You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
* LDAP Attack: Bugfixes when parsing responses (@SAERXCIT)
49
+
*[getST.py](examples/getST.py):
50
+
* Added -self, -altservice and -u2u for S4U2self abuse, S4U2self+u2u, and service substitution (@ShutdownRepo)
51
+
* Added ability to set the RENEW ticket option to renew a TGT (@shikatano)
52
+
* Fixed unicode encoding error when using the -impersonate flag (@alexisbalbachan)
53
+
*[getTGT.py](examples/getTGT.py):
54
+
* Added principalType as new parameter (@DevSpork)
55
+
*[reg.py](examples/reg.py):
56
+
* Start remote registry as unprivileged user in reg.py (@dadevel)
57
+
* Allow adding Binary values (@dc3l1ne)
58
+
* Add missing Null byte for REG_SZ values (@PfiatDe)
59
+
* Support for adding REG_MULTI_SZ values through (@garbrielg5)
60
+
*[smbclient.py](examples/smbclient.py):
61
+
* Added ability to provide an output file that the smbclient mini shell will write commands and output to (@RazzburyPi)
62
+
* Fixed path parse issue when running `tree` command (@trietend)
63
+
*[smbserver.py](examples/smbserver.py):
64
+
* Added parameter "-outputfile" to set smbserver log file(gabrielg5)
65
+
*[DumpNTLMInfo.py](examples/DumpNTLMInfo.py):
66
+
* Allow execution on non-default ports (@jeffmcjunkin)
67
+
* Fixed KeyError exception when running with a Windows 2003 target (@XiaoliChan)
68
+
*[findDelegation.py](examples/findDelegation.py):
69
+
* Added new column to show if SPN exists (@p0dalirius)
70
+
*[mssqlclient.py](examples/mssqlclient.py):
71
+
* Added `-target-ip` parameter to allow Kerberos authentication without much change in the DNS configuration of the local machine (@Palkovsky)
72
+
*[mssqlshell.py](examples/mssqlshell.py):
73
+
* Switching back to original DB after running `enum_impersonate` command (@exploide)
74
+
* Fixed logging in printReplies showing error messages (@gabrielg5)
75
+
*[registry-read.py](examples/registry-read.py):
76
+
* Fixed scenario where value name contains backlash (@DidierA)
77
+
*[net.py](examples/net.py):
78
+
* Fixed User "Account Active" property value (@marcobarlottini)
79
+
* Fixed log messages printing variables in the wrong order (@Cyb3rC3lt)
80
+
*[rbcd.py](examples/rbcd.py):
81
+
* Handled SID not found in LDAP error (@ShutdownRepo)
82
+
*[GetUserSPNs.py](examples/GetUserSPNs.py):
83
+
* Updated the help information for -outputfile to be consistent with -save (@scarvell)
84
+
*[ntfs-read.py](examples/ntfs-read.py):
85
+
* Minor refactor in ntfs-read.py to make it more human-readable (@NtAlexio2)
86
+
*[ldap_shell.py](examples/ldap_shell.py):
87
+
* Added support for dirsync and whoami commands (@nurfed1)
88
+
*[lookupsid.py](examples/lookupsid.py):
89
+
* Now supports kerberos auth (@A1vinSmith)
90
+
*[samrdump.py](examples/samrdump.py):
91
+
* Will fetch AdminComment using MSRPC (@joeldeleep)
92
+
*[tstool.py](examples/tstool.py):
93
+
* Added support for kerberos auth, resolves SIDs (@nopernik)
94
+
95
+
4. New examples
96
+
*[describeTicket.py](examples/describeTicket.py): Ticket describer and decrypter. (@ShutdownRepo)
97
+
*[GetADComputers.py](examples/GetADComputers.py): Query's DC via LDAP and returns the COMPUTER objects and the useful attributes such as full dns name, operating system name and version. (@F-Masood)
98
+
*[GetLAPSPassword.py](examples/GetLAPSPassword.py): Extract LAPS passwords from LDAP (@zblurx and @dru1d-foofus)
99
+
*[dacledit.py](examples/dacledit.py): This script can be used to read, write, remove, backup, restore ACEs (Access Control Entries) in an object DACL (Discretionary Access Control List). (@ShutdownRepo) (@BlWasp_) (@Wlayzz)
100
+
*[owneredit.py](examples/owneredit.py): Added this script to abuse WriteOwner (ADS_RIGHT_WRITE_OWNER) access rights. This allows to take ownership of another object, and then edit that object's DACL (@ShutdownRepo) (@BlWasp_)
101
+
102
+
As always, thanks a lot to all these contributors that make this library better every day (up to now):
* Changed the setting up for new SSL connections (@mpgn, @CT-H00K and @0xdeaddood).
