Fix error when printing ticket contents from a kirbi file format

[dwelch-r7]

Quick fix not sure how this slipped in, must have refactored some "real quick" before pushing and din't re-test in the original PR here #17390

Before:

msf6 auxiliary(admin/kerberos/inspect_ticket) > set TIckET_PATH ./metasploit_ticket.kirbi
TIckET_PATH => ./metasploit_ticket.kirbi
msf6 auxiliary(admin/kerberos/inspect_ticket) > run

[*] [2023.01.13-10:13:54] Kirbi File:./metasploit_ticket.kirbi
[-] [2023.01.13-10:13:54] Auxiliary failed: NoMethodError undefined method `kirbi_to_ccache' for #<Module:auxiliary/admin/kerberos/inspect_ticket datastore=[{"WORKSPACE"=>nil, "VERBOSE"=>false, "NTHASH"=>nil, "AES_KEY"=>nil, "TICKET_PATH"=>"./metasploit_ticket.kirbi"}]>
[-] [2023.01.13-10:13:54] Call stack:
[-] [2023.01.13-10:13:54]   /Users/dwelch/dev/metasploit-framework/lib/msf/core/exploit/remote/kerberos/ticket.rb:170:in `print_contents'
[-] [2023.01.13-10:13:54]   /Users/dwelch/dev/metasploit-framework/modules/auxiliary/admin/kerberos/inspect_ticket.rb:49:in `run'
[*] Auxiliary module execution completed

After:

msf6 auxiliary(admin/kerberos/inspect_ticket) > run

[*] [2023.01.13-10:17:31] Kirbi File:./ticket.kirbi
[*] [2023.01.13-10:17:31] Primary Principal: Administrator@SUPPORT.HTB
Ccache version: 4

