Skip to content

Commit ebb0c2f

Browse files
committed
Merge remote-tracking branch 'ThePorgs/main' into fork/mohemiv/master
# Conflicts: # impacket/krb5/kerberosv5.py
2 parents f1608bd + 308b2a8 commit ebb0c2f

File tree

319 files changed

+20226
-5924
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

319 files changed

+20226
-5924
lines changed

.github/workflows/build_and_test.yml

Lines changed: 8 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -10,18 +10,18 @@ env:
1010

1111
jobs:
1212
lint:
13-
name: Check syntaxs errors and warnings
13+
name: Check syntax errors and warnings
1414
runs-on: ubuntu-latest
1515
if:
1616
github.event_name == 'push' || github.event.pull_request.head.repo.full_name !=
1717
github.repository
1818

1919
steps:
2020
- name: Checkout Impacket
21-
uses: actions/checkout@v2
21+
uses: actions/checkout@v3
2222

2323
- name: Setup Python 3.8
24-
uses: actions/setup-python@v2
24+
uses: actions/setup-python@v4
2525
with:
2626
python-version: 3.8
2727

@@ -48,24 +48,21 @@ jobs:
4848
strategy:
4949
fail-fast: false
5050
matrix:
51-
python-version: ["3.7", "3.8", "3.9"]
51+
python-version: ["3.9", "3.10","3.11","3.12"]
5252
experimental: [false]
5353
os: [ubuntu-latest]
5454
include:
55-
- python-version: "3.6"
56-
experimental: false
57-
os: ubuntu-20.04
58-
- python-version: "3.10"
55+
- python-version: "3.13-dev"
5956
experimental: true
6057
os: ubuntu-latest
6158
continue-on-error: ${{ matrix.experimental }}
6259

6360
steps:
6461
- name: Checkout Impacket
65-
uses: actions/checkout@v2
62+
uses: actions/checkout@v3
6663

6764
- name: Setup Python ${{ matrix.python-version }}
68-
uses: actions/setup-python@v2
65+
uses: actions/setup-python@v4
6966
with:
7067
python-version: ${{ matrix.python-version }}
7168

@@ -93,7 +90,7 @@ jobs:
9390
continue-on-error: true
9491
steps:
9592
- name: Checkout Impacket
96-
uses: actions/checkout@v2
93+
uses: actions/checkout@v3
9794

9895
- name: Build docker image
9996
run: |

ChangeLog.md

Lines changed: 161 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,166 @@ Project owner's main page is at www.coresecurity.com.
55
Complete list of changes can be found at:
66
https://github.com/fortra/impacket/commits/master
77

