jenkins-metasploit
1680 lines
126 KiB
HTML
1680 lines
126 KiB
HTML
<!DOCTYPE html>
|
|
<html>
|
|
<head>
|
|
<meta charset="utf-8">
|
|
<meta name="viewport" content="width=device-width, initial-scale=1.0">
|
|
<title>
|
|
Module: Msf::Exploit::Remote::Kerberos::Ticket
|
|
|
|
— Documentation by YARD 0.9.37
|
|
|
|
</title>
|
|
|
|
<link rel="stylesheet" href="../../../../css/style.css" type="text/css" />
|
|
|
|
<link rel="stylesheet" href="../../../../css/common.css" type="text/css" />
|
|
|
|
<script type="text/javascript">
|
|
pathId = "Msf::Exploit::Remote::Kerberos::Ticket";
|
|
relpath = '../../../../';
|
|
</script>
|
|
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../../js/jquery.js"></script>
|
|
|
|
<script type="text/javascript" charset="utf-8" src="../../../../js/app.js"></script>
|
|
|
|
|
|
</head>
|
|
<body>
|
|
<div class="nav_wrap">
|
|
<iframe id="nav" src="../../../../class_list.html?1"></iframe>
|
|
<div id="resizer"></div>
|
|
</div>
|
|
|
|
<div id="main" tabindex="-1">
|
|
<div id="header">
|
|
<div id="menu">
|
|
|
|
<a href="../../../../_index.html">Index (T)</a> »
|
|
<span class='title'><span class='object_link'><a href="../../../../Msf.html" title="Msf (module)">Msf</a></span></span> » <span class='title'><span class='object_link'><a href="../../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span> » <span class='title'><span class='object_link'><a href="../../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span> » <span class='title'><span class='object_link'><a href="../Kerberos.html" title="Msf::Exploit::Remote::Kerberos (module)">Kerberos</a></span></span>
|
|
»
|
|
<span class="title">Ticket</span>
|
|
|
|
</div>
|
|
|
|
<div id="search">
|
|
|
|
<a class="full_list_link" id="class_list_link"
|
|
href="../../../../class_list.html">
|
|
|
|
<svg width="24" height="24">
|
|
<rect x="0" y="4" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="12" width="24" height="4" rx="1" ry="1"></rect>
|
|
<rect x="0" y="20" width="24" height="4" rx="1" ry="1"></rect>
|
|
</svg>
|
|
</a>
|
|
|
|
</div>
|
|
<div class="clear"></div>
|
|
</div>
|
|
|
|
<div id="content"><h1>Module: Msf::Exploit::Remote::Kerberos::Ticket
|
|
|
|
|
|
|
|
</h1>
|
|
<div class="box_info">
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<dl>
|
|
<dt>Defined in:</dt>
|
|
<dd>lib/msf/core/exploit/remote/kerberos/ticket.rb<span class="defines">,<br />
|
|
lib/msf/core/exploit/remote/kerberos/ticket/storage.rb</span>
|
|
</dd>
|
|
</dl>
|
|
|
|
</div>
|
|
|
|
<h2>Defined Under Namespace</h2>
|
|
<p class="children">
|
|
|
|
|
|
<strong class="modules">Modules:</strong> <span class='object_link'><a href="Ticket/Storage.html" title="Msf::Exploit::Remote::Kerberos::Ticket::Storage (module)">Storage</a></span>
|
|
|
|
|
|
|
|
|
|
</p>
|
|
|
|
|
|
<h2>
|
|
Constant Summary
|
|
<small><a href="#" class="constants_summary_toggle">collapse</a></small>
|
|
</h2>
|
|
|
|
<dl class="constants">
|
|
|
|
<dt id="GROUP_IDS-constant" class="">GROUP_IDS =
|
|
|
|
</dt>
|
|
<dd><pre class="code"><span class='lbracket'>[</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#DOMAIN_USERS-constant" title="Rex::Proto::Kerberos::Pac::DOMAIN_USERS (constant)">DOMAIN_USERS</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#DOMAIN_ADMINS-constant" title="Rex::Proto::Kerberos::Pac::DOMAIN_ADMINS (constant)">DOMAIN_ADMINS</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#GROUP_POLICY_CREATOR_OWNERS-constant" title="Rex::Proto::Kerberos::Pac::GROUP_POLICY_CREATOR_OWNERS (constant)">GROUP_POLICY_CREATOR_OWNERS</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#SCHEMA_ADMINISTRATORS-constant" title="Rex::Proto::Kerberos::Pac::SCHEMA_ADMINISTRATORS (constant)">SCHEMA_ADMINISTRATORS</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#ENTERPRISE_ADMINS-constant" title="Rex::Proto::Kerberos::Pac::ENTERPRISE_ADMINS (constant)">ENTERPRISE_ADMINS</a></span></span><span class='comma'>,</span>
|
|
<span class='rbracket'>]</span></pre></dd>
|
|
|
|
</dl>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<h2>
|
|
Instance Method Summary
|
|
<small><a href="#" class="summary_toggle">collapse</a></small>
|
|
</h2>
|
|
|
|
<ul class="summary">
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#ccache%3F-instance_method" title="#ccache? (instance method)">#<strong>ccache?</strong>(header) ⇒ Boolean </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#create_ccache_principal-instance_method" title="#create_ccache_principal (instance method)">#<strong>create_ccache_principal</strong>(principle, realm) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#create_enc_ticket_part-instance_method" title="#create_enc_ticket_part (instance method)">#<strong>create_enc_ticket_part</strong>(opts:) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#create_new_sid-instance_method" title="#create_new_sid (instance method)">#<strong>create_new_sid</strong>(existing_sid, new_rid) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#create_principal-instance_method" title="#create_principal (instance method)">#<strong>create_principal</strong>(name) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#encrypt_ticket_enc_part-instance_method" title="#encrypt_ticket_enc_part (instance method)">#<strong>encrypt_ticket_enc_part</strong>(ticket_enc_part:, key:, enc_type:) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#forge_ticket-instance_method" title="#forge_ticket (instance method)">#<strong>forge_ticket</strong>(enc_key:, enc_type:, start_time:, end_time:, sname:, flags:, domain:, username:, user_id: Rex::Proto::Kerberos::Pac::DEFAULT_ADMIN_RID, domain_sid:, extra_sids: [], session_key: nil, ticket_checksum: false, is_golden: true) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#get_checksum_type-instance_method" title="#get_checksum_type (instance method)">#<strong>get_checksum_type</strong>(enc_type) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#kirbi%3F-instance_method" title="#kirbi? (instance method)">#<strong>kirbi?</strong>(header) ⇒ Boolean </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#modify_ticket-instance_method" title="#modify_ticket (instance method)">#<strong>modify_ticket</strong>(ticket, enc_kdc_response, new_user, new_user_rid, domain, extra_sids, ticket_decryption_key, ticket_encryption_type, ticket_encryption_key, copy_entire_pac) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'>
|
|
<p>Take an existing ticket and change its PAC to have the provided user value (Used for diamond ticket functionality).</p>
|
|
</div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#print_ccache_contents-instance_method" title="#print_ccache_contents (instance method)">#<strong>print_ccache_contents</strong>(ccache, key: nil) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#print_contents-instance_method" title="#print_contents (instance method)">#<strong>print_contents</strong>(path, key: nil) ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#tgs_flags-instance_method" title="#tgs_flags (instance method)">#<strong>tgs_flags</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#tgt_flags-instance_method" title="#tgt_flags (instance method)">#<strong>tgt_flags</strong> ⇒ Object </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
<li class="public ">
|
|
<span class="summary_signature">
|
|
|
|
<a href="#ticket_as_krb5ccache-instance_method" title="#ticket_as_krb5ccache (instance method)">#<strong>ticket_as_krb5ccache</strong>(ticket, opts:) ⇒ Rex::Proto::Kerberos::CredentialCache::Krb5Ccache </a>
|
|
|
|
|
|
|
|