Creds: 1
  Credential[0]:
    Server: cifs/dc.support.htb@SUPPORT.HTB
    Client: Administrator@SUPPORT.HTB
    Ticket etype: 17 (AES128)
    Key: f082630a73e6208b4a0e8e14e182f2d7
    Subkey: false
    Ticket Length: 1406
    Ticket Flags: 0x40a50000 (FORWARDABLE, RENEWABLE, PRE_AUTHENT, OK_AS_DELEGATE, CANONICALIZE)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 1970-01-01 01:00:00 +0100
      Start time: 2022-10-12 15:34:16 +0100
      End time: 2022-10-13 01:34:16 +0100
      Renew Till: 2022-10-19 15:34:16 +0100
    Ticket:
      Ticket Version Number: 5
      Realm: SUPPORT.HTB
      Server Name: cifs/dc.support.htb
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 5
        Cipher:
          Q4oxIbv+74PGlnDriGmuQEKhMJ5wo1VFmMqf5LHB/YLGV5T6Tor26mp7yfVMERtUsS2xjXswhMHAyi646GeOb7Obm95enX7hHvt8cxFZwpHCLOByWMxF66W7GVnyKHSgr1P6Wxz2qPeVgQcADF98aHdEPHKc9cjDUqxT4J0vVD5c0Mao4WIiX1ZvyFouUKEeTJbBg8geCJfzEh3q19a1bE/ksDp/Frd3NBz+a7isXGK9axxifCDpTCcBMudZErC605h2jwe5xZPvxaOawvB/d2pkq4BnRBq+3Z1uMBDca+r8YvqtyX1VLUpABw06wpQb7nowrAbsR5koXNVH1h4aT/0mfSfyYpsfy8s1XNE1qheIs6Cjeq8fmPLOBksaAUqtG53Upv1KASCLPrBeiUhp75K6LGEo1FtiYjwGXPd05S+hO84Q6SNQVCYd/MGfqbEb0AcXH5PgFGUwtOfB3QLFnI2Gz3ptf5npcQTWytd77D0rWWGPavCbWVYqZORencDMucLySSeVTxJ8vdclU0dk6eM9Ehky2ujhJxakvcctVQGI4xKgjrVrLXvCW1x4TheAVSYeZDQMupolTXM/mBxuDj4KWvfNf0fqhYpy321Dr++tWRvz2UdYsT1KQKl5kpTIi6qEhTflUVQ4RxD2a66gpZwabJjUNYsOsU+jnJSGeJDJM8cZNji7daWHXQT57VTbXHzfgbfxxwi/wQYVMh6lB2oxZcdZuPzR+CUBgZoATe4dwTEjjiqGN+ffpp/6FZFo890ObhClUDZ34kRLA4dKr7qDMpiTUoE4mHIe6rmE2rUfY/Z45G5HNSPn2K9q45eAuCxpJyLLIvniHHI4MvjVdn5Fk/Umryu8k7gbSRK+NT4COPOaL30eHpyLnvUg3cbckTi9V3QHraxplrPIXfzgGXCsjW2gDetYflEj/izFxfCNB39FWq/4RIaSHiNu2fm4CdalxBOpQIAkx129oKQjl7yP35JVLdKPQCifXZWCG4iwq7mozN28WMfnoblkt61LRM/gVNhk5Y73V68vs7MhO8MrIRWbNr0Sw53JRfVdiz0FVf4kkbWS62e9CLGcW/4SObTyk2Ke3eSb06D8efFMEBF7XdeVP3E7KsACtR1csqm5zrWnWWzEkbAtc89h5vjCkEsrqiQB/TTKYrALEyT07N5pUxCgVfb3dygM/oKP9N1vzaXnP8Kmqu9mlOIbD/XL8ri0V/Mx10KLSSynAvxvndL7MTnx6SpJzxwLKQ8wwZpfdVi9T/xjDvZGAWa+VAy1ZB/wNkoIK6lgTtfAHWJoCJ+kHhsqJxJSv8wqSvs6MS6s9dJO2VBNBzz5skXsdRrM7wgdXkQXhWbfBhY3/x6hd01SBAOiMsNHJ7sSTe3fHHIlAYHOgzQZVKs35maVzSNdvD5FKfZw7nJdoIIpMwSvISQo6XLBhTaMYrmrY38b/A2fGr1oylKgTWUPxVClT17/riaJf/oV5rKa3CRb6wpXOsnkxsbQwBoXmntQwor4fC5e43qM/D2S1T4Hf9v6K0siuXySPT63KugwVppuMKgR4d9IwuHnw7LWJseZBHvJAdfxbx0lrDZKCAExTBJn7woghSepDor/0gqP2i1XwUETumGTUZo9c3lhwhvpO2+VZFmWnzuhN6XnBIzMZYmkiua54oT/yedGFLCCyXbDkVmD3NYF83WxBHcS9PbBdBxcBZW6vnK7ocxAMSW/L7sud3OYGfmU4//19SITkP4xrJo1Xjf5p9C0
[*] Auxiliary module execution completed

[adfoster-r7]

Looks like this fixes the crash - but I can't decrypt the ticket 👀

msf6 auxiliary(admin/kerberos/inspect_ticket) > run ticket_path=./ticket.kirbi aes_key=e1c5500ffb883e713288d8037651821b9ecb0dfad89e01d1b920fe136879e33c
[*] Running module against 127.0.0.1

[*] Kirbi File:./ticket.kirbi
[*] Primary Principal: DC3$@ADF3.LOCAL
Ccache version: 4

Creds: 1
  Credential[0]:
    Server: LDAP/DC3@ADF3.LOCAL
    Client: DC3$@ADF3.LOCAL
    Ticket etype: 18 (AES256)
    Key: ab64d555f18de6a3262d921e6dc75dcf884852f551db3114f7983dbaf276e1d6
    Subkey: false
    Ticket Length: 1154
    Ticket Flags: 0x40a50000 (FORWARDABLE, RENEWABLE, PRE_AUTHENT, OK_AS_DELEGATE, CANONICALIZE)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 1970-01-01 01:00:00 +0100
      Start time: 2023-01-12 19:41:41 +0000
      End time: 2023-01-13 05:37:45 +0000
      Renew Till: 1970-01-01 01:00:00 +0100
    Ticket:
      Ticket Version Number: 5
      Realm: ADF3.LOCAL
      Server Name: LDAP/DC3
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 7
        Cipher:
          VVuaetSX/CEk09QcowvLH6TOfi+Ww/oONMZvs9iP6sqfWjepDSSaF5s3/8rW3Zenvrxfuixsc8DJB2374F/A/PuikVYEN1BKZn/oI20QQyM5eFziktUwf4l2qdCNqvzrU/EaH8M4fbSnLzkyLPsB/QHHsGcAt8mfwOlZbxkhGGnJLfAWrkaQWVOdOgcTQ9NQWOUN5BVql96WOB98YDkmaMdjjGF95rVSwTTwss6zodWywK8VGMeyuW8G1j66Ia+6HvHqI/hOJRTfbTvRW+/VImeIBvXMEWe0Dbh3Tpnb56lMmD/LpjKKBhbk3X5mXzL7NoaWNvrUfYBbayQfJc78WPxQA4HFV1RrXJuvSuJkNLaTEFHSpRwS2UVbV11FPJhVnr9O5dR2O/4ayvLjzK2MrU8LRwx0T+vTe63YyVVVYbNX/gKjYE90C3oFCYvDNWgmCoutzjTeivHodckmPxImDOdLVIW+9EKzybae8wQfNRm2o1Zsd7Abl9JB+8HLjNpexCCl0ApIzwTE8kGzhs4jIwLz4uHTHobfIJc1V2jbdptE9NGZlIW7ROY6/GJTFlr+lHj8t4EKisIRQzmpkwMqxsbG418YfD7CyY+QUKmnUmAZQ+jqvvPO2XNQQej2uSrjB815E2YNtLXVVZu3o4PrcoeuiuS0sGmJPwIPZPceHos5sjqIEgTCd26IHRb4OwRXX/bDbw7tvinTaDGdQH/+h5A9UorwJIBL/oyFQB1K2wgo7AkoHS7IMVmkwlNVGML8duETvkv1GIATMu897MT3rgfabi0zrTrRpUk1yIuAvJASwCP0v1cFW9fyZ3cKnudGbo+Za3O9fv4DtU+5s7/nB+lYjXyaJU3SVxgOLyQD2zZYUfqPi9h1wr4sDgTPIT2Deoyt0SqePDuHUxoyHkoaF0A7CPH7vwkA8B4hlgiq3mRyTi0GZWwqKEH5Rns2RnIT+7aFmDAPLLKiqNL1hKXT+jP+VtIEmHXQ9XZYh81PUkBtuY8CDqueMpov2ld0NCSsQFi+G/61ELYYO6EoSc+MhmK0l3Hj3U2avM+kQQ6+h08MDyFty2EFRewp444gDY9qgaIVvMBisVFt4vwEgA1yQ9UM1XljzDDD1ih6LEfNKKoSc8ZZgVQxe6Xd5qh+RzYE46osuNM1rLc4YgrenNwZRYXELsRoP+mvSoLKQxdn7c1q9KBGBGjyupAkvDx+ZHCSaT9DeJMVerS5/5+WF3s33PR7CrQyk9s0cmu1Jp1TEKjQN99JaIyMAW0wiJl3BVlB7cUriIUiGvo8WMcoWaxsS2yzK4Q1pPIBwOdqFYjJBlr9U0DXj5wLoVKunSZxtgmfS9/ShvZDUk7hlb/V2Iu3RMueJnGnA1hfWiAcGXEY4sF8dgSDM+aMO/7XB3DiC1Amh1dhlMQLKZngIfnmDwK7u+T6qLnU
[*] Auxiliary module execution completed

It looks like the AES_KEY is ignored, and it goes down this path the NTHASH path instead:

metasploit-framework/modules/auxiliary/admin/kerberos/inspect_ticket.rb

Lines 66 to 76 in 9c2b813

	if datastore['NTHASH'].present? && datastore['NTHASH'].size != 32
	fail_with(Msf::Exploit::Failure::BadConfig, "NTHASH length was #{datastore['NTHASH'].size}. It should be 32")
	else
	return datastore['NTHASH']
	end
	if datastore['AES_KEY'].present? && (datastore['AES_KEY'].size != 32 && datastore['AES_KEY'].size != 64)
	fail_with(Msf::Exploit::Failure::BadConfig, "AES key length was #{datastore['AES_KEY'].size}. It should be 32 or 64")
	else
	return datastore['AES_KEY']
	end

