* fix(kerberos): support inter-realm (referral) TGT from a ccache
* krb5/ccache: make the inter-realm TGT selection deterministic
* fix(krb5): normalize SPN hosts for referral selection
---------
Co-authored-by: Kali <[email protected]>
* Add SMB signing bypass to ntlmrelayx (cross-user re-authentication)
* Add LDAP signing bypass to ntlmrelayx
* Support anonymous session for the LDAP signing bypass
* Add --delegate-target option for RBCD
* Document LDAP bypass port limitation
* Point the shadow credentials output at getTGT.py for PKINIT
---------
Co-authored-by: Kali <[email protected]>
* Add a PKINIT client implementing RFC 4556, RFC 5349 and RFC 4557
* Fix DiffieHellman ignoring an explicitly supplied generator
* Send paChecksum2 so KDCs with SHA-1 disabled accept the AS-REQ
* Support the RFC 8070 PKINIT freshness extension
* Report a wrong PFX password as such instead of blaming legacy algorithms
* Point the shadow credentials attack at getTGT.py for the TGT
* Validate the KDC path when -ca-cert holds a DER certificate
* Fix PKINIT parsing of oversized ASN.1 lengths
* Fix RSA PKINIT interoperability with Windows
* Fix PKINIT certificate issuer selection
---------
Co-authored-by: Kali <[email protected]>
IP.load_header() did not check the length octet of an option other than
EOL and NOP. A length of 0 left the remaining option bytes unchanged, so
the loop never ended, and decoding the packet hung. This also happens
for an ICMP destination unreachable message that quotes such a header,
since ICMPDecoder decodes the quoted IP header.
Raise ImpactPacketException for a length below 2, as TCP.load_header()
already does for TCP options.
Fixes#990
Co-authored-by: ybai08 <[email protected]>
IP.get_packet() extended the array returned by get_bytes(), which is the
header's own buffer, with the options and padding. Every call after the
first one added the options again, so the serialized header grew and
ip_hl no longer matched the header that was sent.
Build the options in a separate buffer instead, and set ip_hl and the
checksum before joining it to a copy of the header.
Fixes#504
Co-authored-by: ybai08 <[email protected]>
* feat(epm): add optional connection timeout to hept_map
* fix(changepasswd): consistent connect logging and timeout across all protocols
* fix(changepasswd): reject zero and negative -timeout values
* fix(changepasswd): default -timeout to 30s and clarify it is a connection timeout
* test(changepasswd): verify -timeout propagation across all protocols
* Fix SMB server file jail path validation
* Test SMB1 set path information file jail
* Honor read-only shares in SMB1 path metadata updates
Return STATUS_ACCESS_DENIED for TRANS2_SET_PATH_INFORMATION on read-only shares after validating path containment.
Validated with the SMB server suite (84 passed, 8 skipped) and 143 local functional checks using Impacket and Samba clients.
---------
Co-authored-by: Kali <[email protected]>
* Add AD CS CES relay support to ntlmrelayx
* Remove CES startup preflight
* Validate CES endpoint after authentication is received
* Simplify CES integration using ntlmrelayx infrastructure
* Share AD CS template selection with CES
* Keep CES helpers with HTTP attack
* Use generic target handling for CES
* Fix --template description
* Require explicit CES template selection
---------
Co-authored-by: pavi6 <pavi6@krokodil>
Co-authored-by: Gabi Gonzalez <[email protected]>
* Allow service account parsing with local secretsdump
* Implement requested changes
* Improve printSecret of Secretsdump when used with -history switch
* Add test and test data for LocalService local decryption
* Fix bug with -history and secretsdump remote local service
* test: cover local service secret edge cases
* test: align mock import with master
* Fix empty remote service account fallback
---------
Co-authored-by: Kali <[email protected]>
* Join TDS packet data once instead of copying it with each packet
Clean Up Loop
* Test TDS receive reassembly across multiple packets
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* Add Schannel authentication via TLS client certificate
* add PKCS#12 input and verify the Schannel certificate mapping
* propagate whoami failures and support DER certificate files
* Optimize TDS send performance
use memoryview for payload
packetID cannot be larger than 256 and wraps around
* test(tds): cover send framing boundaries and packet ID rollover
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* Fix some SMB relay server syntax error
* Added MS-FSRVP, 2 new calls to SCMR
* Remove wrong email
* added tests for MS-FSRVP
* fix some errors with vairable typing
* Added remote mark for test FSRVP
* Fix FSRVP type hints for Python 3.9
* Add offline NDR tests for FSRVP and SCMR
* Expand FSRVP and SCMR remote tests and skip unsupported methods
* Fix SCMR service creation response tag pointer types
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* created test case file to test spnego/negoex integration and added spengo helper functions
* added getNegoExMessages() function
Added the getNegoExMessages() function to both the init and response classes
* Implement NEGOEX / PKU2U authentication check
Raise NotImplementedError in smb3.py if NEGOEX is selected instead of parsing as NTLM messages
* Raise ldapsession error if ldap server picks NEGOEX
Raise LDAPSessionError for unsupported NEGOEX/PKU2U authentication instead of parsing it as a type2 NTLM message.
Unsure as to using LDAPSessionError or using the NotImplementedError like in smb3.py
* smb.py: Raise NotImplementedError if NEGOEX is selected
* smbserver.py: log for when NEGOEX is offered to us by the client
* Log NEGOEX/PKU2U in smb2 handler
Log a message when NEGOEX/PKU2U authentication is offered by the client, indicating it is not supported for relay, during the SMB2/3 handler section
* wcfrelayserver.py: log if NEGOEX/PKU2U is currently offered
Log a message when NEGOEX/PKU2U authentication is offered by the client, which is not currently supported
* Added NEGOEX check in SPNEGO unwrapping
within the auth-phase SPNEGO unwrap, I inserted a NEGOEX check.
Note I am Unsure if this appropriate for the context or correct placement so a check is appreciated
* socksplugins/smb.py: Detect NEGOEX selection/offering
Log in the SMB1 and SMB2/3 handlers if we have NEGOEX being offered or/and selected.
* Handle NEGOEX/PKU2U authentication in sendAuth
Add check for NEGOEX/PKU2U authentication support in sendAuth method.
* ldaprelayclient.py: Handle NEGOEX/PKU2U relay support in sendAuth
Add check for NEGOEX/PKU2U authentication support in sendAuth method.
* smtprelayclient.py: Handle NEGOEX/PKU2U authentication in sendAuth
Added check for NEGOEX/PKU2U authentication support in sendAuth method.
* imaprelayclient.py: Handle NEGOEX/PKU2U authentication in sendAuth
Added a check for NEGOEX/PKU2U authentication and raised an exception if unsupported.
* rpcrelayclient.py: Handle unsupported NEGOEX/PKU2U authentication
Added check for NEGOEX/PKU2U authentication in sendAuth method.
* mssqlrelayclient.py: added NEGOEX check
* winrmrelayclient.py: log NEGOEX
* Update dcsyncclient.py
* smbrelayclient.py: Add NEGOEX/PKU2U relay support check in SMB1 and smb2
* import log
* Added lazy import as well as made SPNEGO NegTokenInit parsing to be lil more conservative/strict
* Implemented smb handlers, kerberos checking in DCERPC helpers and finally added relevant testcases to ensure the correct behavior is observed
* preserve NTLM fallback for non-NTLM SPNEGO offers
* Addressed remaining issues as well as added regression tests
* ntlmrelayx: handle SPNEGO fallback across relay servers
Add shared helpers for inspecting SPNEGO tokens and requesting NTLM when clients prefer an unsupported mechanism such as NEGOEX/PKU2U.\n\nPreserve SPNEGO framing for NTLM challenges across MSSQL, RDP, RPC, SMB, WCF, WinRM, and WinRMS listeners, and add regression coverage for offer, selection, fallback, and challenge handling.
