Krbrelayx - Boîte à outils de relais Kerberos et d'abus de délégation non contrainte

Boîte à outils pour abuser de Kerberos. Nécessite impacket, ldap3 et dnspython pour fonctionner. Il est recommandé d'installer impacket directement depuis git pour disposer de la dernière version disponible.

Plus d'informations sur cette boîte à outils disponibles dans mon blog https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/. Des informations sur le relais Kerberos dans le blog de suivi https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/.

Outils inclus

addspn.py

Cet outil peut ajouter/supprimer/modifier des noms de principaux de service (SPN) sur des comptes de l'AD via LDAP.

usage: addspn.py [-h] [-u USERNAME] [-p PASSWORD] [-t TARGET] -s SPN [-r] [-q]
                 [-a]
                 HOSTNAME

Add an SPN to a user/computer account

Required options:
  HOSTNAME              Hostname/ip or ldap://host:port connection string to
                        connect to

Main options:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        DOMAIN\username for authentication
  -p PASSWORD, --password PASSWORD
                        Password or LM:NTLM hash, will prompt if not specified
  -t TARGET, --target TARGET
                        Computername or username to target (FQDN or COMPUTER$
                        name, if unspecified user with -u is target)
  -s SPN, --spn SPN     servicePrincipalName to add (for example:
                        http/host.domain.local or cifs/host.domain.local)
  -r, --remove          Remove the SPN instead of add it
  -q, --query           Show the current target SPNs instead of modifying
                        anything
  -a, --additional      Add the SPN via the msDS-AdditionalDnsHostName
                        attribute

dnstool.py

Ajouter/modifier/supprimer des enregistrements DNS intégrés à Active Directory via LDAP.

usage: dnstool.py [-h] [-u USERNAME] [-p PASSWORD] [--forest] [--legacy] [--zone ZONE]
                  [--print-zones] [--tcp] [-k] [-dc-ip ip address] [-dns-ip ip address]
                  [-aesKey hex key] [-r TARGETRECORD]
                  [-a {add,modify,query,remove,resurrect,ldapdelete}] [-t {A}] [-d RECORDDATA]
                  [--allow-multiple] [--ttl TTL]
                  HOSTNAME

Query/modify DNS records for Active Directory integrated DNS via LDAP

Required options:
  HOSTNAME              Hostname/ip or ldap://host:port connection string to
                        connect to

Main options:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        DOMAIN\username for authentication.
  -p PASSWORD, --password PASSWORD
                        Password or LM:NTLM hash, will prompt if not specified
  --forest              Search the ForestDnsZones instead of DomainDnsZones
  --zone ZONE           Zone to search in (if different than the current
                        domain)
  --print-zones         Only query all zones on the DNS server, no other
                        modifications are made

Record options:
  -r TARGETRECORD, --record TARGETRECORD
                        Record to target (FQDN)
  -a {add,modify,query,remove,ldapdelete}, --action {add,modify,query,remove,ldapdelete}
                        Action to perform. Options: add (add a new record),
                        modify (modify an existing record), query (show
                        existing), remove (mark record for cleanup from DNS
                        cache), delete (delete from LDAP). Default: query
  -t {A}, --type {A}    Record type to add (Currently only A records
                        supported)
  -d RECORDDATA, --data RECORDDATA
                        Record data (IP address)
  --allow-multiple      Allow multiple A records for the same name
  --ttl TTL             TTL for record (default: 180)

printerbug.py

Outil simple pour déclencher le bug SpoolService via un backconnect RPC. Similaire à dementor.py. Merci à @agsolino pour avoir implémenté ces appels RPC.

usage: printerbug.py [-h] [-target-file file] [-port [destination port]]
                     [-hashes LMHASH:NTHASH] [-no-pass]
                     target attackerhost

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
  attackerhost          hostname to connect to

optional arguments:
  -h, --help            show this help message and exit

connection:
  -target-file file     Use the targets in the specified file instead of the
                        one on the command line (you must still specify
                        something as target name)
  -port [destination port]
                        Destination port to connect to SMB Server

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful when proxying through
                        ntlmrelayx)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters.
                        If valid credentials cannot be found, it will use the ones specified in the command line
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target
                        parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful
                        when target is the NetBIOS name or Kerberos name and you cannot resolve it

krbrelayx.py

Cet outil offre plusieurs modes d'utilisation :

• Relais Kerberos : lorsqu'aucun identifiant n'est fourni, mais qu'au moins une cible est spécifiée, krbrelayx transmet l'authentification Kerberos à un nom d'hôte cible correspondant, relayant ainsi l'authentification. La façon d'obtenir une authentification Kerberos entrante avec un SPN valide vous appartient, mais vous pouvez utiliser mitm6 pour cela.
• Abus de délégation non contrainte : dans ce mode, krbrelayx déchiffre et extrait les TGT entrants incorporés dans l'authentification avec délégation non contrainte, ou utilise immédiatement les TGT pour s'authentifier auprès d'un service cible. Cela nécessite que les identifiants d'un compte avec délégation non contrainte soient spécifiés.

usage: krbrelayx.py [-h] [-debug] [-t TARGET] [-tf TARGETSFILE] [-w] [-ip INTERFACE_IP] [-r SMBSERVER] [-l LOOTDIR]
                    [-f {ccache,kirbi}] [-codec CODEC] [-no-smb2support] [-wh WPAD_HOST] [-wa WPAD_AUTH_NUM] [-6] [-p PASSWORD]
                    [-hp HEXPASSWORD] [-s USERNAME] [-hashes LMHASH:NTHASH] [-aesKey hex key] [-dc-ip ip address] [-e FILE]
                    [-c COMMAND] [--enum-local-admins] [--no-dump] [--no-da] [--no-acl] [--no-validate-privs]
                    [--escalate-user ESCALATE_USER] [--add-computer] [--delegate-access] [--adcs] [--template TEMPLATE]
                    [-v TARGET]

Kerberos relay and unconstrained delegation abuse tool. By @_dirkjan / dirkjanm.io