Sync BLS master with upstream Fortra/impacket - #10
Merged
Conversation
* modified addcomputer to use impacket.ldap instead of ldap3 * fixing ldaps patch * updated to use impacket.ldap instead of ldap3o * use impacket.ldap instead of ldap3 * removed duplicated code. moved helpers to utils.py and ldap.py * applied code review changes
* Check cached TGT matches requested user in getST.py * Address review feedback for cached TGT validation * Address review feedback for cached TGT validation * Handle multi-component principals in cached TGT validation --------- Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
* dpapi: support unprotect SHA1 keys * dpapi: unprotect outfile option * dpapi: support keys with and without 0x prefix * parseHexKey helper func
…fortra#2053) * httpRelayServer: restore POST body handling and add HTTPS/TLS support This commit makes two improvements to httprelayserver.py: 1. Restore POST body draining logic (fortra#913): - Re-applies fix originally merged in 2021 by Rcarnus. - Ensures POST request bodies are consumed before returning 401 Unauthorized. - Fixes WSUS and other web clients that retry authentication on the same TCP stream. 2. Add HTTPS/TLS support with improved logging: - Introduce optional SSL context when --https, --certfile, and --keyfile are provided. - Wrap inbound sockets with TLS, logging negotiated protocol/cipher on success. - On failures, log SSL error details, flagging early EOFs (likely client cert rejection). - Add startup banner showing port, IPv6/HTTPS status for clarity. Together these changes allow ntlmrelayx to: - Correctly handle WSUS POST-based authentication flows. - Relay over HTTPS endpoints (e.g., WSUS 8531) with real certs or self-signed. - Provide more useful debug information for operators. * Added comment explaining part of code * httpRelayServer: address review feedback for fortra#2053 - Revert log prefix HTTPD(%s)/HTTPD(?) back to (HTTP) (fortra#2012 style) - Preserve SUCCEED [client_id] format from fortra#2032 - Strip unrelated whitespace/style noise from the diff - Remove PY2 branch added by this PR in do_GET - Add parser.error when --https is set without --certfile/--keyfile - Clean strip_blob comment: fix typo, drop history attribution - Wire HTTPS through NTLMRelayxConfig.setHTTPS() setter * Rebased, removed remaining PY2 reference, fixed a log message format * made --keyfile not required for https --------- Co-authored-by: alexisbalbachan <alexisbalbachan@gmail.com>
…ortra#2202) * Working tds np * Print answer * WORKING POOOOOOOC * WORKING POOOOOOOC * WORKING POOOOOOOC * Removing dupplicated functions * Removing dupplicate code * Merged all in one * Add detection version for MSSQL server 2025 * Switch pipe_name to positional argument to not break other things * Comply to remoteHost/remoteName for Kerberos auth * Patch small error * Preserve MSSQL constructor compatibility * Default MSSQL named pipe remote host * Fix MSSQL named pipe timeout and disconnect handling * Support separate SMB credentials for MSSQL named pipes * Fix MSSQL named pipe authentication routing * Honor MSSQL named pipe connection timeouts * Close failed MSSQL named pipe transports --------- Co-authored-by: Aurélien CHALOT <aurelien.chalot@orangecyberdefense.com> Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
…ra#2239) The NetLogon SMB validation path set only the K bit (0x800) of ParameterControl, so a domain-controller (server-trust) account was rejected by the DC with STATUS_NOLOGON_SERVER_TRUST_ACCOUNT, for example when an AD CS CA co-located on a DC authenticates back as the DC's own account. Also set the E bit (0x20) so both workstation and DC computer accounts validate. K remains set, preserving the workstation-account path. Ref: MS-NRPC 2.2.1.4.15 (NETLOGON_LOGON_IDENTITY_INFO), ParameterControl bits K and E. https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-nrpc/81c44fa0-0a27-41b3-b607-de39cce7ea1d Co-authored-by: gregdurys <gregdurys.security@proton.me>
… computers (fortra#2145) * ntlmrelayx: Add --dump-pre2k to enumerate Pre-Windows 2000 vulnerable computer accounts Add a new LDAP relay attack option that identifies computer accounts potentially vulnerable to pre-Windows 2000 authentication, where the password is predictable (lowercase machine name without trailing $). Detection is based on the PASSWD_NOTREQD flag (0x0020) in userAccountControl and computer accounts with pwdLastSet=0. Results are displayed in the console and saved as JSON in the lootdir. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * Deduplicate pre-2k candidate processing * Detect pre-2k accounts by creation timestamp * Remove pre-2k unit test * Classify pre-2k candidate confidence --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com> Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
…fortra#2237) * Add optional Author log poison/overflow flags to atexec Allow -author-log to set a fake RegistrationInfo Author, or -overflow to use a 4000-byte Author buffer, for Security Event 4698 tampering. * Update atexec.py Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com> * Move atexec entry to unreleased changelog --------- Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
…ulti domain forests (e.g. dumped LDAP tickets using rubeus dump module) (fortra#2242) * Fix IndexError in CCache.getCredential when handling 3-part SPNs * Update impacket/krb5/ccache.py Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com> * Add regression tests for 3-part SPN matching in CCache.getCredential --------- Co-authored-by: Gabriel Gonzalez <gabriel.gonzalez@fortra.com>
* feat(smbserver): add SMB 3.1.1 support with pre-auth integrity, KBKDF signing, and session encryption * fix(smbserver): echo request SessionId in SMB2 response headers per MS-SMB2 §3.3.4.1 * refactor(smbserver): drop spec URLs and section numbers from comments * fix(smbserver): reject unsupported SMB2 dialects instead of defaulting to 2.002 * fix(smbserver): encrypt SMB2 compound responses as a single message * fix(smbserver): verify SMB2 transform header auth tag before trusting plaintext * fix(smbserver): source SMB2 transform cipher from connection state, not the packet * fix(smbserver): use correct SMB2 transform flags constant on the encrypt side * fix(smbserver): preserve real SessionId in encrypted LOGOFF transform header * test(smbserver): add SMB 3.1.1 regression tests * test(smbserver): pin functional suites to legacy dialects --------- Co-authored-by: Gabi Gonzalez <gabriel.gonzalez@fortra.com>
* keylistattack: support PAC-hardened DCs The RODC partial TGT now carries a signed PAC, so patched DCs accept the KERB-KEY-LIST request. LIST mode gains -domain-sid / username:rid. * keylistattack: recover keys despite extra PA-DATA getKey() finds KERB-KEY-LIST-REP by type, not encrypted_pa_data[0]. * keylistattack: warn on placeholder PAC requestor _createPartialPac() now logs a WARNING naming the user when it falls back to placeholder RID 1000, so the operator sees the requestor SID will not match the target and can supply username:rid.
…in -request mode (fortra#2201) * Diamond ticket: preserve KDC-issued PAC_REQUESTOR and PAC_ATTRIBUTES in -request mode * Fix: respect -old-pac and skip preservation on user/target mismatch
…ortra#2238) Trust key dump always emitted RC4 + AES256 + AES128, ignoring -just-dc-ntlm. _format_trust_secrets now takes a justNTLM flag, propagated from self.__justNTLM in both the online and offline trust key dump paths, to suppress the AES lines when requested.
Incorporates 21 upstream commits including: - AES-128-GCM SMB3 support - Standardized Kerberos TGS enctype negotiation - SMB 3.1.1 smbserver dialect support - Diamond ticket PAC_REQUESTOR preservation - keylistattack PAC-hardened DC support - atexec Event 4698 author tampering - DCOM interface context loss fix - ntlmrelayx Pre-Windows 2000 enumeration - Named pipe MSSQL/TDS support - LDAP utility functions (escape_filter_chars, get_entry_*) - Various bug fixes Conflicts resolved: - impacket/krb5/kerberosv5.py: Took upstream's TGS enctype negotiation and simplified sendReceive, preserved BLS's KRBTGSFLAGS env var support - impacket/ldap/ldap.py: Took upstream's __all__ with new exports
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Upstream changes incorporated
Conflicts resolved
Test plan