Breakpoint:

[4] pry(#<Msf::Modules::Auxiliary__Admin__Kerberos__Inspect_ticket::MetasploitModule>)> next

From: /Users/user/Documents/code/metasploit-framework/modules/auxiliary/admin/kerberos/inspect_ticket.rb:70 Msf::Modules::Auxiliary__Admin__Kerberos__Inspect_ticket::MetasploitModule#validate_key:

    59: def validate_key
    60:   if datastore['NTHASH'].blank? && datastore['AES_KEY'].blank?
    61:     return nil
    62:   elsif datastore['NTHASH'].present? && datastore['AES_KEY'].present?
    63:     fail_with(Msf::Exploit::Failure::BadConfig, 'NTHASH and AES_KEY may not both be set for inspecting a ticket')
    64:   end
    65: 
    66:   require 'pry-byebug'; binding.pry
    67:   if datastore['NTHASH'].present? && datastore['NTHASH'].size != 32
    68:     fail_with(Msf::Exploit::Failure::BadConfig, "NTHASH length was #{datastore['NTHASH'].size}. It should be 32")
    69:   else
 => 70:     return datastore['NTHASH']
    71:   end
    72: 
    73:   if datastore['AES_KEY'].present? && (datastore['AES_KEY'].size != 32 && datastore['AES_KEY'].size != 64)
    74:     fail_with(Msf::Exploit::Failure::BadConfig, "AES key length was #{datastore['AES_KEY'].size}. It should be 32 or 64")
    75:   else
    76:     return datastore['AES_KEY']
    77:   end
    78: end

[4] pry(#<Msf::Modules::Auxiliary__Admin__Kerberos__Inspect_ticket::MetasploitModule>)> datastore['AES_KEY']
=> "e1c5500ffb883e713288d8037651821b9ecb0dfad89e01d1b920fe136879e33c"
[5] pry(#<Msf::Modules::Auxiliary__Admin__Kerberos__Inspect_ticket::MetasploitModule>)> datastore['NTHASH']
=> nil

i.e. it returns an empty key at line 70 instead of continuing to line 73

[adfoster-r7]

Can we add a quick module test for this? 👍

Fixing the AES_KEY bug would be great too

[adfoster-r7]

Looks good to me; Kirbi no longer crashes, and I can decrypt kirbi files too with the aes_key after running a secrets dump.