</span>
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
<span class="summary_desc"><div class='inline'></div></span>
|
|
|
|
</li>
|
|
|
|
|
|
</ul>
|
|
|
|
|
|
|
|
|
|
<div id="instance_method_details" class="method_details_list">
|
|
<h2>Instance Method Details</h2>
|
|
|
|
|
|
<div class="method_details first">
|
|
<h3 class="signature first" id="ccache?-instance_method">
|
|
|
|
#<strong>ccache?</strong>(header) ⇒ <tt>Boolean</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
<p class="tag_title">Returns:</p>
|
|
<ul class="return">
|
|
|
|
<li>
|
|
|
|
|
|
<span class='type'>(<tt>Boolean</tt>)</span>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
282
|
|
283
|
|
284</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 282</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_ccache?'>ccache?</span><span class='lparen'>(</span><span class='id identifier rubyid_header'>header</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_header'>header</span><span class='lbracket'>[</span><span class='int'>0</span><span class='op'>..</span><span class='int'>1</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x05\x04</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="create_ccache_principal-instance_method">
|
|
|
|
#<strong>create_ccache_principal</strong>(principle, realm) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
276
|
|
277
|
|
278
|
|
279
|
|
280</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 276</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_create_ccache_principal'>create_ccache_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_principle'>principle</span><span class='comma'>,</span> <span class='id identifier rubyid_realm'>realm</span><span class='rparen'>)</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache.html" title="Rex::Proto::Kerberos::CredentialCache (module)">CredentialCache</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5CcachePrincipal.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5CcachePrincipal (class)">Krb5CcachePrincipal</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span><span class='label'>name_type:</span> <span class='id identifier rubyid_principle'>principle</span><span class='period'>.</span><span class='id identifier rubyid_name_type'>name_type</span><span class='comma'>,</span>
|
|
<span class='label'>components:</span> <span class='id identifier rubyid_principle'>principle</span><span class='period'>.</span><span class='id identifier rubyid_name_string'>name_string</span><span class='comma'>,</span>
|
|
<span class='label'>realm:</span> <span class='id identifier rubyid_realm'>realm</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="create_enc_ticket_part-instance_method">
|
|
|
|
#<strong>create_enc_ticket_part</strong>(opts:) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
196
|
|
197
|
|
198
|
|
199
|
|
200
|
|
201
|
|
202
|
|
203
|
|
204
|
|
205
|
|
206
|
|
207
|
|
208
|
|
209
|
|
210
|
|
211
|
|
212
|
|
213
|
|
214
|
|
215
|
|
216
|
|
217</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 196</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_create_enc_ticket_part'>create_enc_ticket_part</span><span class='lparen'>(</span><span class='label'>opts:</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketEncPart.html" title="Rex::Proto::Kerberos::Model::TicketEncPart (class)">TicketEncPart</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span>
|
|
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_key'>key</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/EncryptionKey.html" title="Rex::Proto::Kerberos::Model::EncryptionKey (class)">EncryptionKey</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
|
<span class='label'>type:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:enc_type</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>value:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:session_key</span><span class='rbracket'>]</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_flags'>flags</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:flags</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_crealm'>crealm</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_cname'>cname</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:client</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_transited'>transited</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TransitedEncoding.html" title="Rex::Proto::Kerberos::Model::TransitedEncoding (class)">TransitedEncoding</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='label'>tr_type:</span> <span class='int'>0</span><span class='comma'>,</span> <span class='label'>contents:</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_authtime'>authtime</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:auth_time</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_starttime'>starttime</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:start_time</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_endtime'>endtime</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:end_time</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_renew_till'>renew_till</span> <span class='op'>=</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:renew_till</span><span class='rbracket'>]</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:create_ticket_checksum</span><span class='rbracket'>]</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:ticket_checksum</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_create_ticket_checksum'>create_ticket_checksum</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:checksum_type</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:checksum_enc_key</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_authorization_data'>authorization_data</span> <span class='op'>=</span> <span class='id identifier rubyid_build_pac_authorization_data'>build_pac_authorization_data</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="create_new_sid-instance_method">
|
|
|
|
#<strong>create_new_sid</strong>(existing_sid, new_rid) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
189
|
|
190
|
|
191
|
|
192
|
|
193
|
|
194</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 189</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_create_new_sid'>create_new_sid</span><span class='lparen'>(</span><span class='id identifier rubyid_existing_sid'>existing_sid</span><span class='comma'>,</span> <span class='id identifier rubyid_new_rid'>new_rid</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_existing_sid'>existing_sid</span> <span class='op'>=</span> <span class='id identifier rubyid_existing_sid'>existing_sid</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span>
|
|
<span class='id identifier rubyid_domain_sid'>domain_sid</span> <span class='op'>=</span> <span class='id identifier rubyid_existing_sid'>existing_sid</span><span class='lbracket'>[</span><span class='int'>0</span><span class='op'>..</span><span class='id identifier rubyid_existing_sid'>existing_sid</span><span class='period'>.</span><span class='id identifier rubyid_rindex'>rindex</span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>-</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span><span class='rbracket'>]</span>
|
|
|
|
<span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_domain_sid'>domain_sid</span><span class='embexpr_end'>}</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_new_rid'>new_rid</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="create_principal-instance_method">
