The build-number table is plain data. smb3structs only depends on
impacket.structure, so code that only needs the table no longer loads
the SMB3 client. smb3 star-imports smb3structs, so
impacket.smb3.WIN_VERSIONS keeps working.
Co-authored-by: mpgn <[email protected]>
* Wait for RemoteRegistry to be running instead of sleeping 1 second
After starting a stopped or disabled RemoteRegistry service,
RemoteOperations.__checkServiceStatus() in secretsdump.py and
regsecrets.py slept a fixed second before connecting to winreg. Poll
hRQueryServiceStatus() every 0.1 s until the service reports
SERVICE_RUNNING instead, for at most 50 tries (about 5 s). After that,
the winreg connect is attempted as before.
The wait is still needed because StartService can return while the
service is START_PENDING, and __connectWinReg() does not retry. On
Windows Server 2019 the first poll already returns SERVICE_RUNNING, so
enableRegistry() drops from about 1.15 s to 0.15 s.
* Cap the RemoteRegistry wait by elapsed time and warn on timeout
The 50-try cap did not count the time each hRQueryServiceStatus() call
takes, so a slow link could stretch the wait well past 5 seconds (15 s
with a 200 ms round trip). Stop once 5 seconds have elapsed, and log a
warning when the service is still not running before connecting to
winreg.
---------
Co-authored-by: mpgn <[email protected]>
* fix(kerberos): support inter-realm (referral) TGT from a ccache
* krb5/ccache: make the inter-realm TGT selection deterministic
* fix(krb5): normalize SPN hosts for referral selection
---------
Co-authored-by: Kali <[email protected]>
* Add SMB signing bypass to ntlmrelayx (cross-user re-authentication)
* Add LDAP signing bypass to ntlmrelayx
* Support anonymous session for the LDAP signing bypass
* Add --delegate-target option for RBCD
* Document LDAP bypass port limitation
* Point the shadow credentials output at getTGT.py for PKINIT
---------
Co-authored-by: Kali <[email protected]>
* Add a PKINIT client implementing RFC 4556, RFC 5349 and RFC 4557
* Fix DiffieHellman ignoring an explicitly supplied generator
* Send paChecksum2 so KDCs with SHA-1 disabled accept the AS-REQ
* Support the RFC 8070 PKINIT freshness extension
* Report a wrong PFX password as such instead of blaming legacy algorithms
* Point the shadow credentials attack at getTGT.py for the TGT
* Validate the KDC path when -ca-cert holds a DER certificate
* Fix PKINIT parsing of oversized ASN.1 lengths
* Fix RSA PKINIT interoperability with Windows
* Fix PKINIT certificate issuer selection
---------
Co-authored-by: Kali <[email protected]>
IP.load_header() did not check the length octet of an option other than
EOL and NOP. A length of 0 left the remaining option bytes unchanged, so
the loop never ended, and decoding the packet hung. This also happens
for an ICMP destination unreachable message that quotes such a header,
since ICMPDecoder decodes the quoted IP header.
Raise ImpactPacketException for a length below 2, as TCP.load_header()
already does for TCP options.
Fixes#990
Co-authored-by: ybai08 <[email protected]>
IP.get_packet() extended the array returned by get_bytes(), which is the
header's own buffer, with the options and padding. Every call after the
first one added the options again, so the serialized header grew and
ip_hl no longer matched the header that was sent.
Build the options in a separate buffer instead, and set ip_hl and the
checksum before joining it to a copy of the header.
Fixes#504
Co-authored-by: ybai08 <[email protected]>
* feat(epm): add optional connection timeout to hept_map
* fix(changepasswd): consistent connect logging and timeout across all protocols
* fix(changepasswd): reject zero and negative -timeout values
* fix(changepasswd): default -timeout to 30s and clarify it is a connection timeout
* test(changepasswd): verify -timeout propagation across all protocols
Every relay server calls TargetsProcessor.reloadTargets(full_reload=True)
when --keep-relaying is active and all targets have been attacked once,
so the same targets can be re-attacked. That call wipes finishedAttacks
(and failedAttacks) entirely - which is correct for its actual purpose
(excluding already-attacked targets from generalCandidates/namedCandidates)
but also destroys the only record the finished_attacks socks command reads
from, so it shows only attacks completed since the last reload instead of
the full session history (#2028).
