o jy@sHddlmZddlmZddlZddlZddlZddlZddlZddlZddl Z ddl Z ddl m Z ddl mZddlmZddlmZmZmZmZddlmZdd lmZdd lmZdd lmZdd lmZdd l m!Z!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z*m+Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1m2Z2m3Z3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;mZ>m?Z?m@Z@mAZAmBZBmCZCmDZDmEZEmFZFmGZGmHZHmIZIddlJmKZKmLZLmMZMmNZNmOZOddlPmQZQmRZRmSZSmTZTmUZUmVZVmWZWmXZXmYZYmZZZm[Z[m\Z\m]Z]m^Z^m_Z_m`Z`maZambZbddlcmdZdmeZeddlfmgZgddlhmiZiGdddZjddZkeldkr"e mekdSdS))division)print_functionN)timegm)strptime) unhexlify)ListOptionalDictAny)logger)CCACHE) KerberosSPN)KerberosCredential)KerberosTarget)AS_REPTGS_REP ETYPE_INFO2AuthorizationData EncTicketPart EncASRepPart EncTGSRepPartAD_IF_RELEVANT KDC_REQ_BODYAS_REQTGS_REQ PrincipalNameRealmTicketAP_REQ Authenticator EncryptedDataPA_FOR_USER_ENC krb5_pvno KDCOptions APOptions METHOD_DATA ETYPE_INFO PADATA_TYPEPA_PAC_REQUEST PA_ENC_TS_ENCChecksum CKSUMTYPE) ApplicationTagNumbersPreAuthenticationDataTypesEncryptionTypePrincipalNameTypeProtocolVersionNumber TicketFlags ChecksumTypesAuthorizationDataTypeKERB_NON_KERB_CKSUM_SALT NAME_TYPE MESSAGE_TYPE PaDataType)Key_enctype_table_checksum_tableEnctype_HMACMD5)KERB_SID_AND_ATTRIBUTESPAC_SIGNATURE_DATAPAC_INFO_BUFFERPAC_LOGON_INFOPAC_CLIENT_INFO_TYPEPAC_SERVER_CHECKSUMPAC_PRIVSVR_CHECKSUMPACTYPEPKERB_SID_AND_ATTRIBUTES_ARRAYVALIDATION_INFOPAC_CLIENT_INFOKERB_VALIDATION_INFOUPN_DNS_INFO_FULLPAC_REQUESTOR_INFOPAC_UPN_DNS_INFOPAC_ATTRIBUTES_INFO PAC_REQUESTORPAC_ATTRIBUTE_INFO) KerberosTime Principal)AIOKerberosClientSocket)AIOKerberosClientc@seZdZdededefddZeddZedd Zed d Zd d Z ddZ ddZ ddZ eddZ ddZddZddZddZddZd d!Zd"d#Zd$S)%TICKETERtargetpassworddomaincCs||_||_||_||_d|_d|_|jr>|jd}|d|_t |dkr*|dn|d|_ |j dur<| |j dSdSd|_|j|_ dS)N/rkrbtgt) _TICKETER__password_TICKETER__target_TICKETER__domain_TICKETER__options_TICKETER__tgt_TICKETER__tgt_session_keyspnsplit_TICKETER__servicelen_TICKETER__serverkeytabloadKeysFromKeytab)selfrTrUrVoptions spn_partsrj/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/tickettest.py__init__`s    zTICKETER.__init__cCs|d9}|d7}|S)Nil}*{G rj)trjrjrk getFileTimesszTICKETER.getFileTimecCs|ddd|SNrj data_lengthrjrjrk getPadLengthyszTICKETER.getPadLengthcCs|dddSrorjrrrjrjrkgetBlockLength}szTICKETER.getBlockLengthcCstddS)Nz3Keytab loading not yet implemented for minikerberos)loggingwarning)rgfilenamerjrjrkrfs zTICKETER.loadKeysFromKeytabcCst}ttjtjj}||}|d@|dd<|d?|dd<d|dd<d|dd<d|dd<d|dd<|d@|d d<|d?|d d<d |d d<d |d d<d|d d<d|d d<|j|d <d|d<d|d<d|d<d|d<d|d<d|d<d |d<t |j j |d<|j j d}t|d krd|d<nt |d |d<t||d<|D]}qd |d<d|d<d|d<|j|d <d!