* • Fix MSSQL relay TLS client address logging
---------
Co-authored-by: Kali <[email protected]>
The old ToS byte is now the DiffServ field (RFC 2474/3168), so expose
get/set for the 6 bit DSCP and 2 bit ECN parts, mirroring the traffic
class helpers on IP6. get_ip_tos/set_ip_tos are left untouched.
Closes#211
Co-authored-by: Chris (ChrisJr404) <[email protected]>
* add uint8 in WMI GetObject
* cut the data at the end with numItems
* added testcase for uint8 array retrieval
* fixed test to use __EventFilter builtin class
* fix unnecessary allocation
* change heapData usage
---------
Co-authored-by: Kali <[email protected]>
The "from __future__ import annotations" are the only from __future__ still usefull
with Python3, they stay.
impacket$ git diff | grep annota
from __future__ import annotations
from __future__ import annotations
impacket$
* Fix BootpDecoder crash on plain BOOTP packets without DHCP options
* warn on undersized bootp messages instead of treating them as plain bootp
* actually fix#1900, the reported packet is 235 bytes not 236
* keylistattack: support PAC-hardened DCs
The RODC partial TGT now carries a signed PAC, so patched DCs accept
the KERB-KEY-LIST request. LIST mode gains -domain-sid / username:rid.
* keylistattack: recover keys despite extra PA-DATA
getKey() finds KERB-KEY-LIST-REP by type, not encrypted_pa_data[0].
* keylistattack: warn on placeholder PAC requestor
_createPartialPac() now logs a WARNING naming the user when it falls
back to placeholder RID 1000, so the operator sees the requestor SID
will not match the target and can supply username:rid.
* feat(smbserver): add SMB 3.1.1 support with pre-auth integrity, KBKDF signing, and session encryption
* fix(smbserver): echo request SessionId in SMB2 response headers per MS-SMB2 §3.3.4.1
* refactor(smbserver): drop spec URLs and section numbers from comments
* fix(smbserver): reject unsupported SMB2 dialects instead of defaulting to 2.002
* fix(smbserver): encrypt SMB2 compound responses as a single message
* fix(smbserver): verify SMB2 transform header auth tag before trusting plaintext
* fix(smbserver): source SMB2 transform cipher from connection state, not the packet
* fix(smbserver): use correct SMB2 transform flags constant on the encrypt side
* fix(smbserver): preserve real SessionId in encrypted LOGOFF transform header
* test(smbserver): add SMB 3.1.1 regression tests
* test(smbserver): pin functional suites to legacy dialects
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
* Working tds np
* Print answer
* WORKING POOOOOOOC
* WORKING POOOOOOOC
* WORKING POOOOOOOC
* Removing dupplicated functions
* Removing dupplicate code
* Merged all in one
* Add detection version for MSSQL server 2025
* Switch pipe_name to positional argument to not break other things
* Comply to remoteHost/remoteName for Kerberos auth
* Patch small error
* Preserve MSSQL constructor compatibility
* Default MSSQL named pipe remote host
* Fix MSSQL named pipe timeout and disconnect handling
* Support separate SMB credentials for MSSQL named pipes
* Fix MSSQL named pipe authentication routing
* Honor MSSQL named pipe connection timeouts
* Close failed MSSQL named pipe transports
---------
Co-authored-by: Aurélien CHALOT <[email protected]>
Co-authored-by: Gabi Gonzalez <[email protected]>
* Fix AttributeError when parsing a credential with auth data
Credential.authData was initialized as a tuple and never turned into a
list before the parse loop appended to it, so any ccache credential
carrying authorization data raised "AttributeError: 'tuple' object has
no attribute 'append'". Initialize it as a list right before the loop,
mirroring how addresses is already handled. Adds a regression test.
