Authentication error for Windows Server 2022? #167
Comments
|
Hi! It's really strange because AFAIK, you can use ldap3 library with kerberos and ldaps even if Channel Bindind is enabled. 🌻 |
Password:
[+] Authenticating to LDAP server
[-] Got error: Failed to authenticate to LDAP. Invalid credentials
Traceback (most recent call last):
File "/usr/lib/python3/dist-packages/certipy/entry.py", line 60, in main
actions[options.action](options)
File "/usr/lib/python3/dist-packages/certipy/commands/parsers/find.py", line 12, in entry
find.entry(options)
File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 1185, in entry
find.find()
File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 165, in find
connection = self.connection
^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/certipy/commands/find.py", line 124, in connection
self._connection.connect()
File "/usr/lib/python3/dist-packages/certipy/lib/ldap.py", line 77, in connect
self.connect(version=ssl.PROTOCOL_TLSv1_2)
File "/usr/lib/python3/dist-packages/certipy/lib/ldap.py", line 144, in connect
raise Exception(
Exception: Failed to authenticate to LDAP. Invalid credentialsI have a similar issue. And i tried every possible authentication method and it still fails. I'm kinda stuck on why it doesn't work. The credentials are 100% correct and a simple ldapsearch works like it should. A simple LDAP bind connection delivers the following output : |
|
Thanks for reporting. I am looking into it. |
|
Something interesting to add here is that i can connect and authenticate via the MS-LDP tool. And that both LDAP Signing and Channel Binding are active in our Network . The MS-LDP Tool delivers the following output : @ly4k Thank you very much for your time and for looking into it . I've been looking into this issue for some days now and i would heavily appreciate to learn the base and solution of this problem. This issue stops the tool from working at all since we can't connect/authenticate to our DC. |
|
Unfortunately ldap3 library does not support LDAP Signing/Channel binding out of the box, two PR (1087 and 1042) are currently open to implement them but the project seems dead 😢 (full disclosure: I made one of them) Hope it helps. 🌻 |
|
@ThePirateWhoSmellsOfSunflowers By Simple Authentication you mean to send the full DN into the username String and the Password with the ldaps scheme parameter ? AFAIK simple authentication means to send the full DN and the cleartext password into a request or am I wrong ? Thank you very much for your help. |
|
Simple Authentication is a "non NTLM authentication" as defined in the LDAPv3 RFC but Active Directory is compatible with it. You will need to change certipy code to something like connection = ldap3.Connection(server, authentication=ldap3.SIMPLE, user='my_user@domain.local', password='password')instead of connection = ldap3.Connection(server, authentication=ldap3.NTLM, user='domain.local\\my_user', password='password')Yes the password is sent in cleartext but within a TLS channel, because you are using LDAPS. |
|
Yeah this seemed to fix the invalidCredential issue , which is a step forward in the right direction . But now i have another issue with enum.py : I have seen some other issues that relate to my new one , I'll try to see If i can fix it like its mentioned in this issue |
This worked in my environment with |
|
Keep in mind that you cannot use NT hash with Simple authentication so it's a little bit hacky for IRL scenarios. |
@b1gy7 This issue was fixed in version 4.8.0. There was a duplicate issue, and I've only closed one of them. |
|
I've noticed that and I've upgraded and now it works with the Simple Authentication change. Thank you very much @ly4k @ThePirateWhoSmellsOfSunflowers. If there is any way to financially recompensate to this repository lmk i'll gladly contribute with what I can . A great & active helping community. |
|
I have a Github sponsors profile, which isn't supposed to be public yet, as I'm planning to publish it when my next tool is released, but it is available and live here: https://github.com/sponsors/ly4k 😃 As for Certipy, I am considering making a fork of ldap3 and merging the PRs. I will test later. |
|
I made a fork of LDAP3 and merged the PR from @ThePirateWhoSmellsOfSunflowers. Thanks a lot for that! The new Certipy version If you encounter an environment with LDAP signing, I'd recommend using LDAPS instead of LDAP, and if required, use channel binding as well with the new In the meantime, we'll use this quick and dirty fix, and Certipy will spit out better error messages with relevant information (including the pip install command) if you end up in this scenario. |
|
To follow |
Facing issues when authenticating to Windows Server 2022 (password/ticket valid)
The text was updated successfully, but these errors were encountered: