o jG@sddlZddlZddlZddlZddlZddlmZddlZddlm Z ddl m Z ddl m Z ddlmZddlmZmZmZmZmZmZmZmZmZmZmZmZmZddlmZm Z m!Z!dd l"m#Z#dd l$m%Z%dd l&m'Z' Gd d d Z(dddZ)dddZ*dS)N)logger) print_table)KRB_CRED)filetime_to_dt)geterr) get_TGSget_TGTgenerate_targetsbrute asreproastspnroasts4uprocess_keytab list_ccache del_ccache roast_ccacheccache_to_kirbikirbi_to_ccache) parse_kirbi format_kirbi print_kirbi)LDAPConnectionFactory) KerberosSPN)KerberosCredentialc@s@eZdZddZeddZddZddZd d Zd d Z d S)KerberosCMDHelpercCsdg|_dg|_dS)Nkerberos) live_keywordskeywords)selfr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/pypykatz/kerberos/cmdhelper.py__init__$s zKerberosCMDHelper.__init__cCs |ddur t|d}t|S)N0xT) startswithint)luidrrr luid_converter(s z KerberosCMDHelper.luid_converterc Cstjdd}|jdd}d|_d|_|jddd}|jdd d}|jd d d d|jd dd}|jddd|jd d dd|jddd}|jddd|jd d dd|jddd}|jddd|jddd} |jddd} | jddd| jd ddd|jd d!d} | jddd|jd"d#|gd$tjdd} | jd%d} d| _d&| _| jd'd(d}|jd)d*d| jd+d,d}|jd)d*d|jd-td.d/| jdd0d}|jd)d*d|jd d d d| jd1d2d}|jd)d*d|jd3d4d| jd5d6d}|jd)d*d|jd7d8dtjdd}|jd9d}d|_d:|_|jd;d|_|jd d?d}|jd@dAd|jd d dBd|jdCdDtddEdF|jdGdHd}|jd@dId|jdJdd|jd d dBd|jdCdDtddEdF|jdKdLd}|jdMdNdOd|jd d dPd|jdQdRdSdTdU|jdVdWd|jdXdYdZd[|jd\d\d}|jd]d^d_d|jdMdNdOd|jdCdDtd`dEdF|jd d dad|jdVdWd|jdbdcdYdZd[|jddded}|jd]d^d_d|jdMdNdOd|jdCdDtd`dEdF|jd d dad|jd@dfd|jdbdcdYdZd[|jdgdhd}|jd@dId|jdJdd|jdidjd|jd d dBd|jdkdld}|jdmdId|jdndo| gd$}|jdpdq|gd$}dS)rNF)add_helplive_kerberos_module)helpT currentluidz'Prints out the LUID of the current userroastz)Automatically run spnroast and asreproastz-oz --out-filez1Output file to store hashcat formatted tickets intgtzTRequest a TGT ticket. It may work better specifying the target as cifs/z--targetz3SPN string of the service to request the ticket forzOutput ccache file nameapreqz*Request a APREQ ticket for a given servicetargetpurgez4Purge all tickets. For the current user use --luid 0z--luidzQLUID of the user whose tickets to be purged. Use "0x" if you specify a hex value!sessionsz.List user sessions. Needs elevated privileges.dumpzjFetches tickets for a given session or all sessions from memory and prints or exports them as .kirbi fileszSLUID of the user whose tickets to be exported. Use "0x" if you specify a hex value!z--outdirzpath to kirbi directorytriagez0List tickets for a given session or all sessionsrzKerberos related commands)r*parentsccache_command ccache_modulelistzList ccache file contents ccachefilezpath to CCACHE filedelz]Delete tickets from ccache file based on their order. To get the order user the list command.indexzticket index to delete)typer*z2Convert stored tickets to hashcat crackable format loadkirbizAdd kirbi file to ccache file. kirbifilezpath to kirbi file / directory exportkirbiz3Export tickets to kirbi files. One ticket per file.kirbidirzpath to kirbi directory kirbi_command kirbi_moduleparsez$Parse kirbi file and show the ticketzpath to kirbi filekerberos_modulezFetches a TGT for a given userurlz`user credentials in URL format. Example: "kerberos+password://TEST\victim:Passw0rd!1@10.10.10.2"z/Output