112
+
* Added a callback function to smbserver for incoming authentications (@p0dalirius).
113
+
* Fix crash in winregistry (@laxa)
114
+
* Fixes in IDispatch derived classes in comev implementation (@NtAlexio2)
115
+
* Fix CVE-2020-17049 in ccache.py (@godylockz)
116
+
* Smbserver: Added SMB2_FILE_ALLOCATION_INFO type determination (@JerAxxxxxxx)
117
+
* tds: Fixed python3 incompatibility when receiving over TLS socket (@exploide)
118
+
* crypto: Ensure passwords are utf-8 encoded before deriving Kerberos keys (@jojonas)
119
+
* ese: Fixed python3 incompatibility when reading from db (@alexisbalbachan)
120
+
* ldap queries: Escaped characters are now correctly parsed (@alexisbalbachan)
121
+
* Support SASL authentication in ldap protocol (@NtAlexio2)
122
+
123
+
2. Examples improvements
124
+
*[GetADUsers.py](examples/GetADUsers.py), [GetNPUsers.py](examples/GetNPUsers.py), [GetUserSPNs.py](examples/GetUserSPNs.py) and [findDelegation.py](examples/findDelegation.py):
125
+
* Added dc-host option to connect to specific KDC using its FQDN or NetBIOS name (@rmaksimov and @0xdeaddood).
126
+
*[GetNPUsers.py](examples/GetNPUsers.py)
127
+
* Printing TGT in stdout despite -outputfile parameter (@alexisbalbachan and @Zamanry)
128
+
* Fixed output hash format for AES128/256 (etype 17/18) (@erasmusc)
129
+
*[GetUserSPNs.py](examples/GetUserSPNs.py):
130
+
* Added LDAP paged search (@ThePirateWhoSmellsOfSunflowers and @SAERXCIT).
131
+
* Added a -stealth flag to remove the SPN filter from the LDAP query (@clavoillotte).
132
+
* Improved searchFilter (@ShutdownRepo)
133
+
* Use LDAP paged search (@ThePirateWhoSmellsOfSunflowers)
134
+
*[psexec.py](examples/psexec.py):
135
+
* Added support for name customization using a custom binary file (@Dramelac).
136
+
*[smbexec.py](examples/smbexec.py):
137
+
* Security fixes for privilege escalation vulnerabilities (@bugch3ck).
138
+
* Fixed python3 compatibility issues, added workaround TCP over NetBIOS being disabled (@ljrk0)
139
+
*[secretsdump.py](examples/secretsdump.py):
140
+
* Added a new option to extract only NTDS.DIT data for specific users based on an LDAP filter (@snovvcrash).
141
+
* Security fixes for privilege escalation vulnerabilities (@bugch3ck).
142
+
*[mssqlclient.py](examples/mssqlclient.py):
143
+
* Added multiple new commands. Now supports xp_dirtree execution (@Mayfly277, @trietend and @TurtleARM).
144
+
*[ntlmrelayx.py](examples/ntlmrelayx.py):
145
+
* Added ability to trigger SQLShell when running ntlmrelayx in interactive mode (@sploutchy).
146
+
* Added filter option to the socks command in ntlmrelayx CLI (@shoxxdj)
147
+
* Added ability to register DNS records through LDAP.
* Better handling of various XML files in Group Policy Preferences (@p0dalirius)
152
+
*[smbclient.py](examples/smbclient.py):
153
+
* Added recursive file listing (@Sq00ky)
154
+
*[ticketer.py](examples/ticketer.py):
155
+
* Ticket duration is now specified in hours instead of days (@Dramelac)
156
+
* Added extra-pac implementation (@Dramelac)
157
+
158
+
3. New examples
159
+
*[net.py](examples/net.py) Implementation of windows net.exe builtin tool (@NtAlexio2)
160
+
*[changepasswd.py](examples/changepasswd.py) New example that allows password changing or reseting through multiple protocols (@Alef-Burzmali, @snovvcrash, @bransh, @api0cradle and @p0dalirius)
161
+
*[DumpNTLMInfo.py](examples/DumpNTLMInfo.py) New example that dumps remote host information in ntlm authentication model, without credentials. For SMB protocols v1, v2 and v3. (@NtAlexio2)
162
+
163
+
As always, thanks a lot to all these contributors that make this library better every day (up to now):
[](https://github.com/fortra/impacket/actions/workflows/build_and_test.yml)
6
6
7
-
FORTRA. Copyright (C) 2022 Fortra. All rights reserved.
7
+
Copyright Fortra, LLC and its affiliated companies. All rights reserved.
8
8
9
9
Impacket was originally created by [SecureAuth](https://www.secureauth.com/labs/open-source-tools/impacket), and now maintained by Fortra's Core Security.
0 commit comments