Kerberos TGT Failure

[godylockz]

Using Kerberos ticket requested from impacket's getTGT fails here, passed in with -k and setting KRB5CCNAME:

pywhisker/pywhisker/pywhisker.py

Line 264 in d1704f6

ticket.from_asn1(tgs['ticket'])

AttributeError: 'Ticket' object has no attribute 'from_asn1'

[Romern]

See my ignored comment in #28 (comment) .

[xanruth]

I also have this issue while using #31 :

python3 ~/Tools/pywhisker/pywhisker/pywhisker.py \
-k --no-pass -d DOMAIN.LOCAL--dc-host DC01 --dc-ip 10.10.x.x --target "svc_target" --action add -vv

[DEBUG] Using Kerberos Cache: /home/.../REDACTED.ccache
[DEBUG] Using TGT from cache
Traceback (most recent call last):
  File ".../Tools/pywhisker/pywhisker/pywhisker.py", line 926, in main
    ldap_server, ldap_session = init_ldap_session(
                                ~~~~~~~~~~~~~~~~~^
        args=args,
        ^^^^^^^^^^
    ...<5 lines>...
        logger=logger
        ^^^^^^^^^^^^^
    )
    ^
  File "/home/kali/Tools/pywhisker/pywhisker/pywhisker.py", line 162, in init_ldap_session
    return init_ldap_connection(target, None, args, domain, username, password, lmhash, nthash, logger)
  File "/home/kali/Tools/pywhisker/pywhisker/pywhisker.py", line 126, in init_ldap_connection
    ldap3_kerberos_login(ldap_session, target, username, password, logger, domain, lmhash, nthash, args.auth_key, kdcHost=args.dc_ip)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/home/kali/Tools/pywhisker/pywhisker/pywhisker.py", line 264, in ldap3_kerberos_login
    ticket.from_asn1(tgs['ticket'])
    ^^^^^^^^^^^^^^^^
AttributeError: 'Ticket' object has no attribute 'from_asn1'
[!] 'Ticket' object has no attribute 'from_asn1'

[ShutdownRepo]

Hi guys, I'm truly sorry for the delay, and for the issue
I'm swamped
But if anyone comes up with something that seems to fix the issue, I will gladly merge it!

[ShutdownRepo]

Is #34 as valid fix?

[Cyb3rC3lt]

I can confirm that this worked for me just now when I was getting the same error. Just tried it on a remove action.

[Cyb3rC3lt]

Just as an aside, to also get it working I needed to inject an old version of pyOpenSSL like so: pipx inject pywhisker pyOpenSSL==24.0.0 --force
Or else I would get the below error:

[!] module 'OpenSSL.crypto' has no attribute 'PKCS12'

Seems to have been an issue for impacket last year too:

fortra/impacket#1716

[blurbdust]

#34 worked for an add operation as well

[ShutdownRepo]

Just as an aside, to also get it working I needed to inject an old version of pyOpenSSL like so: pipx inject pywhisker pyOpenSSL==24.0.0 --force Or else I would get the below error:

[!] module 'OpenSSL.crypto' has no attribute 'PKCS12'

Seems to have been an issue for impacket last year too:

fortra/impacket#1716

maybe we should specify that version on our requirements/setup ?

[qu35t-code]

Hi @ShutdownRepo,

The PR works like a charm !
I've just solved the same issue by modifying the import !
Thanks, now I'm DA 💯