8+
## Impacket v0.12.0 (Sep 2024):
9+
1. Library improvements
10+
* Fixed broken hRSetServiceObjectSecurity method (@rkivys)
11+
* Removed dsinternals dependency (@anadrianmanrique)
12+
* Fixed srvs.hNetrShareEnum returning erronous shares (@cnotin)
13+
* Fixed lmhash computing to support non standard characters in the password (@anadrianmanrique)
14+
* Assorted fixes when processing Unicode data (@alexisbalbachan)
15+
* Added `[MS-GKDI]` Group Key Distribution Protocol implementation (@zblurx)
16+
* Fixed incorrect padding in SMBSessionSetupAndX_Extended_ResponseData (@rtpt-erikgeiser)
17+
* Upgraded dependency pyreadline -> pyreadline3 (@anadrianmanrique)
18+
* SMB Server:
19+
* Added query information level 0x0109 for smb1 "SMB_QUERY_FILE_STREAM_INFO" (@Adamkadaban)
20+
* Fixed filename encoding in queryPathInformation (@JerAxxxxxxx)
21+
* Fixed NextEntryOffset for large directory listings (@robnanola)
22+
* Fixed server returning an empty folder when cutting and pasting recursive directories (@robnanola)
23+
* DHCP: Fixed encoding issues (@ujwalkomarla)
24+
25+
3. Examples improvements
26+
* [secretsdump.py](examples/secretsdump.py):
27+
* Double DC Sync performance for DCs supporting SID lookups (@tomspencer)
28+
* Added ability to skip dumping of SAM or SECURITY hives when performing remote operations (@RazzburyPi)
29+
* Added ability to specify users to skip when dumping NTDS (@RazzburyPi)
30+
* [ticketer.py](examples/ticketer.py):
31+
* Support to create Sapphire tickets (@ShutdownRepo)
32+
* [GetUserSPNs.py](examples/GetUserSPNs.py), [getTGT.py](examples/getTGT.py):
33+
* Support for Kerberoasting without pre-authentication and ST request through AS-REQ (@ShutdownRepo)
34+
* [wmiexec.py](examples/wmiexec.py):
35+
* Fix kerberos with remoteHost & add '-target-ip'(@XiaoliChan)
36+
* [ntlmrelayx.py](examples/ntlmrelayx.py):
37+
* Added the creation of a new machine account through SMB (@BlWasp)
38+
* NTLMRelayX Multirelay fixes for target handling, added --keep-relaying flag (@alexisbalbachan)
39+
* Logging multirelay status when triggering the example (@gabrielg5)
40+
* Write certificates to file rather than outputting b64 to console (@RazzburyPi)
41+
* Improved ability to continue relaying to ADCS web enrollment endpoint in order to request multiple certificates for different users (@RazzburyPi)
42+
* Fixed compatibility issue with other SMB clients connecting to the SOCKS proxy created by ntlmrelayx (@jfjallid)
43+
* Allow configuration of the SOCKS5 address and port (@rtpt-erikgeiser)
44+
* Fixed implementation of MSSQLShell (@gabrielg5)
45+
* Logging notification of received connections in all relay servers (@gabrielg5)
46+
* Add domain and username to interactive Ldap shell message (@minniear)
47+
* Enhanced MSSQLShell in NTLMRelayX leveraging TcpShell & output messages (@gabrielg5)
48+
* LDAP Attack: Bugfixes when parsing responses (@SAERXCIT)
49+
* [getST.py](examples/getST.py):
50+
* Added -self, -altservice and -u2u for S4U2self abuse, S4U2self+u2u, and service substitution (@ShutdownRepo)
51+
* Added ability to set the RENEW ticket option to renew a TGT (@shikatano)
52+
* Fixed unicode encoding error when using the -impersonate flag (@alexisbalbachan)
53+
* [getTGT.py](examples/getTGT.py):
54+
* Added principalType as new parameter (@DevSpork)
55+
* [reg.py](examples/reg.py):
56+
* Start remote registry as unprivileged user in reg.py (@dadevel)
57+
* Allow adding Binary values (@dc3l1ne)
58+
* Add missing Null byte for REG_SZ values (@PfiatDe)
59+
* Support for adding REG_MULTI_SZ values through (@garbrielg5)
60+
* [smbclient.py](examples/smbclient.py):
61+
* Added ability to provide an output file that the smbclient mini shell will write commands and output to (@RazzburyPi)
62+
* Fixed path parse issue when running `tree` command (@trietend)
63+
* [smbserver.py](examples/smbserver.py):
64+
* Added parameter "-outputfile" to set smbserver log file(gabrielg5)
65+
* [DumpNTLMInfo.py](examples/DumpNTLMInfo.py):