|d"<d |d#<d |d$d<d |d$d<d |d%d<d |d%d<d |d&<d |d'<d |d(<t}||d)<|S)*Nl LogonTime dwLowDateTime dwHighDateTime LogoffTimei KickOffTimePasswordLastSetrPasswordCanChangePasswordMustChange EffectiveNameFullName LogonScript ProfilePath HomeDirectoryHomeDirectoryDrivei LogonCountBadPasswordCountUserId,iPrimaryGroupId GroupCount UserFlagsUserSessionKey LogonServerLogonDomainNamesLMKey SubAuthStatusLastSuccessfulILogonLastFailedILogonFailedILogonCount Reserved3ResourceGroupCountData)rHrdatetimenowtimezoneutc timetuplernr[intr]user_idgroupsrarcr\upperrF)rgkerbdataaTimeunixTimergroupvalidationInforjrjrkcreateBasicValidationInfos^                 z"TICKETER.createBasicValidationInfocCs@|}i}|||t<t}t}|dddtjjkr7tj j|d<tj j|d<d|d<d|d<n)d|d<d|d<t |j j dkrTtj j|d<tj j|d<n tjj|d<tjj|d<||t<||t<t}|jd |d <t |d |d <||t<|j jr|||j jd ur|||||S) Nticketenc-partetype SignatureTyper Signatures @zutf-16leName NameLengthF)rgetDatagetDataReferentsr@r>r.RC4_HMACvaluer2HMAC_MD5rcr]aesKeyHMAC_SHA1_96_AES256HMAC_SHA1_96_AES128rBrCrGr[encoderA extra_paccreateUpnDnsPacold_paccreateAttributesInfoPaccreateRequestorInfoPac)rgkdcReprpacInfos srvCheckSum privCheckSum clientInforjrjrkcreateBasicPacs:             zTICKETER.createBasicPacc Cst}d|t|}|jd|jd}t||d<t|t||d<|d|d}||}|d|7}|jd}t||d<|||d<|d|d}||}|d|7}d|d <|jd}t||d <|||d <|d |d }||}|d|7}d } t| |d <|||d<|d|d }||}| d|} |||| } ||| |t <dS)N@z utf-16-le UpnLength UpnOffsetDnsDomainNameLengthDnsDomainNameOffsetFlags SamNameLength SamNameOffsets SidLength SidOffset) rIrtrcr[lowerr\rrrrK) rgr upnDnsInfoPAC_padupn_data total_lenpaddns_namesamName user_sid_data user_data post_pac_datarjrjrkr s:                 zTICKETER.createUpnDnsPaccCs&t}d|d<d|d<||t<dS)Nr FlagsLengthrXr)rNrrL)r pacAttributesrjrjrkr2sz TICKETER.createAttributesInfoPaccCst}||t<dSN)rMrrJ)rgr pacRequestorrjrjrkr:szTICKETER.createRequestorInfoPaccCs|jjdur|j|jkrtdntdtddStd|j|jkr3t}tjj |d<n t }tj j |d<d|d <|jj durG |j |d <t tjj |jgd |d <t|d <tjj |d d<|j |d d<t |j|jkr|tjj ntjj |j|j|jkr|j n|jgd |d d<t|d d<d|d dd<t|d<|jj durt|jjdkrtjj |d dd<tjj |dd<n%tjj |d dd<tjj |dd<ntjj |d dd<tjj |dd<d|dd<||}||fS)NTz/Requesting TGT to target domain to use as basisz3Requesting TGT/TGS to target domain to use as basisz:Request functionality not yet implemented for minikerberos)NNz,Creating basic skeleton ticket and PAC Infoszmsg-typepvnocrealmz name-typez name-stringcnamerztkt-vnorealmsnamerrkvnorr)r]requestr\rdrvinfoerrorrr,rrnthashrrr5 PRINCIPALr[rr0rSRV_INSTrbr rcrr.AES256_CTS_HMAC_SHA1_96AES128_CTS_HMAC_SHA1_96rr)rgrrrjrjrkcreateBasicTicketBsR               zTICKETER.createBasicTicketcstddS)Nz?S4U2Self+U2U functionality not yet implemented for minikerberos)NNNN)rvr)rgrjrjrkgetKerberosS4U2SelfU2U}s zTICKETER.getKerberosS4U2SelfU2UcCstd|j|jftjtjjtjt |j j d}|j j r(t ddSt}g}|ddddd |d <|d d tjjkrUd d dtdD|d d<n+|d d tjjkrpd ddtdD|d d<nd ddtdD|d d<|j|d<ttjj|jgd|d<ddd|d<tjtjj}|jdd|d<|jdd|d<||d<||d<g|d<td td!td"|j|jkrt}nt}|d |d <g|d#<d$|d%<||d&<t|d|d<t|d|d<t|d|d<t|d|d<|j|d'<t|j|jkr tjjntjj|j|j|jkr1|jn|jgd|d(<|j|jkrGtd)ntd*|||fS)+NzCustomizing ticket for %s/%s)hourszRSapphire ticket (impersonation) functionality not yet implemented for