o j"~@sddlZddlZddlZddlmZmZddlmZddlm Z ddl m Z ddl m Z ddlmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZmZm Z m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)ddl*m+Z+m,Z,dd l-m.Z.m/Z/m0Z0m1Z1dd l2m3Z3m4Z4m5Z5m6Z6dd l7m8Z8dd l9m:Z:m;Z;mZ>dd l?m@Z@ddlAmBZBddlCmDZDddlEmFZFddlGmHZHddlGmIZIGdddZJdS)N)ListDict)hashlib)logger)CCACHE)KerberosClientSocket) METHOD_DATA ETYPE_INFO ETYPE_INFO2 PADATA_TYPEPA_PAC_REQUEST PA_ENC_TS_ENC EncryptedData krb5_pvno KDC_REQ_BODYAS_REQTGS_REP KDCOptions PrincipalName EncASRepPart EncTGSRepPartrRealmChecksum APOptions AuthenticatorTicketAP_REQTGS_REQ CKSUMTYPEPA_FOR_USER_ENCPA_PAC_OPTIONSPA_PAC_OPTIONSTypes EncTicketPart)KerberosErrorCode KerberosError)Key_enctype_table_HMACMD5Enctype) PaDataTypeEncryptionType NAME_TYPE MESSAGE_TYPE)AuthenticatorChecksum)PKAuthenticatorAuthPack PA_PK_AS_REP KDCDHKeyInfo PA_PK_AS_REQ)KerberosCredential)KerberosTarget) KerberosSPN)construct_apreq_from_tgs_tgt)cms)corec@sPeZdZdedefddZgddddddfd eed ed e fd d Z gddfd ed e fddZ gddfd efddZ ddZ ddZddgdddfded efddZdefddZd.ddZgdejejejejejejejgfd d!Zdgd"ejejejgfd#d$Zejejejgfd%d&Zdd'gdfd(d)Zd*d+Zd,d-Z dS)/ KerbrosClientccredtargetcCsj||_||_t|j|_|jdurtn|j|_d|_d|_d|_d|_ d|_ d|_ d|_ d|_ d|_dS)N) credentialr;rksocccacherkerberos_session_key kerberos_TGTkerberos_TGT_encpart kerberos_TGSkerberos_cipherkerberos_cipher_type kerberos_key server_salt pkinit_tkey)selfr:r;rI/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/client.py__init__s  zKerbrosClient.__init__) forwardable renewable proxiableNFTkdcoptswith_pacreturncCs$tdg}|dur$i} ttd| d<tddi| d<|| td|jtj tj j } |dur|durnt | j d d | jd } t|j|_|j|_t|jj|jj||jd |_|j|jd | d} n|} |} i} ttd| d<t|j| d| d<|| i}tt||d<ttjj|jj !dd|d<|jj"#|d<ttjjd|jj"#gd|d<| tj$d dj d d |d<| tj$d dj d d |d<t%&d|d<|jg|d<|dur|D]}||||<qi}t'|d<t(j)j|d<||d<t*||d <t+|S)!Nz'Constructing TGT request with auth dataTPA-PAC-REQUEST padata-type include-pac padata-valuez$Selecting common encryption type: %sFr microsecond) patimestamppausec)saltz ENC-TIMESTAMPetypecipher kdc-options/z name-typez name-stringcnamerealmkrbtgtsnamedaystillrtimenoncer]pvnomsg-typepadatareq-body),rdebugintr r dumpappendnamedatetimenowtimezoneutcr replacerWr&valuerCrDr%enctyper<get_key_for_enctyperFrEencryptrrsetrr+ PRINCIPALusernamesplitdomainupper timedeltasecretsrandbitsrr, KRB_AS_REQrr)rHsupported_encryption_methodrO enctimestampnewnow no_preauthkdc_req_body_extrarPpadatas pa_data_1rv timestamp enc_timestamp pa_data_2 kdc_req_bodykeykdc_reqrIrIrJbuild_asreq_lts.sP     "   zKerbrosClient.build_asreq_lts)rLrMz renewable-okcCsddlm}|jdkrtdtjtjj}i}tt ||d<t t j j|j jdd|d<|j j|d <t t jjd |j jgd|d <|tjd d jdd|d<|tjd d jdd|d<td|d<|jg|d<t|}t|}i} |j| d<|jdd| d<td| d<|| d<i} |j jj| d<|j jj| d<d| d<i} d| d<| | | d<i} |!