66+
* Allow execution on non-default ports (@jeffmcjunkin)
67+
* Fixed KeyError exception when running with a Windows 2003 target (@XiaoliChan)
68+
* [findDelegation.py](examples/findDelegation.py):
69+
* Added new column to show if SPN exists (@p0dalirius)
70+
* [mssqlclient.py](examples/mssqlclient.py):
71+
* Added `-target-ip` parameter to allow Kerberos authentication without much change in the DNS configuration of the local machine (@Palkovsky)
72+
* [mssqlshell.py](examples/mssqlshell.py):
73+
* Switching back to original DB after running `enum_impersonate` command (@exploide)
74+
* Fixed logging in printReplies showing error messages (@gabrielg5)
75+
* [registry-read.py](examples/registry-read.py):
76+
* Fixed scenario where value name contains backlash (@DidierA)
77+
* [net.py](examples/net.py):
78+
* Fixed User "Account Active" property value (@marcobarlottini)
79+
* Fixed log messages printing variables in the wrong order (@Cyb3rC3lt)
80+
* [rbcd.py](examples/rbcd.py):
81+
* Handled SID not found in LDAP error (@ShutdownRepo)
82+
* [GetUserSPNs.py](examples/GetUserSPNs.py):
83+
* Updated the help information for -outputfile to be consistent with -save (@scarvell)
84+
* [ntfs-read.py](examples/ntfs-read.py):
85+
* Minor refactor in ntfs-read.py to make it more human-readable (@NtAlexio2)
86+
* [ldap_shell.py](examples/ldap_shell.py):
87+
* Added support for dirsync and whoami commands (@nurfed1)
88+
* [lookupsid.py](examples/lookupsid.py):
89+
* Now supports kerberos auth (@A1vinSmith)
90+
* [samrdump.py](examples/samrdump.py):
91+
* Will fetch AdminComment using MSRPC (@joeldeleep)
92+
* [tstool.py](examples/tstool.py):
93+
* Added support for kerberos auth, resolves SIDs (@nopernik)
94+
95+
4. New examples
96+
* [describeTicket.py](examples/describeTicket.py): Ticket describer and decrypter. (@ShutdownRepo)
97+
* [GetADComputers.py](examples/GetADComputers.py): Query's DC via LDAP and returns the COMPUTER objects and the useful attributes such as full dns name, operating system name and version. (@F-Masood)
98+
* [GetLAPSPassword.py](examples/GetLAPSPassword.py): Extract LAPS passwords from LDAP (@zblurx and @dru1d-foofus)
99+
* [dacledit.py](examples/dacledit.py): This script can be used to read, write, remove, backup, restore ACEs (Access Control Entries) in an object DACL (Discretionary Access Control List). (@ShutdownRepo) (@BlWasp_) (@Wlayzz)
100+
* [owneredit.py](examples/owneredit.py): Added this script to abuse WriteOwner (ADS_RIGHT_WRITE_OWNER) access rights. This allows to take ownership of another object, and then edit that object's DACL (@ShutdownRepo) (@BlWasp_)
101+
102+
As always, thanks a lot to all these contributors that make this library better every day (up to now):
103+
104+
@tomspencer @anadrianmanrique @ShutdownRepo @dadevel @gjhami @NtAlexio2 @F-Masood @BlWasp @gabrielg5 @XiaoliChan @omry99 @Wlayzz @themaks @alexisbalbachan @RazzburyPi @jeffmcjunkin @p0dalirius @dc3l1ne @jfjallid @Palkovsky @rtpt-erikgeiser @trietend @zblurx @dru1d-foofus @PfiatDe @DidierA @marcobarlottini @PeterGabaldon @m8r1us @5yn @tzuralon @Adamkadaban @scarvell @JerAxxxxxxx @ujwalkomarla @robnanola @SAERXCIT @nurfed1 @A1vinSmith @joeldeleep @nopernik
105+
106+
107+
## Impacket v0.11.0 (Aug 2023):
108+
1. Library improvements
109+
* Added new Kerberos error codes (@ly4k).
110+
* Added `[MS-TSTS]` Terminal Services Terminal Server Runtime Interface Protocol implementation (@nopernik).
111+
* Changed the setting up for new SSL connections (@mpgn, @CT-H00K and @0xdeaddood).
112+
* Added a callback function to smbserver for incoming authentications (@p0dalirius).
113+
* Fix crash in winregistry (@laxa)
114+
* Fixes in IDispatch derived classes in comev implementation (@NtAlexio2)
115+
* Fix CVE-2020-17049 in ccache.py (@godylockz)
116+
* Smbserver: Added SMB2_FILE_ALLOCATION_INFO type determination (@JerAxxxxxxx)
117+
* tds: Fixed python3 incompatibility when receiving over TLS socket (@exploide)
118+
