Commit Graph

7 Commits

Author SHA1 Message Date
adfoster-r7 76166c0d14 Update SAMR computer and ICPR cert to support SMB sessions 2024-03-01 17:53:58 +00:00
Christophe De La Fuente 3d22fbcad9 Add exploit module for Certifried exploit
- Move all the logic from `modules/auxiliary/admin/dcerpc/icpr_cert.rb`
  to `lib/msf/core/exploit/remote/ms_icpr.rb` library
- Move all the logic from `modules/auxiliary/admin/dcerpc/samr_computer.rb`
  to `lib/msf/core/exploit/remote/ms_samr.rb` library
- Add `modules/auxiliary/admin/dcerpc/cve_2022_26923_certifried.rb` module
- Update the SMB client to disable SSL by default
- Add documentation
- Kerbero client: pass `options` as argument to `send_request_as`
- `calculate_shared_key` returns an EncryptionKey instead of the raw key
- Update `pkinit_login` module to make it compatible
- Add support to `additional_tickets` when requesting tickets
- Add support to PAC CredentialInfo structures
- Add impersonation to escalate privileges
- Add ACTIONS
- Use elevated TGS to delete the computer account
- Update and add specs
2023-01-13 15:30:50 +01:00
Spencer McIntyre f4a65a220a Support ON_BEHALF_OF in icpr_cert
Add the code necessary to request certificates on behalf of other users.
This is necessary to exploit templates vulnerable to ESC2 and ESC3.
2022-11-17 12:12:35 -05:00
Spencer McIntyre b0fe5e1620 Cleanup the code a bit 2022-08-30 11:12:36 -04:00
Spencer McIntyre 69cc144e04 Add module docs 2022-08-30 11:12:36 -04:00
Spencer McIntyre 86804ce5b8 Add specific UPN and DNS support; switch to pipes 2022-08-30 11:12:36 -04:00
Spencer McIntyre cd13039aae Add the initial MS-ICPR module 2022-08-30 11:12:36 -04:00