Skip to content

Commit 78a7268

Browse files
int3xint3x
committed
Merge PR GhostPack#204 GhostPack#204 for dMSA improvements
2 parents 74215f6 + 5f7a36b commit 78a7268

File tree

5 files changed

+73
-24
lines changed

5 files changed

+73
-24
lines changed

‎Rubeus/lib/Ask.cs‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -626,14 +626,14 @@ public static byte[] TGS(string userName, string domain, Ticket providedTicket,
626626
string keyListHash = null;
627627
if (keyList)
628628
{
629-
keyListHash = Helpers.ByteArrayToString(encRepPart.encryptedPaData.PA_KEY_LIST_REP.encryptionKey.keyvalue);
629+
keyListHash = Helpers.ByteArrayToString(encRepPart.encryptedPaData.PA_KEY_LIST_REP.EncryptionKeys[0].keyvalue);
630630
}
631631

632632
// extract DMSA_KEY_PACKAGE for parsing to displayTicket.
633-
PA_DMSA_KEY_PACKAGE dmsaCurrentKeys = null;
633+
PA_DMSA_KEY_PACKAGE dmsaKeyPackage = null;
634634
if (dmsa)
635635
{
636-
dmsaCurrentKeys = encRepPart.encryptedPaData.PA_DMSA_KEY_PACKAGE;
636+
dmsaKeyPackage = encRepPart.encryptedPaData.PA_DMSA_KEY_PACKAGE;
637637
}
638638

639639
// if using /opsec and the ticket is for a server configuration for unconstrained delegation, request a forwardable TGT
@@ -704,7 +704,7 @@ public static byte[] TGS(string userName, string domain, Ticket providedTicket,
704704
string kirbiString = Convert.ToBase64String(kirbiBytes);
705705

706706
return ProcessTicketResponse(kirbiBytes, kirbiString, cred, ptt, servicekey, u2u, clientKey, display,
707-
asrepkey, keyListHash, outfile, printargs, dmsaCurrentKeys);
707+
asrepkey, keyListHash, outfile, printargs, dmsaKeyPackage);
708708

709709
}
710710
else if (responseTag == (int)Interop.KERB_MESSAGE_TYPE.ERROR)
@@ -720,7 +720,7 @@ public static byte[] TGS(string userName, string domain, Ticket providedTicket,
720720
return null;
721721
}
722722

723-
static public byte[] ProcessTicketResponse(byte[] kirbiBytes, string kirbiString, KRB_CRED cred, bool ptt, string servicekey, bool u2u, byte[] clientKey, bool display, string asrepkey, string keyListHash, string outfile, bool printargs, PA_DMSA_KEY_PACKAGE dmsaCurrentKeys) {
723+
static public byte[] ProcessTicketResponse(byte[] kirbiBytes, string kirbiString, KRB_CRED cred, bool ptt, string servicekey, bool u2u, byte[] clientKey, bool display, string asrepkey, string keyListHash, string outfile, bool printargs, PA_DMSA_KEY_PACKAGE dmsaKeyPackage) {
724724

725725
if (ptt) {
726726
// pass-the-ticket -> import into LSASS
@@ -746,7 +746,7 @@ static public byte[] ProcessTicketResponse(byte[] kirbiBytes, string kirbiString
746746

747747
LSA.DisplayTicket(kirbi, 2, false, false, false, false,
748748
string.IsNullOrEmpty(servicekey) ? null : Helpers.StringToByteArray(servicekey), string.IsNullOrEmpty(asrepkey) ? null : Helpers.StringToByteArray(asrepkey),
749-
null, null, null, string.IsNullOrEmpty(keyListHash) ? null : Helpers.StringToByteArray(keyListHash), null, dmsaCurrentKeys);
749+
null, null, null, string.IsNullOrEmpty(keyListHash) ? null : Helpers.StringToByteArray(keyListHash), null, dmsaKeyPackage);
750750
}
751751

752752
if (!String.IsNullOrEmpty(outfile)) {

‎Rubeus/lib/LSA.cs‎

Lines changed: 21 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -488,7 +488,7 @@ public static void DisplaySessionCreds(List<SESSION_CRED> sessionCreds, TicketDi
488488
}
489489
}
490490

491-
public static void DisplayTicket(KRB_CRED cred, int indentLevel = 2, bool displayTGT = false, bool displayB64ticket = false, bool extractKerberoastHash = true, bool nowrap = false, byte[] serviceKey = null, byte[] asrepKey = null, string serviceUser = "", string serviceDomain = "", byte[] krbKey = null, byte[] keyList = null, string desPlainText = "", PA_DMSA_KEY_PACKAGE dmsaCurrentKeys = null)
491+
public static void DisplayTicket(KRB_CRED cred, int indentLevel = 2, bool displayTGT = false, bool displayB64ticket = false, bool extractKerberoastHash = true, bool nowrap = false, byte[] serviceKey = null, byte[] asrepKey = null, string serviceUser = "", string serviceDomain = "", byte[] krbKey = null, byte[] keyList = null, string desPlainText = "", PA_DMSA_KEY_PACKAGE dmsaKeyPackage = null)
492492
{
493493
// displays a given .kirbi (KRB_CRED) object, with display options
494494

@@ -552,13 +552,29 @@ public static void DisplayTicket(KRB_CRED cred, int indentLevel = 2, bool displa
552552
Console.WriteLine("{0}Password Hash : {2}", indent, userName, Helpers.ByteArrayToString(keyList));
553553
}
554554