|
|
|
|
#<strong>create_principal</strong>(name) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
269
|
|
270
|
|
271
|
|
272
|
|
273
|
|
274</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 269</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_create_principal'>create_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_name'>name</span><span class='rparen'>)</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/PrincipalName.html" title="Rex::Proto::Kerberos::Model::PrincipalName (class)">PrincipalName</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
|
<span class='label'>name_type:</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/NameType.html" title="Rex::Proto::Kerberos::Model::NameType (module)">NameType</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/NameType.html#NT_PRINCIPAL-constant" title="Rex::Proto::Kerberos::Model::NameType::NT_PRINCIPAL (constant)">NT_PRINCIPAL</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>name_string:</span> <span class='const'>Array</span><span class='period'>.</span><span class='id identifier rubyid_wrap'>wrap</span><span class='lparen'>(</span><span class='id identifier rubyid_name'>name</span><span class='rparen'>)</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="encrypt_ticket_enc_part-instance_method">
|
|
|
|
#<strong>encrypt_ticket_enc_part</strong>(ticket_enc_part:, key:, enc_type:) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
219
|
|
220
|
|
221
|
|
222
|
|
223
|
|
224
|
|
225
|
|
226
|
|
227
|
|
228
|
|
229</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 219</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_encrypt_ticket_enc_part'>encrypt_ticket_enc_part</span><span class='lparen'>(</span><span class='label'>ticket_enc_part:</span><span class='comma'>,</span> <span class='label'>key:</span><span class='comma'>,</span> <span class='label'>enc_type:</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_enc_class'>enc_class</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html" title="Rex::Proto::Kerberos::Crypto::Encryption (module)">Encryption</a></span></span><span class='period'>.</span><span class='id identifier rubyid_from_etype'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html#from_etype-class_method" title="Rex::Proto::Kerberos::Crypto::Encryption.from_etype (method)">from_etype</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_enc_type'>enc_type</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_encrypted'>encrypted</span> <span class='op'>=</span> <span class='id identifier rubyid_enc_class'>enc_class</span><span class='period'>.</span><span class='id identifier rubyid_encrypt'>encrypt</span><span class='lparen'>(</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_encode'>encode</span><span class='comma'>,</span> <span class='id identifier rubyid_key'>key</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/KeyUsage.html" title="Rex::Proto::Kerberos::Crypto::KeyUsage (module)">KeyUsage</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/KeyUsage.html#KDC_REP_TICKET-constant" title="Rex::Proto::Kerberos::Crypto::KeyUsage::KDC_REP_TICKET (constant)">KDC_REP_TICKET</a></span></span>
|
|
<span class='rparen'>)</span>
|
|
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/EncryptedData.html" title="Rex::Proto::Kerberos::Model::EncryptedData (class)">EncryptedData</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
|
<span class='label'>etype:</span> <span class='id identifier rubyid_enc_type'>enc_type</span><span class='comma'>,</span> <span class='label'>kvno:</span> <span class='int'>2</span><span class='comma'>,</span> <span class='label'>cipher:</span> <span class='id identifier rubyid_encrypted'>encrypted</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="forge_ticket-instance_method">
|
|
|
|
#<strong>forge_ticket</strong>(enc_key:, enc_type:, start_time:, end_time:, sname:, flags:, domain:, username:, user_id: Rex::Proto::Kerberos::Pac::DEFAULT_ADMIN_RID, domain_sid:, extra_sids: [], session_key: nil, ticket_checksum: false, is_golden: true) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
<p class="tag_title">Parameters:</p>
|
|
<ul class="param">
|
|
|
|
<li>
|
|
|
|
<span class='name'>session_key</span>
|
|
|
|
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>nil</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The session key</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>extra_sids</span>
|
|
|
|
|
|
<span class='type'>(<tt>Array<String></tt>)</span>
|
|
|
|
|
|
<em class="default">(defaults to: <tt>[]</tt>)</em>
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>An array of extra sids, Ex: '['S-1-5-etc-etc-519']'</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
35
|
|
36
|
|
37
|
|
38
|
|
39
|
|
40
|
|
41
|
|
42
|
|
43
|
|
44
|
|
45
|
|
46
|
|
47
|
|
48
|
|
49
|
|
50
|
|
51
|
|
52
|
|
53
|
|
54
|
|
55
|
|
56
|
|
57
|
|
58
|
|
59
|
|
60
|
|
61
|
|
62
|
|
63
|
|
64
|
|
65
|
|
66
|
|
67
|
|
68
|
|
69
|
|
70
|
|
71
|
|
72
|
|
73
|
|
74
|
|
75
|
|
76
|
|
77
|
|
78
|
|
79
|
|
80
|
|
81
|
|
82
|
|
83
|
|
84
|
|
85</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 35</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_forge_ticket'>forge_ticket</span><span class='lparen'>(</span><span class='label'>enc_key:</span><span class='comma'>,</span> <span class='label'>enc_type:</span><span class='comma'>,</span> <span class='label'>start_time:</span><span class='comma'>,</span> <span class='label'>end_time:</span><span class='comma'>,</span> <span class='label'>sname:</span><span class='comma'>,</span> <span class='label'>flags:</span><span class='comma'>,</span>
|
|
<span class='label'>domain:</span><span class='comma'>,</span> <span class='label'>username:</span><span class='comma'>,</span> <span class='label'>user_id:</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#DEFAULT_ADMIN_RID-constant" title="Rex::Proto::Kerberos::Pac::DEFAULT_ADMIN_RID (constant)">DEFAULT_ADMIN_RID</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>domain_sid:</span><span class='comma'>,</span> <span class='label'>extra_sids:</span> <span class='lbracket'>[</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>session_key:</span> <span class='kw'>nil</span><span class='comma'>,</span> <span class='label'>ticket_checksum:</span> <span class='kw'>false</span><span class='comma'>,</span> <span class='label'>is_golden:</span> <span class='kw'>true</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_sname_principal'>sname_principal</span> <span class='op'>=</span> <span class='id identifier rubyid_create_principal'>create_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_sname'>sname</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_cname_principal'>cname_principal</span> <span class='op'>=</span> <span class='id identifier rubyid_create_principal'>create_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_username'>username</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_checksum_type'>checksum_type</span> <span class='op'>=</span> <span class='id identifier rubyid_get_checksum_type'>get_checksum_type</span><span class='lparen'>(</span><span class='id identifier rubyid_enc_type'>enc_type</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_session_key_byte_length'>session_key_byte_length</span> <span class='op'>=</span> <span class='id identifier rubyid_enc_type'>enc_type</span> <span class='op'>==</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html" title="Rex::Proto::Kerberos::Crypto::Encryption (module)">Encryption</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html#AES256-constant" title="Rex::Proto::Kerberos::Crypto::Encryption::AES256 (constant)">AES256</a></span></span> <span class='op'>?</span> <span class='int'>32</span> <span class='op'>:</span> <span class='int'>16</span>
