feat: Compute gMSA AES keys when using --gmsa#1125
feat: Compute gMSA AES keys when using --gmsa#1125Ne0re0 wants to merge 2 commits intoPennyw0rth:mainfrom
Conversation
Ne0re0
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
|
Hi and thanks for the PR. Nice idea, but what is 988131e about? Please also elaborate the use of AI, as requested in the PR template: |
| ggroup.add_argument("--gmsa-convert-id", help="Get the secret name of specific gmsa or all gmsa if no gmsa provided") | ||
| ggroup.add_argument("--gmsa-decrypt-lsa", help="Decrypt the gmsa encrypted value from LSA") | ||
|
|
||
| ldap_parser.add_argument( |
There was a problem hiding this comment.
Please put this all on one line
|
|
||
| # Allow explicit override for cross-domain/cross-forest enumeration | ||
| if getattr(self.args, "target_domain", None): | ||
| self.baseDN = ",".join([f"DC={part}" for part in self.args.target_domain.split(".")]) |
There was a problem hiding this comment.
variable naming should by pythonic, e.g. base_dn and target_domain
| ntlm_hash = MD4.new() | ||
| ntlm_hash.update(currentPassword) | ||
| passwd = hexlify(ntlm_hash.digest()).decode("utf-8") | ||
| # Compute Kerberos AES keys |
There was a problem hiding this comment.
This code is used twice but with only one different, it should be functionalized so there isn't the same code in two separate places if that is possible
There was a problem hiding this comment.
I factorized as much code as possible and removed duplicated code in the NT hash computation as well :)
|
Hi! Oops, I didn't realize commits to the same branch would sync directly to this PR. Sorry about that... The extra changes were entirely claude coded and not meant to be included. I'll revert it back to the first commit. Would you prefer a fresh PR or should we continue with this one? |
Absolutely fine to continue on in here👍 |
|
Hey! I pr'ed an gmsadump script to impacket and I think it might be helpful for this :3 fortra/impacket#2171 We can simply use the generate_kerberos_keys() from impacket.krb5.crypto function to get the ntlm, aes128 and aes256 creds from the password blob |
4 participants
Description
This PR computes both
aes128-cts-hmac-sha1-96andaes256-cts-hmac-sha1-96keys when using--gmsawithnxc ldap, provided the specified user hasReadGMSAPasswordrights over a gMSA account.This is a re-implementation of the logic from the gMSADumper tool.
Type of change
Setup guide for the review
To test this, you need a user with
ReadGMSAPasswordrights over a gMSA account. Run:Screenshots (if appropriate):
Checklist:
poetry run ruff check ., use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)