* simplified initialization code
---------
Co-authored-by: Eugen Goebel <[email protected]>
Co-authored-by: Kali <[email protected]>
* fix(tds): decode hex bytes to str for binary column display
* fix(tds): decode BIGCHARTYPE and TEXTTYPE bytes as latin-1 string
* test(tds): cover decoded binary and char row values
Add parseRow regression coverage for binary/image hex output and non-Unicode text/char values so Python 3 does not render them as bytes reprs.\n\nAlso simplify latin-1 decode paths, since latin-1 accepts every byte value and the UnicodeDecodeError fallback was unreachable.
---------
Co-authored-by: Gabi Gonzalez <[email protected]>
KNOWN_PROTOCOLS is a dict literal keyed by interface UUID, so duplicate
keys are silently collapsed by Python and the second entry shadows the
first, producing incorrect protocol lookups (issue #2126).
Two UUIDs were listed twice:
- 12345778-1234-ABCD-EF00-0123456789AB was mapped to both MS-LSAD and
MS-LSAT. Both protocols are served over the same lsarpc interface
(MSRPC_UUID_LSAD == MSRPC_UUID_LSAT), so the two entries are merged
into one that names both.
- 00000000-0000-0000-C000-000000000046 is IID_IUnknown (see
dcomrt.IID_IUnknown) and already maps to MS-DCOM. It was also listed
in the MS-RSMP block, which has its own interface UUIDs; that
erroneous entry is removed.
Adds a regression test that parses the source and asserts KNOWN_PROTOCOLS
has no duplicate keys.
Closes#2126
Co-authored-by: moizxsec <[email protected]>
* Add NEGOEX protocol implementation in negoex.py
This file implements the NEGOEX protocol for SPNEGO extended negotiation, including message types, structures, and parsing functions. This commit is a initial, first start attempt at the protocol
* Minor cleanups
Just cleaned up and trimmed up certain code elements from leftover.
* Corrected the intended file for PR
* Added new function to create a negoex message instance
The `createNegoMessage` function has been implemented to create a negoex message as either the initiator or acceptor
* Function to create Exchange message
Implemented the function that's able to create an exchange message used within the NEGOEX protocol
* Added helper functions, fixed imports and minor changes
* Removed NegoExContext
* Added commented section seperators to make it easier to read the module
* Added auth scheme UID for PKU2U
* Implemented createAlert/createVerify message functions
* Replaced older python convention with f strings
* Addede exposed safe accessors
* Added strict signutre check in the function that checks the message headers for the correct strucutre/format
* Minor fixes on F strings
* Implemented stricter parsing as well as added testcases for the negoex.py module
* Created NegoExContext
Created the NegoExContext class that will be exposing to public consumers to drive the state machine required for the protocol to work
* Implement method to register auth scheme and create exchange messages depending on the status of the caller
* Implemented internal function to create verify messages + checksum creation as well as step through the sequencing in the message exchang
* Implemented functions to process/track incoming verify messages, function to process incoming NEGOEX token, and a function to create the first message to initiate the negotiation protocol/process
* Corrected comment
* Implemented function to inform consumers they have finished the protocol exchange
* Modified order of methods in state machine class to be more logical and reader friendly
* Added the option for caller to provide optimistictoken to eliminate the need for a full round trip and allows us to instead progress directly with the authentication exchange
* Added testcases for the negoex state machine based on the microsoft protocol example in MS-NEGOEX open spec
* Fixed sequnce number bug where sequence number were not incremented correctly
* Fixed the failing testcase by just asserting it equals the selected scheme since mutual schemes should only have the scheme that we, the iniator, offered
* removed uneccesary test assertion
* Implement _processAlert method in NegoEx class
The current defined alert message is informational in nature as it requires nothing for us, the receiver to practically do anything in response to it.
This could change in future revisions of the module and so for now while we only log it via debug we got a verify message, there might be new logic needed in the future with revisions.