* crypto: Ensure passwords are utf-8 encoded before deriving Kerberos keys (@jojonas)
119+
* ese: Fixed python3 incompatibility when reading from db (@alexisbalbachan)
120+
* ldap queries: Escaped characters are now correctly parsed (@alexisbalbachan)
121+
* Support SASL authentication in ldap protocol (@NtAlexio2)
122+
123+
2. Examples improvements
124+
* [GetADUsers.py](examples/GetADUsers.py), [GetNPUsers.py](examples/GetNPUsers.py), [GetUserSPNs.py](examples/GetUserSPNs.py) and [findDelegation.py](examples/findDelegation.py):
125+
* Added dc-host option to connect to specific KDC using its FQDN or NetBIOS name (@rmaksimov and @0xdeaddood).
126+
* [GetNPUsers.py](examples/GetNPUsers.py)
127+
* Printing TGT in stdout despite -outputfile parameter (@alexisbalbachan and @Zamanry)
128+
* Fixed output hash format for AES128/256 (etype 17/18) (@erasmusc)
129+
* [GetUserSPNs.py](examples/GetUserSPNs.py):
130+
* Added LDAP paged search (@ThePirateWhoSmellsOfSunflowers and @SAERXCIT).
131+
* Added a -stealth flag to remove the SPN filter from the LDAP query (@clavoillotte).
132+
* Improved searchFilter (@ShutdownRepo)
133+
* Use LDAP paged search (@ThePirateWhoSmellsOfSunflowers)
134+
* [psexec.py](examples/psexec.py):
135+
* Added support for name customization using a custom binary file (@Dramelac).
136+
* [smbexec.py](examples/smbexec.py):
137+
* Security fixes for privilege escalation vulnerabilities (@bugch3ck).
138+
* Fixed python3 compatibility issues, added workaround TCP over NetBIOS being disabled (@ljrk0)
139+
* [secretsdump.py](examples/secretsdump.py):
140+
* Added a new option to extract only NTDS.DIT data for specific users based on an LDAP filter (@snovvcrash).
141+
* Security fixes for privilege escalation vulnerabilities (@bugch3ck).
142+
* [mssqlclient.py](examples/mssqlclient.py):
143+
* Added multiple new commands. Now supports xp_dirtree execution (@Mayfly277, @trietend and @TurtleARM).
144+
* [ntlmrelayx.py](examples/ntlmrelayx.py):
145+
* Added ability to trigger SQLShell when running ntlmrelayx in interactive mode (@sploutchy).
146+
* Added filter option to the socks command in ntlmrelayx CLI (@shoxxdj)
147+
* Added ability to register DNS records through LDAP.
148+
* [addcomputer.py](examples/addcomputer.py), [rbcd.py](examples/rbcd.py):
149+
* Allow weak TLS ciphers for LDAP connections (@AdrianVollmer)
150+
* [Get-GPPPassword.py](examples/Get-GPPPassword.py):
151+
* Better handling of various XML files in Group Policy Preferences (@p0dalirius)
152+
* [smbclient.py](examples/smbclient.py):
153+
* Added recursive file listing (@Sq00ky)
154+
* [ticketer.py](examples/ticketer.py):
155+
* Ticket duration is now specified in hours instead of days (@Dramelac)
156+
* Added extra-pac implementation (@Dramelac)
157+
158+
3. New examples
159+
* [net.py](examples/net.py) Implementation of windows net.exe builtin tool (@NtAlexio2)
160+
* [changepasswd.py](examples/changepasswd.py) New example that allows password changing or reseting through multiple protocols (@Alef-Burzmali, @snovvcrash, @bransh, @api0cradle and @p0dalirius)
161+
* [DumpNTLMInfo.py](examples/DumpNTLMInfo.py) New example that dumps remote host information in ntlm authentication model, without credentials. For SMB protocols v1, v2 and v3. (@NtAlexio2)
162+
163+
As always, thanks a lot to all these contributors that make this library better every day (up to now):
164+
165+
@ly4k @nopernik @snovvcrash @ShutdownRepo @kiwids0220 @mpgn @CT-H00K @rmaksimov @arossert @aevy-syn @tirkarthi @p0dalirius @Dramelac @Mayfly277 @S3cur3Th1sSh1t @nobbd @AdrianVollmer @trietend @TurtleARM @ThePirateWhoSmellsOfSunflowers @SAERXCIT @clavoillotte @Marshall-Hallenbeck @sploutchy @almandin @rtpt-alexanderneumann @JerAxxxxxxx @NtAlexio2 @laxa @godylockz @exploide @jojonas @Zamanry @erasmusc @bugch3ck @ljrk0 @Sq00ky @shoxxdj @Alef-Burzmali @bransh @api0cradle @alexisbalbachan @0xdeaddood @NtAlexio2 @sanmopre
166+
167+
8168
## Impacket v0.10.0 (May 2022):
9169