555-
if(dmsaCurrentKeys != null)
555+
if (dmsaKeyPackage != null)
556556
{
557-
string etypeName = Enum.GetName(typeof(Interop.KERB_ETYPE), dmsaCurrentKeys.currentKeys.encryptionKey.keytype);
558-
string cKeyValue = Helpers.ByteArrayToString(dmsaCurrentKeys.currentKeys.encryptionKey.keyvalue);
557+
string etypeName, cKeyValue;
558+
foreach (var encryptionKey in dmsaKeyPackage.currentKeys.EncryptionKeys)
559+
{
560+
etypeName = Enum.GetName(typeof(Interop.KERB_ETYPE), encryptionKey.keytype);
561+
cKeyValue = Helpers.ByteArrayToString(encryptionKey.keyvalue);
562+
559563

564+
Console.WriteLine("{0}Current Keys for {1}: ({2}) {3}", indent, userName, etypeName, cKeyValue);
565+
}
560566

561-
Console.WriteLine("{0}Current Keys for {1}: ({2}) {3}", indent, userName, etypeName, cKeyValue);
567+
if (dmsaKeyPackage.previousKeys != null)
568+
{
569+
foreach (var encryptionKey in dmsaKeyPackage.previousKeys.EncryptionKeys)
570+
{
571+
etypeName = Enum.GetName(typeof(Interop.KERB_ETYPE), encryptionKey.keytype);
572+
cKeyValue = Helpers.ByteArrayToString(encryptionKey.keyvalue);
573+
574+
575+
Console.WriteLine("{0}Previous Keys for {1}: ({2}) {3}", indent, userName, etypeName, cKeyValue);
576+
}
577+
}
562578
}
563579

564580

‎Rubeus/lib/krb_structures/EncryptionKey.cs‎

Lines changed: 12 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,18 @@ public EncryptionKey()
2121

2222
public EncryptionKey(AsnElt body)
2323
{
24-
foreach (AsnElt s in body.Sub[0].Sub)
24+
// Unwrap a wrapper if present, or use body directly if it's already a SEQUENCE
25+
AsnElt seq;
26+
if (body.TagValue == AsnElt.SEQUENCE)
27+
{
28+
seq = body;
29+
}
30+
else
31+
{
32+
seq = body.Sub[0];
33+
}
34+
35+
foreach (AsnElt s in seq.Sub)
2536
{
2637
switch (s.TagValue)
2738
{

‎Rubeus/lib/krb_structures/PA_DMSA_KEY_PACKAGE.cs‎

Lines changed: 15 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,21 @@ public PA_DMSA_KEY_PACKAGE()
2626

2727
public PA_DMSA_KEY_PACKAGE(AsnElt body)
2828
{
29-
currentKeys = new PA_KEY_LIST_REP(body.Sub[0].Sub[0]);
30-
previousKeys = new PA_KEY_LIST_REP(body.Sub[1].Sub[0]);
31-
expirationInterval = body.Sub[2].Sub[0].GetTime();
32-
fetchInterval = body.Sub[3].Sub[0].GetTime();
33-
}
29+
currentKeys = new PA_KEY_LIST_REP(body.Sub[0].Sub[0]);
30+
31+
// previous-keys is OPTIONAL
32+
if (body.Sub.Length == 4)
33+
{
34+
previousKeys = new PA_KEY_LIST_REP(body.Sub[1].Sub[0]);
35+
expirationInterval = body.Sub[2].Sub[0].GetTime();
36+
fetchInterval = body.Sub[3].Sub[0].GetTime();
37+
}
38+
else
39+
{
40+
expirationInterval = body.Sub[1].Sub[0].GetTime();
41+
fetchInterval = body.Sub[2].Sub[0].GetTime();
42+
}
43+
}
3444

3545
public AsnElt Encode()
3646
{

‎Rubeus/lib/krb_structures/PA_KEY_LIST_REP.cs‎

Lines changed: 19 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,29 +1,41 @@
11
using Asn1;
22
using System;
3+
using System.Collections.Generic;
4+
using System.Linq;
35
using System.Text;
46

57
namespace Rubeus
68
{
79
public class PA_KEY_LIST_REP
810
{
911
// KERB-KEY-LIST-REP ::= SEQUENCE OF EncryptionKey
12+
1013
public PA_KEY_LIST_REP()
1114
{
12-
encryptionKey = new EncryptionKey();
15+
EncryptionKeys = new List<EncryptionKey>();
1316
}
17+
1418
public PA_KEY_LIST_REP(AsnElt body)
1519
{
16-
encryptionKey = new EncryptionKey(body);
20+
if (body.TagValue != AsnElt.SEQUENCE)
21+
throw new ArgumentException("KERB-KEY-LIST-REP must be a SEQUENCE", nameof(body));
22+
23+
EncryptionKeys = new List<EncryptionKey>(body.Sub.Length);
24+
foreach (var child in body.Sub)
25+
{
26+
EncryptionKeys.Add(new EncryptionKey(child));
27+
}
1728
}
1829

1930
public AsnElt Encode()
2031
{
21-
AsnElt encryptionKeyAsn = encryptionKey.Encode();
22-
AsnElt encryptionKeySeq = AsnElt.Make(AsnElt.SEQUENCE, new[] { encryptionKeyAsn });
23-
return encryptionKeySeq;
24-
}
32+
var encodedKeys = EncryptionKeys
33+
.Select(key => key.Encode())
34+
.ToArray();
2535

26-
public EncryptionKey encryptionKey { get; set; }
36+
return AsnElt.Make(AsnElt.SEQUENCE, encodedKeys);
37+
}
2738

39+
public List<EncryptionKey> EncryptionKeys { get; set; }
2840
}
2941
}

0 commit comments

Comments
 (0)