|
|
<span class='id identifier rubyid_session_key'>session_key</span> <span class='op'>||=</span> <span class='const'>SecureRandom</span><span class='period'>.</span><span class='id identifier rubyid_hex'>hex</span><span class='lparen'>(</span><span class='id identifier rubyid_session_key_byte_length'>session_key_byte_length</span> <span class='op'>/</span> <span class='int'>2</span><span class='rparen'>)</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_session_key'>session_key</span><span class='period'>.</span><span class='id identifier rubyid_bytes'>bytes</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>!=</span> <span class='id identifier rubyid_session_key_byte_length'>session_key_byte_length</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Invalid key length for session key, expected </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_session_key_byte_length'>session_key_byte_length</span><span class='embexpr_end'>}</span><span class='tstring_content'>, got </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_session_key'>session_key</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='embexpr_end'>}</span><span class='tstring_content'> for session key </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_session_key'>session_key</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_opts'>opts</span> <span class='op'>=</span> <span class='lbrace'>{</span>
|
|
<span class='label'>client:</span> <span class='id identifier rubyid_cname_principal'>cname_principal</span><span class='comma'>,</span>
|
|
<span class='label'>server:</span> <span class='id identifier rubyid_sname_principal'>sname_principal</span><span class='comma'>,</span>
|
|
<span class='label'>auth_time:</span> <span class='id identifier rubyid_start_time'>start_time</span><span class='comma'>,</span>
|
|
<span class='label'>start_time:</span> <span class='id identifier rubyid_start_time'>start_time</span><span class='comma'>,</span>
|
|
<span class='label'>end_time:</span> <span class='id identifier rubyid_end_time'>end_time</span><span class='comma'>,</span>
|
|
<span class='label'>renew_till:</span> <span class='id identifier rubyid_end_time'>end_time</span><span class='comma'>,</span>
|
|
<span class='label'>realm:</span> <span class='id identifier rubyid_domain'>domain</span><span class='period'>.</span><span class='id identifier rubyid_upcase'>upcase</span><span class='comma'>,</span>
|
|
<span class='label'>key_value:</span> <span class='id identifier rubyid_enc_key'>enc_key</span><span class='comma'>,</span>
|
|
<span class='label'>checksum_enc_key:</span> <span class='id identifier rubyid_enc_key'>enc_key</span><span class='comma'>,</span>
|
|
<span class='label'>session_key:</span> <span class='id identifier rubyid_session_key'>session_key</span><span class='comma'>,</span>
|
|
<span class='label'>enc_type:</span> <span class='id identifier rubyid_enc_type'>enc_type</span><span class='comma'>,</span>
|
|
<span class='label'>user_id:</span> <span class='id identifier rubyid_user_id'>user_id</span><span class='comma'>,</span>
|
|
<span class='label'>group_ids:</span> <span class='const'><span class='object_link'><a href="#GROUP_IDS-constant" title="Msf::Exploit::Remote::Kerberos::Ticket::GROUP_IDS (constant)">GROUP_IDS</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>checksum_type:</span> <span class='id identifier rubyid_checksum_type'>checksum_type</span><span class='comma'>,</span>
|
|
<span class='label'>client_name:</span> <span class='id identifier rubyid_username'>username</span><span class='comma'>,</span>
|
|
<span class='label'>domain_id:</span> <span class='id identifier rubyid_domain_sid'>domain_sid</span><span class='comma'>,</span>
|
|
<span class='label'>extra_sids:</span> <span class='id identifier rubyid_extra_sids'>extra_sids</span><span class='comma'>,</span>
|
|
<span class='label'>flags:</span> <span class='id identifier rubyid_flags'>flags</span><span class='comma'>,</span>
|
|
<span class='label'>create_ticket_checksum:</span> <span class='id identifier rubyid_ticket_checksum'>ticket_checksum</span><span class='comma'>,</span>
|
|
<span class='label'>is_golden:</span> <span class='id identifier rubyid_is_golden'>is_golden</span>
|
|
<span class='rbrace'>}</span>
|
|
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span> <span class='op'>=</span> <span class='id identifier rubyid_create_enc_ticket_part'>create_enc_ticket_part</span><span class='lparen'>(</span><span class='label'>opts:</span> <span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_enc_part'>enc_part</span> <span class='op'>=</span> <span class='id identifier rubyid_encrypt_ticket_enc_part'>encrypt_ticket_enc_part</span><span class='lparen'>(</span>
|
|
<span class='label'>ticket_enc_part:</span> <span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:key_value</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='label'>enc_type:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:enc_type</span><span class='rbracket'>]</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket'>ticket</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Ticket.html" title="Rex::Proto::Kerberos::Model::Ticket (class)">Ticket</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
|
<span class='label'>tkt_vno:</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html#VERSION-constant" title="Rex::Proto::Kerberos::Model::VERSION (constant)">VERSION</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>realm:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>sname:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:server</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>enc_part:</span> <span class='id identifier rubyid_enc_part'>enc_part</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='comment'># Wrap the ticket up with its metadata, i.e. its key/sname/time information etc
|
|
</span> <span class='id identifier rubyid_ccache'>ccache</span> <span class='op'>=</span> <span class='id identifier rubyid_ticket_as_krb5ccache'>ticket_as_krb5ccache</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket'>ticket</span><span class='comma'>,</span> <span class='label'>opts:</span> <span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_ccache'>ccache</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="get_checksum_type-instance_method">
|
|
|
|
#<strong>get_checksum_type</strong>(enc_type) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
19
|
|
20
|
|
21
|
|
22
|
|
23
|
|
24
|
|
25
|
|
26
|
|
27
|
|
28
|
|
29
|
|
30
|
|
31</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 19</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_get_checksum_type'>get_checksum_type</span><span class='lparen'>(</span><span class='id identifier rubyid_enc_type'>enc_type</span><span class='rparen'>)</span>
|
|
<span class='comment'># https://www.ietf.org/rfc/rfc3962.txt#:~:text=7.%20%20Assigned%20Numbers
|
|
