Merge pull request Pennyw0rth#756 from Pennyw0rth/preauth

Author: mpgn

nxc/connection.py

@@ -140,7 +140,7 @@ def __init__(self, args, db, target):
                              self.args.use_kcache or
                              self.args.aesKey or
                              (hasattr(self.args, "delegate") and self.args.delegate) or
-                             (hasattr(self.args, "no_preauth") and self.args.no_preauth))
+                             (hasattr(self.args, "no_preauth_targets") and self.args.no_preauth_targets))
         self.aesKey = None if not self.args.aesKey else self.args.aesKey[0]
         self.use_kcache = None if not self.args.use_kcache else self.args.use_kcache
         self.admin_privs = False

nxc/protocols/ldap.py

@@ -415,7 +415,7 @@ def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="",
                 color="yellow",
             )
             # If no preauth is set, we want to be able to execute commands such as --kerberoasting
-            if self.args.no_preauth:  # noqa: SIM103
+            if self.args.no_preauth_targets:  # noqa: SIM103
                 return True
             else:
                 return False
@@ -990,9 +990,9 @@ def asreproast(self):
                         hash_asreproast.write(f"{hash_TGT}\n")
 
     def kerberoasting(self):
-        if self.args.no_preauth:
+        if self.args.no_preauth_targets:
             usernames = []
-            for item in self.args.no_preauth:
+            for item in self.args.no_preauth_targets:
                 if os.path.isfile(item):
                     with open(item, encoding="utf-8") as f:
                         usernames.extend(line.strip() for line in f if line.strip())

nxc/protocols/ldap/proto_args.py

@@ -13,7 +13,7 @@ def proto_args(parser, parents):
     egroup = ldap_parser.add_argument_group("Retrieve hash on the remote DC", "Options to get hashes from Kerberos")
     egroup.add_argument("--asreproast", help="Output AS_REP response to crack with hashcat to file")
     egroup.add_argument("--kerberoasting", help="Output TGS ticket to crack with hashcat to file")
-    egroup.add_argument("--no-preauth", nargs=1, dest="no_preauth", help="No-preauth user for AS-REQ Kerberoast (use with -u users/SPNs).")
+    egroup.add_argument("--no-preauth-targets", nargs=1, dest="no_preauth_targets", help="Targeted kerberoastable users")
 
     vgroup = ldap_parser.add_argument_group("Retrieve useful information on the domain")
     vgroup.add_argument("--base-dn", metavar="BASE_DN", dest="base_dn", type=str, default=None, help="base DN for search queries")