| | d<|j j"| d<i} t#| | d<|$| | d<|j jj%| d <t&| } |j j'| d!d"}t(}||d#<g}|d!uri}t)t*d$|d%<t+d&d!i|d'<|,|i}t-j.j|d%<||d'<|,|i}d(|d)<d*|d+<||d,<||d-<t/|S).Nr)keysz5RC4 encryption is not supported for certificate auth!r_r`rarbrcrdrer[rfrVrhrirjrkr]cusecctime paChecksumpgqz1.2.840.10046.2.1 algorithm parameters public_keypkAuthenticatorclientPublicValue clientDHNonceT) wrap_signedsignedAuthPackrRrSrTrUrl rmrnro)0 asn1cryptorrz Exceptionrurvrwrxrr~rr+rr<rrrrSRV_INSTrryrrrrsha1rrdigestrWdhparamsrrDomainParametersPublicKeyAlgorithmget_public_keyr. PublicKeyInfodh_noncer/ sign_authpackr2rqr r rsr) PK_AS_REQr)rHrrOrPrrvkdc_req_body_datarchecksum authenticatordppkaspkiauthpacksigned_authpackpayloadr pa_data_0rasreqrIrIrJbuild_asreq_pkinitbsl   "        z KerbrosClient.build_asreq_pkinitcCs`|jjdur|j|||d}n|j|||d}td|j|}|j dkr.t |d|S)N)rPzSending TGT request to server KRB_ERRORzPreauth failed!) r< certificaterrrrpr=sendrecvrrrtr$)rHrrOrPreqreprIrIrJ do_preauths    zKerbrosClient.do_preauthc CszA|jdur td|j|jj|jj|jj\}}}|dur!|||_|d|_t |d|d|_ t |d|_ |d|_ WdStyW}z d|fWYd}~Sd}~ww)NNo CCACHE file foundenc-partkeytypekeyvalue)TN)r>rget_tgtr<rrccache_spn_strict_checkr@rAr%r?r&rCrD)rHtgt keystructerrerIrIrJtgt_from_ccaches  "  zKerbrosClient.tgt_from_ccachec Cst}t|djD]K}t|d}|tjks|tjkrW|tjkr+t|d}n |tjkr7t|d}|jD]}|d|t|d<t dt|dj |dfq:q |j |}||vrftd||}|durr|}||_|S)Nze-datarSrUrZr]z/Server supports encryption type %s with salt %sz,Preferred enc type not in supported enctypes) collections OrderedDictrloadnativer)r r r*rrprtr<get_preferred_enctyperencoderF) rHrsupp_enc_methods enc_method data_type enc_info_listenc_infopreferred_enc_typerZrIrIrJ"select_preferred_encryption_methods(    " z0KerbrosClient.select_preferred_encryption_methodoverride_snamec Cs|\}}|dur dStdtjtjj}i} tt|| d<t t j j |j jdd| d<|j j| d<|durQt t j j d|j jgd| d <n t t jj |d| d <|tjd d jd d | d<|tjd d jd d | d<td| d<|dur|j | d<n|| d<i} |durttd| d<tddi| d<i} t| d<tjj | d<t | d kr| g| d<t!| | d<t"| } td|j#$|j#j%| dd} | j&dkr| j'} | |_(|dks|j j)dur| St*| d d|_+| d d|_,t-|j+j.|j /t0| d d|_1n+| j'd!t2j3j kr't4| | j'} td"|5| }|6|} td#| j'} | |_(|j j7durl|8| \|_9|_:|_+|j |_,|j;j<|j(|j9dd$td%dS| d d&}|j+=|j1d'|}z t>?|j'|_9Wn6t@y}z)td(z tA?|j'|_9Wnt@y}ztBd)|d}~wwWYd}~nd}~wwt-|j+j.