10170
1. Library improvements
@@ -562,7 +722,7 @@ As always, thanks a lot to all these contributors that make this library better
562722
UUIDs used and that information is included as well. This could be helpful when reading a portmap output and to
563723
develop new functionality to interact against a target interface.
564724
* `smbexec.py`: Another alternative to psexec. Less capabilities but might work on tight AV environments. Based on the
565-
technique described at https://www.optiv.com/blog/owning-computers-without-shell-access. It also
725+
technique described at https://web.archive.org/web/20190515131124/https://www.optiv.com/blog/owning-computers-without-shell-access. It also
566726
supports instantiating a local smbserver to receive the output of the commandos executed for those situations
567727
where no share is available on the other end.
568728
* `smbrelayx.py`: It now also listens on port 80 and forwards/reflects the credentials accordingly.

README.md

Lines changed: 11 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Impacket
44
[![Latest Version](https://img.shields.io/pypi/v/impacket.svg)](https://pypi.python.org/pypi/impacket/)
55
[![Build and test Impacket](https://github.com/fortra/impacket/actions/workflows/build_and_test.yml/badge.svg)](https://github.com/fortra/impacket/actions/workflows/build_and_test.yml)
66

7-
FORTRA. Copyright (C) 2022 Fortra. All rights reserved.
7+
Copyright Fortra, LLC and its affiliated companies. All rights reserved.
88

99
Impacket was originally created by [SecureAuth](https://www.secureauth.com/labs/open-source-tools/impacket), and now maintained by Fortra's Core Security.
1010

@@ -50,47 +50,36 @@ Getting Impacket
5050

5151
### Latest version
5252

53-
* Impacket v0.10.0
53+
* Impacket v0.12.0
5454

5555
[![Python versions](https://img.shields.io/pypi/pyversions/impacket.svg)](https://pypi.python.org/pypi/impacket/)
5656

5757
[Current and past releases](https://github.com/fortra/impacket/releases)
5858

5959
### Development version
6060

61-
* Impacket v0.10.1-dev (**[master branch](https://github.com/fortra/impacket/tree/master)**)
61+
* Impacket v0.13.0-dev (**[master branch](https://github.com/fortra/impacket/tree/master)**)
6262

63-
[![Python versions](https://img.shields.io/badge/python-3.6%20|%203.7%20|%203.8%20|%203.9-blue.svg)](https://github.com/fortra/impacket/tree/master)
63+
[![Python versions](https://img.shields.io/badge/python-3.8%20|%203.9%20|%203.10%20|%203.11%20|%203.12-blue.svg)](https://github.com/fortra/impacket/tree/master)
6464

6565

6666
Setup
6767
=====
6868

6969
### Quick start
7070

71-
In order to grab the latest stable release with `pip` run:
71+
> :information_source: We recommend using `pipx` over `pip` for system-wide installations.
7272
73-
python3 -m pip install impacket
73+
In order to grab the latest stable release run:
7474

75-
> :information_source: This will make the Impacket library available to
76-
your Python code, but will not provide you with the example scripts.
75+
python3 -m pipx install impacket
7776

78-
### Installing the library + example scripts
79-
80-
In order to install the library and the example scripts, download and
77+
If you want to play with the unreleased changes, download the development
78+
version from the [master branch](https://github.com/fortra/impacket/tree/master),
8179
extract the package, and execute the following command from the
82-
directory where the Impacket's release has been unpacked:
83-
84-
python3 -m pip install .
85-
86-
> :information_source: This will install the library into the default Python
87-
modules path, where you can make use of the example scripts from the directory.
88-
89-
> :warning: Make sure the example scripts you're using are consistent with the
90-
library version that's installed in your python environment.
91-
We recommend using [virtual environments](https://docs.python.org/3/library/venv.html) to
92-
make sure system-wide installations doesn't interfere with it.
80+
directory where Impacket has been unpacked:
9381

82+
python3 -m pipx install .
9483

9584
### Docker Support
9685

0 commit comments

Comments
 (0)