</span> <span class='kw'>case</span> <span class='id identifier rubyid_enc_type'>enc_type</span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html" title="Rex::Proto::Kerberos::Crypto::Encryption (module)">Encryption</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html#AES256-constant" title="Rex::Proto::Kerberos::Crypto::Encryption::AES256 (constant)">AES256</a></span></span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html" title="Rex::Proto::Kerberos::Crypto::Checksum (module)">Checksum</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html#SHA1_AES256-constant" title="Rex::Proto::Kerberos::Crypto::Checksum::SHA1_AES256 (constant)">SHA1_AES256</a></span></span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html" title="Rex::Proto::Kerberos::Crypto::Encryption (module)">Encryption</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html#AES128-constant" title="Rex::Proto::Kerberos::Crypto::Encryption::AES128 (constant)">AES128</a></span></span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html" title="Rex::Proto::Kerberos::Crypto::Checksum (module)">Checksum</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html#SHA1_AES128-constant" title="Rex::Proto::Kerberos::Crypto::Checksum::SHA1_AES128 (constant)">SHA1_AES128</a></span></span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html" title="Rex::Proto::Kerberos::Crypto::Encryption (module)">Encryption</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Encryption.html#RC4_HMAC-constant" title="Rex::Proto::Kerberos::Crypto::Encryption::RC4_HMAC (constant)">RC4_HMAC</a></span></span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html" title="Rex::Proto::Kerberos::Crypto::Checksum (module)">Checksum</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/Checksum.html#HMAC_MD5-constant" title="Rex::Proto::Kerberos::Crypto::Checksum::HMAC_MD5 (constant)">HMAC_MD5</a></span></span>
|
|
<span class='kw'>else</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error.html" title="Rex::Proto::Kerberos::Model::Error (module)">Error</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html" title="Rex::Proto::Kerberos::Model::Error::KerberosError (class)">KerberosError</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Error::KerberosError#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Unknown crypto type: </span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_enc_type'>enc_type</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="kirbi?-instance_method">
|
|
|
|
#<strong>kirbi?</strong>(header) ⇒ <tt>Boolean</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
|
|
<p class="tag_title">Returns:</p>
|
|
<ul class="return">
|
|
|
|
<li>
|
|
|
|
|
|
<span class='type'>(<tt>Boolean</tt>)</span>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
286
|
|
287
|
|
288</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 286</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_kirbi?'>kirbi?</span><span class='lparen'>(</span><span class='id identifier rubyid_header'>header</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_header'>header</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>\x76</span><span class='tstring_end'>"</span></span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="modify_ticket-instance_method">
|
|
|
|
#<strong>modify_ticket</strong>(ticket, enc_kdc_response, new_user, new_user_rid, domain, extra_sids, ticket_decryption_key, ticket_encryption_type, ticket_encryption_key, copy_entire_pac) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
<p>Take an existing ticket and change its PAC to have the provided user value (Used for diamond ticket functionality)</p>
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
<p class="tag_title">Parameters:</p>
|
|
<ul class="param">
|
|
|
|
<li>
|
|
|
|
<span class='name'>ticket</span>
|
|
|
|
|
|
<span class='type'>(<tt><span class='object_link'><a href="" title="Msf::Exploit::Remote::Kerberos::Ticket (module)">Ticket</a></span></tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The ticket to modify</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>enc_kdc_response</span>
|
|
|
|
|
|
<span class='type'>(<tt>EncKdcResponse</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The decrypted KDC response containing contextual information</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>new_user</span>
|
|
|
|
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The username to apply to the ticket</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>new_user_rid</span>
|
|
|
|
|
|
<span class='type'>(<tt>Integer</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The user RID to apply to the ticket</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>domain</span>
|
|
|
|
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The domain of the user</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>extra_sids</span>
|
|
|
|
|
|
<span class='type'>(<tt>List<String></tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Extra SIDs to include in the ticket</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>ticket_decryption_key</span>
|
|
|
|
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The encryption key of the existing ticket (krbtgt or a session key)</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>ticket_encryption_type</span>
|
|
|
|
|
|
<span class='type'>(<tt>Integer</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The encryption type of the resulting ticket</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>ticket_encryption_key</span>
|
|
|
|
|
|
<span class='type'>(<tt>String</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>The encryption key for the resulting ticket (usually krbtgt)</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>copy_entire_pac</span>
|
|
|
|
|
|
<span class='type'>(<tt>Boolean</tt>)</span>
|
|
|
|
|
|
|
|
—
|
|
<div class='inline'>
|
|
<p>Whether to copy all values (extra stealth, as long as the values are accurate i.e. sapphire ticket), or just the important ones</p>
|
|
</div>
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
101
|
|
102
|
|
103
|
|
104
|
|
105
|
|
106
|
|
107
|
|
108
|
|
109
|
|
110
|
|
111
|
|
112
|
|
113
|
|
114
|
|
115
|
|
116
|
|
117
|
|
118
|
|
119
|
|
120
|
|
121
|
|
122
|
|
123
|
|
124
|
|
125
|
|
126
|
|
127
|
|
128
|
|
129
|
|
130
|
|
131
|
|
132
|
|
133
|
|
134
|
|
135
|
|
136
|
|
137
|
|
138
|
|
139
|
|
140
|
|
141
|
|
142
|
|
143
|
|
144
|
|
145
|
|
146
|
|
147
|
|
148
|
|
149
|
|
150
|
|
151
|
|
152
|
|
153
|
|
154
|
|
155
|
|
156
|
|
157
|
|
158
|
|
159
|
|
160
|
|
161
|
|
162
|
|
163
|
|
164
|
|
165
|
|
166
|
|
167
|
|
168
|
|
169
|
|
170
|
|
171
|
|
172
|
|
173
|
|
174
|
|
175
|
|
176
|
|
177
|
|
178
|
|
179
|
|
180
|
|
181
|
|
182
|
|
183
|
|
184
|
|
185
|
|
186
|
|
187</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 101</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_modify_ticket'>modify_ticket</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket'>ticket</span><span class='comma'>,</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='comma'>,</span> <span class='id identifier rubyid_new_user'>new_user</span><span class='comma'>,</span> <span class='id identifier rubyid_new_user_rid'>new_user_rid</span><span class='comma'>,</span> <span class='id identifier rubyid_domain'>domain</span><span class='comma'>,</span> <span class='id identifier rubyid_extra_sids'>extra_sids</span><span class='comma'>,</span> <span class='id identifier rubyid_ticket_decryption_key'>ticket_decryption_key</span><span class='comma'>,</span> <span class='id identifier rubyid_ticket_encryption_type'>ticket_encryption_type</span><span class='comma'>,</span> <span class='id identifier rubyid_ticket_encryption_key'>ticket_encryption_key</span><span class='comma'>,</span> <span class='id identifier rubyid_copy_entire_pac'>copy_entire_pac</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span> <span class='op'>=</span> <span class='id identifier rubyid_ticket'>ticket</span><span class='period'>.</span><span class='id identifier rubyid_enc_part'>enc_part</span>