|j9d*d+|_:|j;j<|j(|j9dd$td%dS),aJ decrypt_tgt: used for asreproast attacks Steps performed: 1. Send and empty (no encrypted timestamp) AS_REQ with all the encryption types we support 2. Depending on the response (either error or AS_REP with TGT) we either send another AS_REQ with the encrypted data or return the TGT (or fail miserably) 3. PROFIT Nz2Generating initial TGT without authentication datar_r`rarbrcrdrer[rfrrVrhrirjrkr]TrRrSrTrUrlrmrnrozSending initial TGT to %sF)throwrr error-codez1Got reply from server, asikg to provide auth dataz"Got valid TGT response from server) override_ppz Got valid TGTr^z(EncAsRepPart load failed, is this linux?z+Failed to load decrypted part of the reply!rr)Crrrprurvrwrxrr~rr+rrzr<rrrrrget_principalnamerryrrget_supported_enctypesrqr r rrrr,rlenrrr= get_addr_strrrtrr@ nopreauthr&rCrDr%r{r|r*rEr#KDC_ERR_PREAUTH_REQUIREDr$rrrdecrypt_asrep_certrAr?r>add_tgtdecryptrrrrerror)rHoverride_etype decrypt_tgtrOrrP_rrvrrrrrr cipherTexttemprrIrIrJget_TGTs   $     &          zKerbrosClient.get_TGTspn_userc Csz/|jdur td|j|\}}}|dur|t|d|d}t|j}||d|dfWStyG}z ddd|fWYd}~Sd}~ww)Nrrrr)r>rget_tgsr%rr)rHrtgsrrrrrIrIrJtgs_from_ccacheMs  zKerbrosClient.tgs_from_ccachecCs||\}}}}|dur|||fS|jdur%|\}}|dur%tdtd|tjtj j } i} t t gd| d<|j | d<ttjj|d| d<| tjd d jd d | d <td| d<|rr|| d<n|jdkr}dg| d<n|jg| d<i} t| d<t|jd| d<|jd| d<| j| d<| jd d | d<|rt} d | _d| _i} d| d<| | d<t | | d<d | d<|j!"|j#dt$| %d}i}t|d<t&j'j|d <t(t |d!<t)|jd"|d"<t*|j|d#|d$<i}t+j,j|d%<t-|%|d&<i}t|d<t&j.j|d <|g|d'<t/| |d(<t,|}td)|j01|%}|j2d*kr>t3|d+td,|j4}t56|j!7|j#d-|d.d/j4}t8|d0d1|d0d2}|j9:||td3||_;|||fS)4a Requests a TGS ticket for the specified user. Retruns the TGS ticket, end the decrpyted encTGSRepPart. spn_user: KerberosTarget: the service user you want to get TGS for. override_etype: None or list of etype values (int) Used mostly for kerberoasting, will override the AP_REQ supported etype values (which is derived from the TGT) to be able to recieve whatever tgs tiecket NzNo TGT found in CCACHE!z$Constructing TGS request for user %s)rLrM renewable_ok canonicalizer_rcrarer[rfrrVrhrjrkr]irauthenticator-vnocrealmrbrrsi cksumtypercksumz seq-numberrlrm ap-optionsticketr\rrSrUrnroz"Constructing TGS request to serverrzget_TGS failed!zGot TGS reply, decrypting...rr^rrrzGot valid TGS reply)add_tgsrB)rHrris_linuxr encTGSRepPartrrrrvrauthenticator_dataacchksumauthenticator_data_encap_reqrrrrrIrIrJget_TGS\s~                    "  zKerbrosClient.get_TGS)rLrMrzenc-tkt-in-skeycCs|js td||j|}tjtjj }i}t |d<t |jd|d<|jd|d<|j |d<|j dd|d<|j|jd t|d}i}t |d <tjj|d <tt|d <t|jd |d <t|j|d|d<i}tjj|d<t||d<i} tt|| d<tt j!j|jj"#dd| d<|jj$%| d<|tj&ddj dd| d<t'(d| d<dg| d<t|jd g| d<i} t | d <tj)j| d <|g| d<t*| | d <t| } td!