Krbrelayx - Kit de ferramentas para retransmissão Kerberos e abuso de delegação não restrita

Toolkit para abusar do Kerberos. Requer impacket, ldap3 e dnspython para funcionar. Recomenda-se instalar o impacket diretamente do git para ter a versão mais recente disponível.

Mais informações sobre este kit de ferramentas disponíveis no meu blog https://dirkjanm.io/krbrelayx-unconstrained-delegation-abuse-toolkit/. Informações sobre retransmissão Kerberos no blog de acompanhamento https://dirkjanm.io/relaying-kerberos-over-dns-with-krbrelayx-and-mitm6/.

Ferramentas incluídas

addspn.py

Esta ferramenta pode adicionar/remover/modificar Nomes Principais de Serviço (SPNs) em contas no AD via LDAP.

usage: addspn.py [-h] [-u USERNAME] [-p PASSWORD] [-t TARGET] -s SPN [-r] [-q]
                 [-a]
                 HOSTNAME

Add an SPN to a user/computer account

Required options:
  HOSTNAME              Hostname/ip or ldap://host:port connection string to
                        connect to

Main options:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        DOMAIN\username for authentication
  -p PASSWORD, --password PASSWORD
                        Password or LM:NTLM hash, will prompt if not specified
  -t TARGET, --target TARGET
                        Computername or username to target (FQDN or COMPUTER$
                        name, if unspecified user with -u is target)
  -s SPN, --spn SPN     servicePrincipalName to add (for example:
                        http/host.domain.local or cifs/host.domain.local)
  -r, --remove          Remove the SPN instead of add it
  -q, --query           Show the current target SPNs instead of modifying
                        anything
  -a, --additional      Add the SPN via the msDS-AdditionalDnsHostName
                        attribute

dnstool.py

Adicionar/modificar/excluir registros DNS integrados do Active Directory via LDAP.

usage: dnstool.py [-h] [-u USERNAME] [-p PASSWORD] [--forest] [--legacy] [--zone ZONE]
                  [--print-zones] [--tcp] [-k] [-dc-ip ip address] [-dns-ip ip address]
                  [-aesKey hex key] [-r TARGETRECORD]
                  [-a {add,modify,query,remove,resurrect,ldapdelete}] [-t {A}] [-d RECORDDATA]
                  [--allow-multiple] [--ttl TTL]
                  HOSTNAME

Query/modify DNS records for Active Directory integrated DNS via LDAP

Required options:
  HOSTNAME              Hostname/ip or ldap://host:port connection string to
                        connect to

Main options:
  -h, --help            show this help message and exit
  -u USERNAME, --user USERNAME
                        DOMAIN\username for authentication.
  -p PASSWORD, --password PASSWORD
                        Password or LM:NTLM hash, will prompt if not specified
  --forest              Search the ForestDnsZones instead of DomainDnsZones
  --zone ZONE           Zone to search in (if different than the current
                        domain)
  --print-zones         Only query all zones on the DNS server, no other
                        modifications are made

Record options:
  -r TARGETRECORD, --record TARGETRECORD
                        Record to target (FQDN)
  -a {add,modify,query,remove,ldapdelete}, --action {add,modify,query,remove,ldapdelete}
                        Action to perform. Options: add (add a new record),
                        modify (modify an existing record), query (show
                        existing), remove (mark record for cleanup from DNS
                        cache), delete (delete from LDAP). Default: query
  -t {A}, --type {A}    Record type to add (Currently only A records
                        supported)
  -d RECORDDATA, --data RECORDDATA
                        Record data (IP address)
  --allow-multiple      Allow multiple A records for the same name
  --ttl TTL             TTL for record (default: 180)

printerbug.py

Ferramenta simples para acionar o bug do SpoolService via backconnect RPC. Semelhante ao dementor.py. Agradecimentos a @agsolino por implementar essas chamadas RPC.

usage: printerbug.py [-h] [-target-file file] [-port [destination port]]
                     [-hashes LMHASH:NTHASH] [-no-pass]
                     target attackerhost

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>
  attackerhost          hostname to connect to

optional arguments:
  -h, --help            show this help message and exit

connection:
  -target-file file     Use the targets in the specified file instead of the
                        one on the command line (you must still specify
                        something as target name)
  -port [destination port]
                        Destination port to connect to SMB Server

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful when proxying through
                        ntlmrelayx)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters.
                        If valid credentials cannot be found, it will use the ones specified in the command line
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target
                        parameter
  -target-ip ip address
                        IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful
                        when target is the NetBIOS name or Kerberos name and you cannot resolve it

krbrelayx.py

Esta ferramenta tem múltiplas opções de uso:

• Retransmissão Kerberos: Quando nenhuma credencial é fornecida, mas pelo menos um alvo é especificado, o krbrelayx encaminhará a autenticação Kerberos para um hostname de destino correspondente, retransmitindo efetivamente a autenticação. Como obter autenticação Kerberos de entrada com um SPN válido é com você, mas você pode usar o mitm6 para isso.
• Abuso de delegação não restrita: Neste modo, o krbrelayx descriptografará e despejará os TGTs recebidos embutidos na autenticação com delegação não restrita, ou usará imediatamente os TGTs para autenticar em um serviço de destino. Isso requer que as credenciais de uma conta com delegação não restrita sejam especificadas.

usage: krbrelayx.py [-h] [-debug] [-t TARGET] [-tf TARGETSFILE] [-w] [-ip INTERFACE_IP] [-r SMBSERVER] [-l LOOTDIR]
                    [-f {ccache,kirbi}] [-codec CODEC] [-no-smb2support] [-wh WPAD_HOST] [-wa WPAD_AUTH_NUM] [-6] [-p PASSWORD]
                    [-hp HEXPASSWORD] [-s USERNAME] [-hashes LMHASH:NTHASH] [-aesKey hex key] [-dc-ip ip address] [-e FILE]
                    [-c COMMAND] [--enum-local-admins] [--no-dump] [--no-da] [--no-acl] [--no-validate-privs]
                    [--escalate-user ESCALATE_USER] [--add-computer] [--delegate-access] [--adcs] [--template TEMPLATE]
                    [-v TARGET]

Kerberos relay and unconstrained delegation abuse tool. By @_dirkjan / dirkjanm.io