Add allFinishedAttacks, a persistent list appended to alongside
finishedAttacks in registerTarget() but never cleared by reloadTargets(),
and point do_finished_attacks() at it instead. finishedAttacks/failedAttacks
and the exclusion logic that depends on them being clearable are untouched.
Fixes#2028.
Co-authored-by: Claude Sonnet 5 <[email protected]>
* Fix SMB server file jail path validation
* Test SMB1 set path information file jail
* Honor read-only shares in SMB1 path metadata updates
Return STATUS_ACCESS_DENIED for TRANS2_SET_PATH_INFORMATION on read-only shares after validating path containment.
Validated with the SMB server suite (84 passed, 8 skipped) and 143 local functional checks using Impacket and Samba clients.
---------
Co-authored-by: Kali <[email protected]>
* Add AD CS CES relay support to ntlmrelayx
* Remove CES startup preflight
* Validate CES endpoint after authentication is received
* Simplify CES integration using ntlmrelayx infrastructure
* Share AD CS template selection with CES
* Keep CES helpers with HTTP attack
* Use generic target handling for CES
* Fix --template description
* Require explicit CES template selection
---------
Co-authored-by: pavi6 <pavi6@krokodil>
Co-authored-by: Gabi Gonzalez <[email protected]>
* Allow service account parsing with local secretsdump
* Implement requested changes
* Improve printSecret of Secretsdump when used with -history switch
* Add test and test data for LocalService local decryption
* Fix bug with -history and secretsdump remote local service
* test: cover local service secret edge cases
* test: align mock import with master
* Fix empty remote service account fallback
---------
Co-authored-by: Kali <[email protected]>
* Join TDS packet data once instead of copying it with each packet
Clean Up Loop
* Test TDS receive reassembly across multiple packets
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* Add Schannel authentication via TLS client certificate
* add PKCS#12 input and verify the Schannel certificate mapping
* propagate whoami failures and support DER certificate files
* Optimize TDS send performance
use memoryview for payload
packetID cannot be larger than 256 and wraps around
* test(tds): cover send framing boundaries and packet ID rollover
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* Add LSA dump to ntlmrelayx
* Gated SMB LSA dump beind --dump-lsa
* Keep SAM and LSA extraction independent so a SAM failure does not prevent a requested LSA dump.
Attempt SAM, SECURITY, and RemoteOperations cleanup independently to ensure RemoteRegistry restoration is still attempted after errors.
Move --dump-lsa into the SMB client options group and clarify that LSA secret extraction is opt-in.
---------
Co-authored-by: Kali <[email protected]>
* Fix some SMB relay server syntax error
* Added MS-FSRVP, 2 new calls to SCMR
* Remove wrong email
* added tests for MS-FSRVP
* fix some errors with vairable typing
* Added remote mark for test FSRVP
* Fix FSRVP type hints for Python 3.9
* Add offline NDR tests for FSRVP and SCMR
* Expand FSRVP and SCMR remote tests and skip unsupported methods
* Fix SCMR service creation response tag pointer types
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* created test case file to test spnego/negoex integration and added spengo helper functions
* added getNegoExMessages() function
Added the getNegoExMessages() function to both the init and response classes
* Implement NEGOEX / PKU2U authentication check
Raise NotImplementedError in smb3.py if NEGOEX is selected instead of parsing as NTLM messages
* Raise ldapsession error if ldap server picks NEGOEX
Raise LDAPSessionError for unsupported NEGOEX/PKU2U authentication instead of parsing it as a type2 NTLM message.
Unsure as to using LDAPSessionError or using the NotImplementedError like in smb3.py
* smb.py: Raise NotImplementedError if NEGOEX is selected
* smbserver.py: log for when NEGOEX is offered to us by the client
* Log NEGOEX/PKU2U in smb2 handler
Log a message when NEGOEX/PKU2U authentication is offered by the client, indicating it is not supported for relay, during the SMB2/3 handler section
* wcfrelayserver.py: log if NEGOEX/PKU2U is currently offered
Log a message when NEGOEX/PKU2U authentication is offered by the client, which is not currently supported
* Added NEGOEX check in SPNEGO unwrapping
within the auth-phase SPNEGO unwrap, I inserted a NEGOEX check.