|j+,| } | j-d"krd#} | j.d$d%krd&} t/| | td'| j.}t0t1|d d(d}|d d(d)}|2|jd*|}t34|j.}t54|j2|jd+|d(d)j.}t6|d,d-|d,d.}|j78||td/||||fS)0Nz+[U2U] TGT is not available! Fetching TGT...rrrbrrrVrrrlrmrrr\rrSrUr_r`rarercr[rfrhrjrkrr]additional-ticketsrnroz[U2U] Sending request to serverrz [U2U] failed!rzc[U2U] Failed to get U2U! Error code (16) indicates that delegation is not enabled for this account!z[U2U] Got reply, decrypting...rr^rrrrz[U2U] Got valid TGS reply)9r@rrprr<rrurvrwrxrrrWryrCr}r?rrrr,rrzrr~rrrDr)rrrrr+rrrrrrrrrrr=rrtrr$r&rqrr"rrr%r>r)rHrOrsupp_encrvr rr pa_data_auth krb_tgs_body krb_tgs_reqrreplyemsgrr^ encticketdecdata decticketr rrIrIrJU2Usj               "  zKerbrosClient.U2U)rLrMrcCs|js td||j|}d}tjtjj }i}t |d<t |jd|d<|jd|d<|j |d<|j dd|d <|j|jd t|d } i} t | d <tjj| d <tt| d<t|jd| d<t|j| d| d<i} tjj| d<t| | d<tjjj dddd} | |j!"7} | |j#"7} | |"7} td| $td| t%&|jd| } td| $i}t't(d|d<| |d<i}t)tjj|*d|d<|j#|d <t+||d!<||d"<i}t't,d#|d<t-||d<|d urt.|t/r|g}nt.|t0r|}n |*}n|jj!1d$}i}t2t||d%<t)tj3j|d|d&<|jj#4|d'<|tj5d(d)j dd|d*<t67d+|d,<|jj8g|d-<i}t |d <tj9j|d <| |g|d.<t:||d/<t|}td0|j;<|}|j=d1krd2}|j>d3d4krd5}t?||td6|j>}t@A|jB|jd7|d8d9j>}tC|d:d;|d:d<}|jDE||td=||_F|||fS)>z0 user_to_impersonate : KerberosTarget class z0[S4U2self] TGT is not available! Fetching TGT...KerberosrrrbrrrVrrNrlrmrrr\rrSrUlittleFsignedz4U2self] S4UByteArray: %sz[S4U2self] chksum_data: %sHMAC_MD5rrrauserName userRealmrz auth-packagez PA-FOR-USERr`r_rercr[rfrhrjrkr]rnroz$[S4U2self] Sending request to serverrzS4U2self failed!rrzlS4U2self: Failed to get S4U2self! Error code (16) indicates that delegation is not enabled for this account!z#[S4U2self] Got reply, decrypting...rrr^rrrz[S4U2self] Got valid TGS reply)Gr@rrprr<rrurvrwrxrrrWryrCr}r?rrrr,rrzrr~rrrDr)rrr+rrrrrhexr'rrqrrrrr r isinstancestrlistrrUNKNOWNrrrrr{rrr=rrtrr$rrrr%r>rrB)rHuser_to_impersonaterrOrrauth_package_namervr rrr S4UByteArray chksum_datar pa_for_user_enc pa_for_userrrrrrrr rrIrIrJS4U2selfs                   "  zKerbrosClient.S4U2selfcCstdd|tjtjj}|j |}i}t t d|d<t dt tdgi|d<i}t|d<t|jd |d <|jd |d <|j|d <|jd d |d<|j|jdt|d}i} t| d<tjj| d<tt| d<t|jd| d<t|j|d| d<i} t j!j| d<t"| | d<i} t#tgd| d<t$t%j&j|d| d<|jj'(| d<|tj)ddjd d | d<t*+d| d<|jj,g| d <|g| d!<i} t| d<tj-j| d<| |g| d"<t.| | d#<t!| } |j/0| }|j1d$krd%}|j2d&d'krd(}t3||td)|j2}t45|j6|jd*|d+d,j2}t7|d-d.