file to store the TGT in. CCACHE format.z-ez--etypezEncryption type to be requested)r;defaultr*tgsz&Fetches a TGS for a given service/userzuser credentials in URL formatspnr zBruteforcing usernamesz-dz--domainzTDomain name (realm). This overrides any other domain spec that the users might have.z)Output file to store the found usernames.z-nz--show-negatives store_truezPrint failed enumerations)actionr*addresszKerberos server IP/hostnametargets*zusername or file with usernames(one per line). Must be in username@domain format, unless you specified --domain then only the username is needed.You can specify mutliple usernames or files separated by space)nargsr*r z-lz--ldapz5LDAP URL. Load targets via LDAP connection to the DC.z=Output file to store the tickets in hashcat crackable format.z-tz --targetsr zkerberoast/spnroastz'user credentials in Kerberos URL formatr z1Gets an S4U2proxy ticket impersonating given user targetuserkeytabz%Parse keytab file, list secret key(s) keytabfileccachezParse/Edit ccache filekirbizParse/Edit kirbi file)argparseArgumentParseradd_subparsersrequireddest add_parser add_argumentr%) rparser live_parserlive_subcommand_parserlive_kerberos_subparserslive_luid_parserlive_roast_parserlive_tgs_parserlive_purge_parserlive_sessions_parserlive_export_parserlive_triage_parserccache_subcommand_parserkerberos_ccache_subparsers ccache_list ccache_del ccache_roast ccache_kirbikirbi_subcommand_parserkerberos_kirbi_subparsers kirbi_listkerberos_groupkerberos_subparsers tgt_parser tgs_parser brute_parserasreproast_parserspnroast_parser s4u_parser keytab_parser ccache_parser kirbi_parserrrr add_args.s      zKerberosCMDHelper.add_argscCsbt|jdkr|j|jvr||t|jdkr+|jdkr-|j|jvr/||dSdSdSdS)Nrlive)lenrcommandrunrmodulerun_live)rargsrrr executes  $ zKerberosCMDHelper.executecCs&tdkr tddSddlm}m}|}|jdkrGt||j \}}}|dur5tdt |dS|j durC|D]}t|q|jdkrItt|j|jd\}}|durtd|dS|jdurCt|jd}| | WddS1sr<rTrB)+rCrrrrDrrrrrr2rrrGr rKdomainr rJshow_negativesrldapget_ldap_kerberos_targetsr Exceptionr r rOrrRr6rr8rrr:rr?rrTrArr=) rrrTrrrF encTGSRepPartkey target_spnsrrrr rs   "  $  "           "  $          zKerberosCMDHelper.runN) __name__ __module__ __qualname__r! staticmethodr'r{rrrrrrr r#s y jrntlmcCs>ddlm}|}|d}|dur|}d||d|d|fS)Nr)get_logon_info logonserverzldap+sspi-%s://%s\%s@%srusername)winacl.functions.highlevelr) authmethodhostrinforrrr get_ldap_urlps rallc s|dkr t||d}t|}|}|IdH\}}|dur#||jjdddd}g} g} |dks;|dkr^|2z3dHW\} }|durM|t } | j | _ || _ | | q?6|d ksf|dkr|2z3dHW\} }|durx|t} | j | _ || _ | | qj6| | fS) Nauto)rrzDC=rP,.rrrG)rrfrom_url get_clientconnect _ldapinfodistinguishedNamereplaceget_all_knoreq_usersrsAMAccountNamerrrget_all_service_usersr) ldap_urlrrr msldap_urlclientrrr spn_users asrep_usersusercredrrr rzs<      r)rN)rrN)+rrrrUrpypykatzr tracebackminikerberos.common.utilsr"minikerberos.protocol.asn1_structsrpypykatz.commons.filetimerpypykatz.commons.commonrpypykatz.kerberos.kerberosrrr r r r r rrrrrrpypykatz.kerberos.kirbiutilsrrrmsldap.commons.factoryrminikerberos.common.spnrminikerberos.common.credsrrrrrrrr s,     <    O