Improve kerberos user enum module - #16430
Conversation
| def user_list | ||
| users = nil | ||
| if File.readable? datastore['USER_FILE'] | ||
| users = File.new(datastore['USER_FILE']).read.split |
There was a problem hiding this comment.
User accounts with spaces weren't being handled correctly, I've changed this to readlines now
Long term this should be using the brute force mixin for running enumeration in parallel, but that's out of scope for this PR
b291c14 to
1ab9da5
Compare
1ab9da5 to
a53be31
Compare
| hashcat -m 18200 -a 0 ./hashes.txt ./wordlist.txt | ||
| ``` | ||
|
|
||
| You can see previously creds with: |
There was a problem hiding this comment.
| You can see previously creds with: | |
| You can see previously stored creds with: |
| credential_data.merge!( | ||
| private_data: opts[:asrep], | ||
| private_type: :nonreplayable_hash, | ||
| jtr_format: 'krb5' |
There was a problem hiding this comment.
I went with krb5 for now, which is validated here:
https://github.com/rapid7/metasploit-credential/blob/1d2b701e5aa3ca316dc7068cf5b98849fc4349cd/app/models/metasploit/credential/nonreplayable_hash.rb#L10-L23
But I believe the john format list has been updated since 2014, and there's more granularity available now:
➜ ~ john --list=formats
... krb5, krb5asrep, krb5pa-sha1, krb5tgs, krb5-17, krb5-18, krb5-3, krb5pa-md5, ...
There was a problem hiding this comment.
Pull request to add the newer formats rapid7/metasploit-credential#162
|
Testd all the scenarios and looks good to me will land |
Release NotesAdds support for logging AS-REP Roastable accounts, as well as storing the generated Kerberos token within the creds database. Additionally improves error handling. |
4 participants
Closes #15286
Adds support for logging AS-REP Roastable accounts, as well as storing the generated Kerberos token within the
credsdatabase. Additionally improves error handling.These accounts can be shown by toggling the following flag after creating a new user within a domain controller:
Verification
modules/auxiliary/admin/kerberos/ms14_068_kerberos_checksumworks as expected