show RBCD over DCs

de5906d

Removing searchfilter for DCs to allow RBCD and Unconstrained to be shown

Added possibility to query delegs for disabled users

8d738ad

Merge branch 'SecureAuthCorp:master' into findDelegation

3c9432e

Added "-disabled" switch to query only delegs for disabled users

55e9742

Update smbattack.py

7fc473c

ShutdownRepo and others added 6 commits September 14, 2022 18:09

Get gpppasswords scheduled tasks

42290d6

# Conflicts: # examples/Get-GPPPassword.py

LDAP attack: Add DNS records to LDAP

d30981c

# Conflicts: # impacket/examples/ntlmrelayx/attacks/ldapattack.py

Add pac ticketer

2870081

# Conflicts: # examples/ticketer.py # impacket/krb5/pac.py

Added flag to drop SSP from Net-NTLMv1 auth

456289b

# Conflicts: # impacket/smbserver.py

Fix parameter merge

06ea5fd

Merge pull request #37 from ShutdownRepo/getST-u2u

4817b85

[getST.py] adding -u2u support in combination to -self for SPN-less RBCD

ShutdownRepo changed the title ~~Added -self and -altservice to getST for S4U2self abuse and service substitution~~ Added -self, -altservice and -u2u to getST for S4U2self abuse, S4U2self+u2u, and service substitution Sep 25, 2022

ShutdownRepo added 2 commits September 26, 2022 14:44

Merge pull request #36 from Dramelac/patch-1

2d1e373

Fix parameter merge

Merge branch 'exegol' into getST

a67c44c

AlgunaPseudo mentioned this pull request Nov 19, 2023

Patch SamAccountName [CVE-2021-42287] Orange-Cyberdefense/GOAD#145

Closed

anadrianmanrique added the medium Medium priority item label Dec 7, 2023

anadrianmanrique self-assigned this Dec 7, 2023

ShutdownRepo added 2 commits December 11, 2023 22:03

removed unneeded changes

1261fb5

removed unneeded changes

ac8c0e9

removed unneeded changes

2fc02e6

anadrianmanrique added the waiting for response Further information is needed from people who opened the issue or pull request label Jan 2, 2024

anadrianmanrique mentioned this pull request Jan 25, 2024

implemented S4U2self only and u2u in getST.py #1691

Merged

anadrianmanrique closed this Jan 30, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Added `-self`, `-altservice` and `-u2u` to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

Added `-self`, `-altservice` and `-u2u` to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

ShutdownRepo commented Nov 1, 2021

ShutdownRepo commented Dec 14, 2021

ShutdownRepo commented Sep 25, 2022

anadrianmanrique commented Dec 11, 2023

ShutdownRepo commented Dec 11, 2023 •

edited

Loading

ShutdownRepo commented Dec 11, 2023

anadrianmanrique commented Dec 12, 2023

ShutdownRepo commented Dec 12, 2023

anadrianmanrique commented Dec 12, 2023 •

edited

Loading

ShutdownRepo commented Dec 13, 2023

ShutdownRepo commented Dec 13, 2023

anadrianmanrique commented Dec 27, 2023

anadrianmanrique commented Dec 27, 2023

anadrianmanrique commented Jan 30, 2024

Added -self, -altservice and -u2u to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

Added -self, -altservice and -u2u to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

Conversation

ShutdownRepo commented Nov 1, 2021

ShutdownRepo commented Dec 14, 2021

ShutdownRepo commented Sep 25, 2022

anadrianmanrique commented Dec 11, 2023

ShutdownRepo commented Dec 11, 2023 • edited Loading

ShutdownRepo commented Dec 11, 2023

anadrianmanrique commented Dec 12, 2023

ShutdownRepo commented Dec 12, 2023

anadrianmanrique commented Dec 12, 2023 • edited Loading

ShutdownRepo commented Dec 13, 2023

ShutdownRepo commented Dec 13, 2023

anadrianmanrique commented Dec 27, 2023

anadrianmanrique commented Dec 27, 2023

anadrianmanrique commented Jan 30, 2024

Added `-self`, `-altservice` and `-u2u` to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

Added `-self`, `-altservice` and `-u2u` to getST for S4U2self abuse, S4U2self+u2u, and service substitution #1202

ShutdownRepo commented Dec 11, 2023 •

edited

Loading

anadrianmanrique commented Dec 12, 2023 •

edited

Loading