Note I am Unsure if this appropriate for the context or correct placement so a check is appreciated
* socksplugins/smb.py: Detect NEGOEX selection/offering
Log in the SMB1 and SMB2/3 handlers if we have NEGOEX being offered or/and selected.
* Handle NEGOEX/PKU2U authentication in sendAuth
Add check for NEGOEX/PKU2U authentication support in sendAuth method.
* ldaprelayclient.py: Handle NEGOEX/PKU2U relay support in sendAuth
Add check for NEGOEX/PKU2U authentication support in sendAuth method.
* smtprelayclient.py: Handle NEGOEX/PKU2U authentication in sendAuth
Added check for NEGOEX/PKU2U authentication support in sendAuth method.
* imaprelayclient.py: Handle NEGOEX/PKU2U authentication in sendAuth
Added a check for NEGOEX/PKU2U authentication and raised an exception if unsupported.
* rpcrelayclient.py: Handle unsupported NEGOEX/PKU2U authentication
Added check for NEGOEX/PKU2U authentication in sendAuth method.
* mssqlrelayclient.py: added NEGOEX check
* winrmrelayclient.py: log NEGOEX
* Update dcsyncclient.py
* smbrelayclient.py: Add NEGOEX/PKU2U relay support check in SMB1 and smb2
* import log
* Added lazy import as well as made SPNEGO NegTokenInit parsing to be lil more conservative/strict
* Implemented smb handlers, kerberos checking in DCERPC helpers and finally added relevant testcases to ensure the correct behavior is observed
* preserve NTLM fallback for non-NTLM SPNEGO offers
* Addressed remaining issues as well as added regression tests
* ntlmrelayx: handle SPNEGO fallback across relay servers
Add shared helpers for inspecting SPNEGO tokens and requesting NTLM when clients prefer an unsupported mechanism such as NEGOEX/PKU2U.\n\nPreserve SPNEGO framing for NTLM challenges across MSSQL, RDP, RPC, SMB, WCF, WinRM, and WinRMS listeners, and add regression coverage for offer, selection, fallback, and challenge handling.
* • Fix MSSQL relay TLS client address logging
---------
Co-authored-by: Kali <[email protected]>
The old ToS byte is now the DiffServ field (RFC 2474/3168), so expose
get/set for the 6 bit DSCP and 2 bit ECN parts, mirroring the traffic
class helpers on IP6. get_ip_tos/set_ip_tos are left untouched.
Closes#211
Co-authored-by: Chris (ChrisJr404) <[email protected]>
* add uint8 in WMI GetObject
* cut the data at the end with numItems
* added testcase for uint8 array retrieval
* fixed test to use __EventFilter builtin class
* fix unnecessary allocation
* change heapData usage
---------
Co-authored-by: Kali <[email protected]>
The "from __future__ import annotations" are the only from __future__ still usefull
with Python3, they stay.
impacket$ git diff | grep annota
from __future__ import annotations
from __future__ import annotations
impacket$
Python throws an error when a call to `__str__` returns something other
than an instance of `str`:
```
>>> from impacket.dcerpc.v5.srvs import SHARE_INFO_1
>>> str(SHARE_INFO_1())
Traceback (most recent call last):
File "<python-input-1>", line 1, in <module>
str(SHARE_INFO_1())
~~~^^^^^^^^^^^^^^^^
TypeError: __str__ returned non-string (type bytes)
```
Wrapped the current result with a call to `hexlify`.
* Fix BootpDecoder crash on plain BOOTP packets without DHCP options
* warn on undersized bootp messages instead of treating them as plain bootp
* actually fix#1900, the reported packet is 235 bytes not 236
* implemented backup and clear
* always list amount of existing keycredentials for target object
* added do_backup_shadow_creads to ldap_shell. Aligned do_clear_shadow_creds by requiring a target per argument
* ldap shell shadow creds operations now report the amount of already existing credentiallinks
* Update typo
Co-authored-by: Gabriel Gonzalez <[email protected]>
* Fix typo
Co-authored-by: Gabriel Gonzalez <[email protected]>
* Centralized backup logic
* use one MODIFY_REPLACE instead of two
* renamed flag
* added restore_shadow_creds command to ldap shell
* fix
---------
Co-authored-by: Gabriel Gonzalez <[email protected]>