kiwi decryption steps

meterpreter > kiwi_cmd 'sekurlsa::tickets /export'
....
====================
Base64 of file : [0;17aae2]-2-0-60a10000-DC3$@krbtgt-ADF3.LOCAL.kirbi
====================
doQAAAWXMIQAAAWRoIQAAAADAgEFoYQAAAADAgEWooQAAAQtMIQAAAQnYYQAAAQh
MIQAAAQboIQAAAADAgEFoYQAAAAMGwpBREYzLkxPQ0FMooQAAAAvMIQAAAApoIQA
AAADAgECoYQAAAAaMIQAAAAUGwZrcmJ0Z3QbCkFERjMuTE9DQUyjhAAAA8UwhAAA
A7+ghAAAAAMCARKhhAAAAAMCAQKihAAAA6cEggOjtrvvuenfZO2wr+kjO/pYjNwK
y2rik3lYvEICsHpof1ybyUypWIEVD6CPh+PdayitDXDwY7FQ72Y/HRTd8k3ictS/
sN0Nm29g3xuIo7Nfkj24WZd7sdRHN6hRu7exhzgSjRS+/Kz45M0+r7/mO9sKZRd2
B1TqReIzvNx8hd1r5zuged/KB0sZ87e8GtE8NuyCOT7aXeELQQFK2TjARs3cgq+I
fyolcaiaxjKqTcxVZBGppqEUKgyiTmB4170RVkBXQocYdlfjlubBW24IF44lc9hG
cESqJXZKB2ZupVVizuj5+tM7qmNLkJ9+mN223Lf88E7M0+kUXlacx6V4yqj6ZZkR
no9mlRnLwvuIxzxxhKXUTwY/2LkLQdHyv4cwEBbhNkn5Fc4SHZdOVl0JJTahimUd
st/MleiNysIBsKVWDTplwQxhvWhq0pVibhZ7fHL9JnvHDiCiBtBm4c6v12laWsAn
cjC7/A9tBoOIWcaggczny0ZGqRk3fVQ0txfwPbz2gidy0ZtAIB4KqXOTeSCW6OdZ
fWe1RAMyhC/ByDEUtHkmf7Ps7a6AN1evEgw7VAQVRmGRV7H5GO2XkncXk7HuMNU6
FJAiWGoL/9Xa/CXePNc6rpGPWryufqX+Avz6bMJU4e9xerGboX1ZCH7FTOI3YmHO
JvrjpetkfLwt88zoJN6X6vcMzn4PlnUu3ZRvL647bFYq4JW8XOtsFyBpKU/PJXC4
EZ03/KwWWa4xuv2aSXJ312kfBL3f9g1E3Ju+pNZp1W4S6nnrvCczyMaPb1Rf4ubk
824OEVxF3GBeR99EE40nuRzBU/YLucM6/fwGjI621kR9zTjM5uEXjmX0ezHY2ydc
ALBhtVum0FZ0QryRTnNHwEzhC407gIrrWBU9cWKdRFsKBB1UY2HwP0UM6uYcqy+U
tJNR98RC9TixxU/N86PtzVytwaM+uw2YSEWXFwpShgvm0HBeW/FmIeDQHweCygXw
/P/ErYKVagUPtb5v4rgYVxnOm7tx77jShjMLHMsT62f46d5Ym5PQjUM6a9OCWcb1
SIEt+2o7V2/5Jp8bL+PaenMJMjtwCsjxFbvtmjuaKFzS/rLzgfCrvaLod36iQU8F
m6IRww7X9QQe+sy95AZuJumnocF7rS9dvW1WjfWjgpK0Q4e7bMR85zDwAsBoz67k
dNiq2LLHYvCaiYy7VLEEuJa3upbygdKlT2F6OSEhl0c+e5417w7ZPZT/o+kbOFVW
06OEAAABRjCEAAABQKCEAAAAAwIBAKKEAAABMQSCAS19hAAAAScwhAAAASGghAAA
ARswhAAAARUwhAAAAQ+ghAAAADcwhAAAADGghAAAAAMCARKhhAAAACIEIGm/HHkB
hYiF4ZjplsODAFnTEStH3BRUrsjb1hw3LZaXoYQAAAAMGwpBREYzLkxPQ0FMooQA
AAAhMIQAAAAboIQAAAADAgEBoYQAAAAMMIQAAAAGGwREQzMko4QAAAAHAwUAYKEA
AKWEAAAAERgPMjAyMzAxMTQwMzQyNTRapoQAAAARGA8yMDIzMDExNDEzNDI1NFqn
hAAAABEYDzIwMjMwMTIxMDM0MjU0WqiEAAAADBsKQURGMy5MT0NBTKmEAAAALzCE
AAAAKaCEAAAAAwIBAqGEAAAAGjCEAAAAFBsGa3JidGd0GwpBREYzLkxPQ0FM
====================

msf6 auxiliary(admin/kerberos/inspect_ticket) > run ticket_path=first.kirbi aes_key=e1c5500ffb883e713288d8037651821b9ecb0dfad89e01d1b920fe136879e33c
[*] Running module against 127.0.0.1

[*] Kirbi File:first.kirbi
[*] Primary Principal: DC3$@ADF3.LOCAL
Ccache version: 4