minikerberos)NNNrrr)keytypekeyvaluekeyrrcSg|]}ttjqSrjrandomchoicestring ascii_letters.0_rjrjrk z,TICKETER.customizeTicket..rcSrrjrrrjrjrkrrr{cSrrjrrrjrjrkrrrrrr)ztr-typecontents transited) microsecondauthtime starttimeendtimez renew-tillzauthorization-dataz PAC_LOGON_INFOz PAC_CLIENT_INFO_TYPEz EncTicketPartzlast-reqi[noncezkey-expirationsrealmrz EncAsRepPartz EncTGSRepPart) rvrr\r[rrrr timedeltarr]duration impersonaterrr.rrjoinrangerrrr5rreplacerdrrstrrrb)rgrrticketDuration encTicketPartflagsr encRepPartrjrjrkcustomizeTicketsh$   ""        "    zTICKETER.customizeTicketcCstdtddS)NzSigning/Encrypting final ticketzLPAC signing and ticket encryption not yet fully implemented for minikerberos)rNN)rvrr)rgrencASorTGSRepPartrrrjrjrksignEncryptTickets  zTICKETER.signEncryptTicketcCs0td|jdddt}tddS)NzSaving ticket in %srW.z.ccachez8CCACHE saving not yet fully implemented for minikerberos)rvrr[rr )rgr sessionKeyccacherjrjrk saveTicketszTICKETER.saveTicketcsf|\}}|dur-|||\}}}|dur/|||||\}}}|r1|||dSdSdSdSr)rrrr)rgr adIfRelevantrrrcipherrrjrjrkruns z TICKETER.runN)__name__ __module__ __qualname__rrl staticmethodrnrtrurfrrrrrrrrrrr!rjrjrjrkrS_s*   Z() ;V rSc stdtjddd}|jdddd|jd dd d|jd d d dd|jddddd|jddddd|jddddd|jdddd|jdddd|jddddd|jd dd!d"d|jd#dd$d|jd%d d&d|jd'd d(d|jd)dd*d+d|jd,d d-d|jd.d d/d|d0}|jd1dd2d|jd3dd4d|jd5dd6d7d|jd8dd9d:d|jd;ddtd?td@tdAtdBtdCtdDtdEtdFtdGtdHt d=| }|j rt j t jdInt j t jdI|jdur%t dJt d=|jdurA|jdurA|jdurAt dKt d=|jdur]|jdur]|jd ur]t dLt d=|jdurs|jdurst dMt d=|jdur|jdur|jdurdNdOlm}|dP}n|j}|jr8g}|jd f|jp|jdQf|jdf|jd1f|d3f|jdf|jd fg}|D] \}}|s||q|rt dRdS|t d=|j s|jst dTt d=g} |j!r| d%|j"dur| d#|j#dur| d|j$dur| d)| r)t dUdS| |j r8|jdur8t dVzt%|j&||j|} | 'IdHWdSt(yv} zt )j*t jkredNdl+} | ,tt-| WYd} ~ dSd} ~ ww)WNzMinikerberos Ticket GeneratorTz>Creates a Kerberos golden/silver tickets based on user options)add_help descriptionrTstorez%username for the newly created ticket)actionhelpz-spnz}SPN (service/server) of the target service the silver ticket will be generated for. if omitted, golden ticket will be createdz-request store_trueFzlRequests ticket to domain and clones it changing only the supplied information. It requires specifying -user)r)defaultr*z-domainz2the fully qualified domain name (e.g. contoso.com))r)requiredr*z -domain-sidz@Domain SID of the target domain the ticker will be generated forz-aesKeyzhex keyz5AES key used for signing the ticket (128 or 256 bits))r)metavarr*z-nthashz#NT hash used for signing the ticketz-keytabz7Read keys for SPN from keytab file (silver ticket only)z-groupsz513, 512, 520, 518, 519zVcomma separated list of groups user will belong to (default = 513, 512, 520, 518, 519)z-user-id500zCuser id for the user the ticket will be created for (default = 500)z -extra-sidzHComma separated list of ExtraSids to be included inside the ticket's PACz -extra-pacz-Populate your ticket with extra PAC (UPN_DNS)z-old-pacz^Use the old PAC structure