|
|
<span class='id identifier rubyid_decrypted_ticket_part'>decrypted_ticket_part</span> <span class='op'>=</span> <span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='period'>.</span><span class='id identifier rubyid_decrypt_asn1'>decrypt_asn1</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket_decryption_key'>ticket_decryption_key</span><span class='comma'>,</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto.html" title="Rex::Proto::Kerberos::Crypto (module)">Crypto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/KeyUsage.html" title="Rex::Proto::Kerberos::Crypto::KeyUsage (module)">KeyUsage</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Crypto/KeyUsage.html#KDC_REP_TICKET-constant" title="Rex::Proto::Kerberos::Crypto::KeyUsage::KDC_REP_TICKET (constant)">KDC_REP_TICKET</a></span></span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_decoded_ticket_part'>decoded_ticket_part</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketEncPart.html" title="Rex::Proto::Kerberos::Model::TicketEncPart (class)">TicketEncPart</a></span></span><span class='period'>.</span><span class='id identifier rubyid_decode'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketEncPart.html#decode-instance_method" title="Rex::Proto::Kerberos::Model::TicketEncPart#decode (method)">decode</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_decrypted_ticket_part'>decrypted_ticket_part</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_auth_data_val'>auth_data_val</span> <span class='op'>=</span> <span class='id identifier rubyid_decoded_ticket_part'>decoded_ticket_part</span><span class='period'>.</span><span class='id identifier rubyid_authorization_data'>authorization_data</span><span class='period'>.</span><span class='id identifier rubyid_elements'>elements</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_element'>element</span><span class='op'>|</span> <span class='id identifier rubyid_element'>element</span><span class='lbracket'>[</span><span class='symbol'>:type</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/AuthorizationDataType.html" title="Rex::Proto::Kerberos::Model::AuthorizationDataType (module)">AuthorizationDataType</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/AuthorizationDataType.html#AD_IF_RELEVANT-constant" title="Rex::Proto::Kerberos::Model::AuthorizationDataType::AD_IF_RELEVANT (constant)">AD_IF_RELEVANT</a></span></span><span class='rbrace'>}</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_auth_data_val'>auth_data_val</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>!=</span> <span class='int'>1</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error.html" title="Rex::Proto::Kerberos::Model::Error (module)">Error</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html" title="Rex::Proto::Kerberos::Model::Error::KerberosError (class)">KerberosError</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Error::KerberosError#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_elements'>elements</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='embexpr_end'>}</span><span class='tstring_content'> PAC AD_IF_RELEVANT elements found (expected 1)</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_pac_auth_data'>pac_auth_data</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/AuthorizationData.html" title="Rex::Proto::Kerberos::Model::AuthorizationData (class)">AuthorizationData</a></span></span><span class='period'>.</span><span class='id identifier rubyid_decode'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/AuthorizationData.html#decode-instance_method" title="Rex::Proto::Kerberos::Model::AuthorizationData#decode (method)">decode</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_auth_data_val'>auth_data_val</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='lbracket'>[</span><span class='symbol'>:data</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_elements'>elements</span> <span class='op'>=</span> <span class='id identifier rubyid_pac_auth_data'>pac_auth_data</span><span class='period'>.</span><span class='id identifier rubyid_elements'>elements</span><span class='period'>.</span><span class='id identifier rubyid_select'>select</span> <span class='lbrace'>{</span> <span class='op'>|</span><span class='id identifier rubyid_element'>element</span><span class='op'>|</span> <span class='id identifier rubyid_element'>element</span><span class='lbracket'>[</span><span class='symbol'>:type</span><span class='rbracket'>]</span> <span class='op'>==</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html#AD_WIN2K_PAC-constant" title="Rex::Proto::Kerberos::Pac::AD_WIN2K_PAC (constant)">AD_WIN2K_PAC</a></span></span><span class='rbrace'>}</span>
|
|
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_elements'>elements</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span> <span class='op'>!=</span> <span class='int'>1</span>
|
|
<span class='id identifier rubyid_raise'>raise</span> <span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error.html" title="Rex::Proto::Kerberos::Model::Error (module)">Error</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html" title="Rex::Proto::Kerberos::Model::Error::KerberosError (class)">KerberosError</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Error/KerberosError.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Error::KerberosError#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='tstring'><span class='tstring_beg'>"</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_elements'>elements</span><span class='period'>.</span><span class='id identifier rubyid_length'>length</span><span class='embexpr_end'>}</span><span class='tstring_content'> PAC elements found (expected 1)</span><span class='tstring_end'>"</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_realm'>realm</span> <span class='op'>=</span> <span class='id identifier rubyid_domain'>domain</span>
|
|
<span class='id identifier rubyid_checksum_type'>checksum_type</span> <span class='op'>=</span> <span class='id identifier rubyid_get_checksum_type'>get_checksum_type</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket_encryption_type'>ticket_encryption_type</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_existing_pac'>existing_pac</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5Pac.html" title="Rex::Proto::Kerberos::Pac::Krb5Pac (class)">Krb5Pac</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='id identifier rubyid_elements'>elements</span><span class='lbracket'>[</span><span class='int'>0</span><span class='rbracket'>]</span><span class='lbracket'>[</span><span class='symbol'>:data</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_cname_principal'>cname_principal</span> <span class='op'>=</span> <span class='id identifier rubyid_create_principal'>create_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_new_user'>new_user</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_sname_principal'>sname_principal</span> <span class='op'>=</span> <span class='id identifier rubyid_create_principal'>create_principal</span><span class='lparen'>(</span><span class='lbracket'>[</span><span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>krbtgt</span><span class='tstring_end'>'</span></span><span class='comma'>,</span><span class='id identifier rubyid_domain'>domain</span><span class='period'>.</span><span class='id identifier rubyid_upcase'>upcase</span><span class='rbracket'>]</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_opts'>opts</span> <span class='op'>=</span> <span class='lbrace'>{</span>