* Implement _processNego internal function
Additionally fixed an error I had accidentally left in place from editing via iPad
* implemented internal function to validate convId
Implemented function to track conversation IDs and ensure incoming messages are the right authentication schemes and match our expected conversation ids
* implemented 4 new test cases to track/validate conversation ID, acceptor side processing
* fixed indent
* Add NegoExError import to test_negoex.py
* Fix test case indentation issues
* Create raa.py
Implemented new module to implement the MS-RAA protocol
* Implement Remote Authorization API Protocol Interface
This file implements the Remote Authorization API Protocol Interface for client-side operations, including various structures and RPC calls necessary for authorization tasks.
* Convert SID to RPC_SID object in context initialization
Fixed bug in which passing directly the Sid from the string, and instead we need to convert the string to an RPC_SID instance
* clarity
* Fixed issues with the token groups NDRstruct. Additionally fixed issue passing the proper UUID for the interface
* Add test cases for the MS-RAA module rpc calls
* • tests: select the matching RAA TCP endpoint
Use RPC_C_EP_MATCH_BY_IF when looking up MS-RAA endpoints and verify
that each returned tower belongs to the RAA interface before selecting a
TCP port.
The previous lookup could return unrelated endpoint mapper entries, so
the tests could bind the RAA interface to another service's dynamic RPC
port and fail with abstract_syntax_not_supported.
Also guard ProtocolData access while scanning tower floors and reuse
epm.FLOOR_TCPPORT_IDENTIFIER instead of a magic b'\x07' value.
* • raa: fix token group parsing and remote test coverage
Fix AUTHZR_TOKEN_GROUPS marshalling for real non-empty group SID
responses. Windows NDR32 replies omit the conformant-array max count in
this structure, while NDR64 replies include it before GroupCount, so the
parser now handles both observed layouts.
Also fix several helper serialization issues:
- default AUTHZR_HANDLE data is now bytes on Python 3
- hAuthzrInitializeContextFromSid sends zeroed reserved Identifier fields
- ModifyClaims/ModifySids helpers wrap operation values as NDRENUM items
Update the RAA remote tests to:
- select the matching MS-RAA TCP endpoint from EPM
- use epm.FLOOR_TCPPORT_IDENTIFIER instead of a magic b'\x07'
- resolve the configured test account SID at runtime via LSAT
- exercise ModifyClaims/ModifySids helper calls against a live context
* Updated comments at the very top of file
Updated comments to remove old comment that said tests would be soon and instead referenced the file in which the test cases are found in
* minor fixes
---------
Co-authored-by: Kali <[email protected]>
Use DCOMConnection in test_RemoteGetClassObject instead of a raw
DCE/RPC connection from self.connect(). RemoteGetClassObject returns an
interface whose RemRelease path expects the DCOMConnection PORTMAPS cache
to be initialized for the target; the raw connection path leaves that
cache empty and can raise KeyError keyed by the target address.
Wrap the interface use in a try/finally so the DCOM connection is always
disconnected after the test.
* preserve request-based ticket lifetime and add regression test
* tests: expand coverage for request-based ticket lifetime preservation
* Updated tests to comply with the code review
* Update examples/ticketer.py
* update description of the -duration parameter
---------
Co-authored-by: Gabriel Gonzalez <[email protected]>
* Fixed TS_ALL_PROCESSES_INFO parsing for RpcWinStationGetAllProcesses
* Removed ldap3 dependency, fixed mismatched data type for rawsid, added missing test
* Removed unused imports, renamed imagenamesize -> imagename to match docs. Added missing test
* Modify ticketer and ccache logic
* ticketer now update existing ccache if KRB5CCNAME is specified
* ticketConverter now convert all TGS within the Kirbi or provided Ccache
* Fix a bug during the conversion from ccache to kirbi that does not correctly preserve ticket flags
* Update kirbi test cases. Improve Kirbi to Ccache conversion.