to create your ticket (exclude PAC_ATTRIBUTES_INFO and PAC_REQUESTORz -duration87600z=Amount of hours till the ticket expires (default = 24*365*10)z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-userzZdomain/username to be used if -request is chosen (it can be different from domain/usernamez -passwordzpassword for domain/usernamez-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-dc-ipz ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz -impersonatezSapphire ticket. target username that will be impersonated (through S4U2Self+U2U) for querying the ST and extracting the PAC, which will be included in the new ticketrXz Examples: zp ./ticketer.py -nthash -domain-sid -domain baduser zd will create and save a golden ticket for user 'baduser' that will be all encrypted/signed used RC4.z^ If you specify -aesKey instead of -ntHash everything will be encrypted using AES128 or AES256zc (depending on the key specified). No traffic is generated against the KDC. Ticket will be saved asz baduser.ccache. z ./ticketer.py -nthash -aesKey -domain-sid -domain -request -user -password baduser z` will first authenticate against the KDC (using -user/-password) and get a TGT that will be usedzc as template for customization. Whatever encryption algorithms used on that ticket will be honored,zf hence you might need to specify both -nthash and -aesKey data. Ticket will be generated for 'baduser'z and saved as baduser.ccache)levelzDomain should be specified!z7You have to specify either aesKey, or nthash, or keytabzMYou cannot specify both -aesKey and -nthash w/o using -request. Pick only onez.-request parameter needs -user to be specifiedr)getpassz Password:z-aesKey or -nthashz+missing parameters to do sapphire ticket : z, z=missing parameter -user-id. Must be set if not doing -old-pacz7doing sapphire ticket, ignoring following parameters : zWparameter -user-id will be ignored when specifying -old-pac in a sapphire ticket attack).printargparseArgumentParser add_argumentadd_argument_grouprcsysargv print_helpexit parse_argsdebugrv basicConfigDEBUGINFOrVcriticalrrrerruserhashesrUr3r domain_sidrappendrrr extra_sidrrrSrTr! Exception getLoggerr2 traceback print_excr) parserrrhr3rUmissing_paramsrequired_paramsparam param_nameignored_paramsexecutererJrjrjrkmains     $  $    $               rT__main__)n __future__rrr5rrvrrstructr9asynciocalendarrtimerbinasciirtypingrrr r minikerberosr minikerberos.common.ccacher minikerberos.common.spnr minikerberos.common.credsrminikerberos.common.targetr"minikerberos.protocol.asn1_structsrrrrrrrrrrrrrrrrr r!r"r#r$r%r&r'r(r)r*r+minikerberos.protocol.constantsr,r-r.r/r0r1r2r3r4r5r6r7 minikerberos.protocol.encryptionr8r9r:r;r<minikerberos.protocol.pacr=r>r?r@rArBrCrDrErFrGrHrIrJrKrLrMrN minikerberos.protocol.structuresrOrP$minikerberos.network.aioclientsocketrQminikerberos.aioclientrRrSrTr"r!rjrjrjrksF 0         x8P  #