|
|
<span class='label'>client:</span> <span class='id identifier rubyid_cname_principal'>cname_principal</span><span class='comma'>,</span>
|
|
<span class='label'>server:</span> <span class='id identifier rubyid_sname_principal'>sname_principal</span><span class='comma'>,</span>
|
|
<span class='label'>auth_time:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_auth_time'>auth_time</span><span class='comma'>,</span>
|
|
<span class='label'>start_time:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_start_time'>start_time</span><span class='comma'>,</span>
|
|
<span class='label'>end_time:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_end_time'>end_time</span><span class='comma'>,</span>
|
|
<span class='label'>renew_till:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_renew_till'>renew_till</span><span class='comma'>,</span>
|
|
<span class='label'>realm:</span> <span class='id identifier rubyid_realm'>realm</span><span class='period'>.</span><span class='id identifier rubyid_upcase'>upcase</span><span class='comma'>,</span>
|
|
<span class='label'>key_value:</span> <span class='id identifier rubyid_ticket_encryption_key'>ticket_encryption_key</span><span class='comma'>,</span>
|
|
<span class='label'>checksum_enc_key:</span> <span class='id identifier rubyid_ticket_encryption_key'>ticket_encryption_key</span><span class='comma'>,</span>
|
|
<span class='label'>session_key:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_key'>key</span><span class='period'>.</span><span class='id identifier rubyid_value'>value</span><span class='comma'>,</span>
|
|
<span class='label'>enc_type:</span> <span class='id identifier rubyid_enc_kdc_response'>enc_kdc_response</span><span class='period'>.</span><span class='id identifier rubyid_key'>key</span><span class='period'>.</span><span class='id identifier rubyid_type'>type</span><span class='comma'>,</span>
|
|
<span class='label'>user_id:</span> <span class='id identifier rubyid_new_user_rid'>new_user_rid</span><span class='comma'>,</span>
|
|
<span class='label'>group_ids:</span> <span class='const'><span class='object_link'><a href="#GROUP_IDS-constant" title="Msf::Exploit::Remote::Kerberos::Ticket::GROUP_IDS (constant)">GROUP_IDS</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>checksum_type:</span> <span class='id identifier rubyid_checksum_type'>checksum_type</span><span class='comma'>,</span>
|
|
<span class='label'>client_name:</span> <span class='id identifier rubyid_new_user'>new_user</span><span class='comma'>,</span>
|
|
<span class='label'>extra_sids:</span> <span class='id identifier rubyid_extra_sids'>extra_sids</span><span class='comma'>,</span>
|
|
<span class='label'>flags:</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='period'>.</span><span class='id identifier rubyid_from_flags'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/KerberosFlags.html#from_flags-class_method" title="Rex::Proto::Kerberos::Model::KerberosFlags.from_flags (method)">from_flags</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_tgt_flags'>tgt_flags</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|
<span class='label'>create_ticket_checksum:</span> <span class='kw'>false</span><span class='comma'>,</span>
|
|
<span class='label'>is_golden:</span> <span class='kw'>true</span><span class='comma'>,</span>
|
|
<span class='rbrace'>}</span>
|
|
<span class='comment'>####
|
|
</span>
|
|
<span class='id identifier rubyid_domain_sid'>domain_sid</span> <span class='op'>=</span> <span class='kw'>nil</span>
|
|
<span class='id identifier rubyid_existing_pac'>existing_pac</span><span class='period'>.</span><span class='id identifier rubyid_pac_info_buffers'>pac_info_buffers</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_buff'>buff</span><span class='op'>|</span>
|
|
<span class='id identifier rubyid_element'>element</span> <span class='op'>=</span> <span class='id identifier rubyid_buff'>buff</span><span class='period'>.</span><span class='id identifier rubyid_buffer'>buffer</span><span class='period'>.</span><span class='id identifier rubyid_pac_element'>pac_element</span>
|
|
<span class='kw'>case</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_ul_type'>ul_type</span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType (module)">Krb5PacElementType</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html#LOGON_INFORMATION-constant" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType::LOGON_INFORMATION (constant)">LOGON_INFORMATION</a></span></span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:group_id</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_primary_group_id'>primary_group_id</span><span class='period'>.</span><span class='id identifier rubyid_value'>value</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:domain_id</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_logon_domain_id'>logon_domain_id</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:logon_domain_name</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_logon_domain_name'>logon_domain_name</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:logon_count</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_logon_count'>logon_count</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:password_last_set</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_password_last_set'>password_last_set</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:user_id</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_user_id'>user_id</span> <span class='kw'>unless</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:user_id</span><span class='rbracket'>]</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_copy_entire_pac'>copy_entire_pac</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:base_verification_info</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span>
|
|
<span class='id identifier rubyid_element'>element</span><span class='period'>.</span><span class='id identifier rubyid_data'>data</span><span class='period'>.</span><span class='id identifier rubyid_extra_sids'>extra_sids</span><span class='period'>.</span><span class='id identifier rubyid_each'>each</span> <span class='kw'>do</span> <span class='op'>|</span><span class='id identifier rubyid_sid'>sid</span><span class='op'>|</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:extra_sids</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_append'>append</span><span class='lparen'>(</span><span class='id identifier rubyid_sid'>sid</span><span class='period'>.</span><span class='id identifier rubyid_sid'>sid</span><span class='period'>.</span><span class='id identifier rubyid_to_s'>to_s</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType (module)">Krb5PacElementType</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html#USER_PRINCIPAL_NAME_AND_DNS_INFORMATION-constant" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType::USER_PRINCIPAL_NAME_AND_DNS_INFORMATION (constant)">USER_PRINCIPAL_NAME_AND_DNS_INFORMATION</a></span></span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_copy_entire_pac'>copy_entire_pac</span>
|
|