Creds: 1
  Credential[0]:
    Server: krbtgt/ADF3.LOCAL@ADF3.LOCAL
    Client: DC3$@ADF3.LOCAL
    Ticket etype: 18 (AES256)
    Key: 69bf1c7901858885e198e996c3830059d3112b47dc1454aec8dbd61c372d9697
    Subkey: false
    Ticket Length: 1017
    Ticket Flags: 0x60a10000 (FORWARDABLE, FORWARDED, RENEWABLE, PRE_AUTHENT, CANONICALIZE)
    Addresses: 0
    Authdatas: 0
    Times:
      Auth time: 1970-01-01 01:00:00 +0100
      Start time: 2023-01-14 03:42:54 +0000
      End time: 2023-01-14 13:42:54 +0000
      Renew Till: 2023-01-21 03:42:54 +0000
    Ticket:
      Ticket Version Number: 5
      Realm: ADF3.LOCAL
      Server Name: krbtgt/ADF3.LOCAL
      Encrypted Ticket Part:
        Ticket etype: 18 (AES256)
        Key Version Number: 2
        Decrypted (with key: \xe1\xc5\x50\x0f\xfb\x88\x3e\x71\x32\x88\xd8\x03\x76\x51\x82\x1b\x9e\xcb\x0d\xfa\xd8\x9e\x01\xd1\xb9\x20\xfe\x13\x68\x79\xe3\x3c):
          Times:
            Auth time: 2023-01-14 03:42:54 UTC
            Start time: 2023-01-14 03:42:54 UTC
            End time: 2023-01-14 13:42:54 UTC
            Renew Till: 2023-01-21 03:42:54 UTC
          Client Addresses: 0
          Transited: tr_type: 1, Contents: ""
          Client Name: 'DC3$'
          Client Realm: 'ADF3.LOCAL'
          Ticket etype: 18 (AES256)
          Encryption Key: 69bf1c7901858885e198e996c3830059d3112b47dc1454aec8dbd61c372d9697
          Flags: 0x60a10000 (FORWARDABLE, FORWARDED, RENEWABLE, PRE_AUTHENT)
          PAC:
            Validation Info:
              Logon Time: 2022-11-05 14:23:07 +0000
              Logoff Time: Never Expires (inf)
              Kick Off Time: Never Expires (inf)
              Password Last Set: 2023-01-14 03:42:30 +0000
              Password Can Change: 2023-01-15 03:42:30 +0000
              Password Must Change: Never Expires (inf)
              Logon Count: 691
              Bad Password Count: 0
              User ID: 1001
              Primary Group ID: 516
              User Flags: 32
              User Session Key: \x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00
              User Account Control: 8448
              Sub Auth Status: 0
              Last Successful Interactive Logon: No Time Set (0)
              Last Failed Interactive Logon: No Time Set (0)
              Failed Interactive Logon Count: 0
              SID Count: 2
              Resource Group Count: 0
              Group Count: 1
              Group IDs:
                Relative ID: 516, Attributes: 7
              Logon Domain ID: S-1-5-21-1266190811-2419310613-1856291569
              Effective Name: 'DC3$'
              Full Name: ''
              Logon Script: ''
              Profile Path: ''
              Home Directory: ''
              Home Directory Drive: ''
              Logon Server: 'DC3'
              Logon Domain Name: 'ADF3'
            Client Info:
              Name: 'DC3$'
              Client ID: 2023-01-14 03:42:54 +0000
            {:ul_type=>12, :cb_buffer_size=>72, :offset=>560, :buffer=>{:pac_element=>{:ul_type=>12, :unknown_element=>"\x1E\x00\x10\x00\x14\x000\x00\x01\x00\x00\x00\x00\x00\x00\x00D\x00C\x003\x00$\x00@\x00a\x00d\x00f\x003\x00.\x00l\x00o\x00c\x00a\x00l\x00\x00\x00A\x00D\x00F\x003\x00.\x00L\x00O\x00C\x00A\x00L\x00\x00\x00\x00\x00"}, :padding=>""}}
            Pac Server Checksum:
              Signature: \xe8\x0f\x40\xa6\xb9\x17\x77\x49\x4b\x8b\x36\x34
            Pac Privilege Server Checksum:
              Signature: \x1e\xc8\x24\x44\xff\x83\x4f\x41\xed\xea\xc7\x5f\x69\xb1\x35\xca
[*] Auxiliary module execution completed

We should circle back round to supporting ul_type 12 at some point - but it's good for now 👍

0x0000000C
User principal name (UPN) and Domain Name System (DNS) information (section 2.10).
https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-pac/3341cfa2-6ef5-42e0-b7bc-4544884bf399