Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Patches secretsdump unable to compute Kerberos salt to retrieve AESkeys via Kerberos authentication #3

Merged
merged 2 commits into from
Nov 2, 2023
Merged

Patches secretsdump unable to compute Kerberos salt to retrieve AESkeys via Kerberos authentication #3

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
3af5a04
Update secretsdump.py to support retrival of aesKeys via Kerberos
Dfte Oct 7, 2023
390715c
Update secretsdump.py
Dfte Oct 7, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 20 additions & 13 deletions impacket/examples/secretsdump.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -699,19 +699,26 @@ def getDomainSid(self):
return self.__domainSid

def getMachineKerberosSalt(self):
"""
Returns Kerberos salt for the current connection if
we have the correct information
"""
if self.__smbConnection.getServerName() == '':
# Todo: figure out an RPC call that gives us the domain FQDN
# instead of the NETBIOS name as NetrWkstaGetInfo does
return b''
else:
host = self.__smbConnection.getServerName()
domain = self.__smbConnection.getServerDNSDomainName()
salt = b'%shost%s.%s' % (domain.upper().encode('utf-8'), host.lower().encode('utf-8'), domain.lower().encode('utf-8'))
return salt
"""
Returns Kerberos salt for the current connection if
we have the correct information
"""
# Patched by @Defte_ when using Kerberos, the getServerName function returns nothing
# But we do need the domain FQDN as well as the computer name
if self.__smbConnection.getServerName() == '':
# To do we can request the getMachineNameAndDomain() which returns:
# - The computer name
# - The NETBIOS domain name (not FQDN so we don't need it hence the _)
# Using the getRemoteHost function we can get the DC's FQDN to which we substract the computer name
# Once we have the domain FQDN and the computer name we can compute the Kerberos salt
host, _ = self.getMachineNameAndDomain()
domain = self.__smbConnection.getRemoteHost().split(f"{host.lower()}.")[1]
LOG.debug(f"[Secretsdump][getMachineKerberosSalt] Host: {host} / Domain FQDN: {domain}")
else:
host = self.__smbConnection.getServerName()
domain = self.__smbConnection.getServerDNSDomainName()
salt = b'%shost%s.%s' % (domain.upper().encode('utf-8'), host.lower().encode('utf-8'), domain.lower().encode('utf-8'))
return salt

def getMachineNameAndDomain(self):
if self.__smbConnection.getServerName() == '':
Expand Down