|d-d/}|j89||td0|||fS)1Nz[S4U2proxy] Impersonating %sr`zPA-PAC-OPTIONSrSrzz%resource-based constrained delegationrUrrrbrrrVrrrlrmrrr\r)rLrMzconstrained-delegationrr_rarercr[rfrhrjrkr]rrnrorzS4U2proxy failed!rrznS4U2proxy: Failed to get S4U2proxy! Error code (16) indicates that delegation is not enabled for this account!z+[S4U2proxy] Got server reply, decrypting...rrr^rrrz[S4U2proxy] Got valid TGS reply):rrpjoinrrurvrwrxr<rrqr r r!r~rrrrr@rWryrCr}r?rr,rrzrrrrDr)rrrrr+rrrrrrr{rrr=rrtrr$rrrr%r>r)rHs4uself_ticketrrrvr pa_pac_optsr rr pa_tgs_reqrrrrrrr rrIrIrJ S4U2proxyxsb           "  zKerbrosClient.S4U2proxyrc Cst|||j||||dS)N)r seq_numberap_optscb_data)r6r@)rHrr  sessionkeyrr8r9r:rIrIrJconstruct_apreqszKerbrosClient.construct_apreqcCs ||\}}}||d|S)Nr)r2r7)rH target_user service_spnrr rrIrIrJgetSTszKerbrosClient.getSTcCsdd}|dD]}|ddkrt|dj}nqtdz tj|dj}Wntj|dd dj}Y|d }|d d krJtd t|dj}tddgdd|dDd}tj t |d ddddd}|j j|} |d} | |j jj| } |dd} t| } | tjkr|| d|_n| tjkr|| d|_n | tjkrtdt| j|j}|dd}| |d |}t|j}tt|d!d"} t| j|d!d#}||| fS)$NcSs~d}d}t||kr=tt|g|}t|t||kr/||d|t|7} |S||7}|d7}t||ks |S)Nrr[)rrrbytesr)rzkeysizeoutput currentNum currentDigestrIrIrJ truncate_keys  z6KerbrosClient.decrypt_asrep_cert..truncate_keyrnrSr#rUzPA_PK_AS_REP not found! dhSignedDataencap_content_info content_typez1.3.6.1.5.2.3.2z%Keyinfo content type unexpected valuecontent1cSsg|]}t|qSrI)r)).0xrIrIrJ sz4KerbrosClient.decrypt_asrep_cert..subjectPublicKeyrrbigFr! serverDHNoncerr] rzBRC4 key truncation documentation missing. it is different from AESr^rrrr)r0rrrr7 SignedDatar1rqr3 from_bytesr8 BitStringrrr<rexchangerr&r(AES256rGAES128RC4NotImplementedErrorr%r{rr)rHas_reprFpapkasrepsdkeyinfoauthdatapubkey shared_key server_noncefullKeyr]r^renc_datadec_dataencasrep session_keyrIrIrJrsF  $&       z KerbrosClient.decrypt_asrep_cert)NF)!__name__ __module__ __qualname__r3r4rKrr)boolrrrrrrr5rrrr* DES_CBC_CRC DES_CBC_MD4 DES_CBC_MD5 DES3_CBC_SHA1ARCFOUR_HMAC_MD5AES256_CTS_HMAC_SHA1_96AES128_CTS_HMAC_SHA1_96rr2r7r<r?rrIrIrIrJr9s ,4K "g .` JrF r9)Krrurtypingrr unicryptor minikerberosrminikerberos.common.ccacher!minikerberos.network.clientsocketr"minikerberos.protocol.asn1_structsrr r r r r rrrrrrrrrrrrrrrrrrr r!r"minikerberos.protocol.errorsr#r$ minikerberos.protocol.encryptionr%r&r'r(minikerberos.protocol.constantsr)r*r+r, minikerberos.protocol.structuresr-minikerberos.protocol.rfc4556r.r/r0r1r2minikerberos.common.credsr3minikerberos.common.targetr4minikerberos.common.spnr5!minikerberos.protocol.ticketutilsr6rr7r8r9rIrIrIrJs*    x