<span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:upn_dns_info_pac_element</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='id identifier rubyid_element'>element</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>when</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac.html" title="Rex::Proto::Kerberos::Pac (module)">Pac</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType (module)">Krb5PacElementType</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Pac/Krb5PacElementType.html#TICKET_CHECKSUM-constant" title="Rex::Proto::Kerberos::Pac::Krb5PacElementType::TICKET_CHECKSUM (constant)">TICKET_CHECKSUM</a></span></span>
|
|
<span class='comment'># We want to be stealthy and match whatever the KDC is doing, so we should do it too
|
|
</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:create_ticket_checksum</span><span class='rbracket'>]</span> <span class='op'>=</span> <span class='kw'>true</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span>
|
|
|
|
<span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span> <span class='op'>=</span> <span class='id identifier rubyid_create_enc_ticket_part'>create_enc_ticket_part</span><span class='lparen'>(</span><span class='label'>opts:</span> <span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_enc_part'>enc_part</span> <span class='op'>=</span> <span class='id identifier rubyid_encrypt_ticket_enc_part'>encrypt_ticket_enc_part</span><span class='lparen'>(</span>
|
|
<span class='label'>ticket_enc_part:</span> <span class='id identifier rubyid_ticket_enc_part'>ticket_enc_part</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='id identifier rubyid_ticket_encryption_key'>ticket_encryption_key</span><span class='comma'>,</span> <span class='label'>enc_type:</span> <span class='id identifier rubyid_ticket_encryption_type'>ticket_encryption_type</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ticket'>ticket</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Ticket.html" title="Rex::Proto::Kerberos::Model::Ticket (class)">Ticket</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Element.html#initialize-instance_method" title="Rex::Proto::Kerberos::Model::Element#initialize (method)">new</a></span></span><span class='lparen'>(</span>
|
|
<span class='label'>tkt_vno:</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html#VERSION-constant" title="Rex::Proto::Kerberos::Model::VERSION (constant)">VERSION</a></span></span><span class='comma'>,</span>
|
|
<span class='label'>realm:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>sname:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:server</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>enc_part:</span> <span class='id identifier rubyid_enc_part'>enc_part</span>
|
|
<span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_ccache'>ccache</span> <span class='op'>=</span> <span class='id identifier rubyid_ticket_as_krb5ccache'>ticket_as_krb5ccache</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket'>ticket</span><span class='comma'>,</span> <span class='label'>opts:</span> <span class='id identifier rubyid_opts'>opts</span><span class='rparen'>)</span>
|
|
|
|
<span class='id identifier rubyid_ccache'>ccache</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="print_ccache_contents-instance_method">
|
|
|
|
#<strong>print_ccache_contents</strong>(ccache, key: nil) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
306
|
|
307
|
|
308
|
|
309</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 306</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_print_ccache_contents'>print_ccache_contents</span><span class='lparen'>(</span><span class='id identifier rubyid_ccache'>ccache</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='kw'>nil</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_presenter'>presenter</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache.html" title="Rex::Proto::Kerberos::CredentialCache (module)">CredentialCache</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5CcachePresenter.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter (class)">Krb5CcachePresenter</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5CcachePresenter.html#initialize-instance_method" title="Rex::Proto::Kerberos::CredentialCache::Krb5CcachePresenter#initialize (method)">new</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_ccache'>ccache</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_print_status'>print_status</span> <span class='id identifier rubyid_presenter'>presenter</span><span class='period'>.</span><span class='id identifier rubyid_present'>present</span><span class='lparen'>(</span><span class='label'>key:</span> <span class='id identifier rubyid_key'>key</span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="print_contents-instance_method">
|
|
|
|
#<strong>print_contents</strong>(path, key: nil) ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
290
|
|
291
|
|
292
|
|
293
|
|
294
|
|
295
|
|
296
|
|
297
|
|
298
|
|
299
|
|
300
|
|
301
|
|
302
|
|
303
|
|
304</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 290</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_print_contents'>print_contents</span><span class='lparen'>(</span><span class='id identifier rubyid_path'>path</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='kw'>nil</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_header'>header</span> <span class='op'>=</span> <span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_binread'>binread</span><span class='lparen'>(</span><span class='id identifier rubyid_path'>path</span><span class='comma'>,</span> <span class='int'>2</span><span class='rparen'>)</span>
|
|
<span class='kw'>if</span> <span class='id identifier rubyid_ccache?'>ccache?</span><span class='lparen'>(</span><span class='id identifier rubyid_header'>header</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_print_status'>print_status</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Credentials cache: File:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_path'>path</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='id identifier rubyid_ccache'>ccache</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache.html" title="Rex::Proto::Kerberos::CredentialCache (module)">CredentialCache</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5Ccache.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5Ccache (class)">Krb5Ccache</a></span></span><span class='period'>.</span><span class='id identifier rubyid_read'>read</span><span class='lparen'>(</span><span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_binread'>binread</span><span class='lparen'>(</span><span class='id identifier rubyid_path'>path</span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_print_ccache_contents'>print_ccache_contents</span><span class='lparen'>(</span><span class='id identifier rubyid_ccache'>ccache</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='id identifier rubyid_key'>key</span><span class='rparen'>)</span>
|
|
<span class='kw'>elsif</span> <span class='id identifier rubyid_kirbi?'>kirbi?</span><span class='lparen'>(</span><span class='id identifier rubyid_header'>header</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_print_status'>print_status</span> <span class='tstring'><span class='tstring_beg'>"</span><span class='tstring_content'>Kirbi File:</span><span class='embexpr_beg'>#{</span><span class='id identifier rubyid_path'>path</span><span class='embexpr_end'>}</span><span class='tstring_end'>"</span></span>
|
|
<span class='id identifier rubyid_krb_cred'>krb_cred</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/KrbCred.html" title="Rex::Proto::Kerberos::Model::KrbCred (class)">KrbCred</a></span></span><span class='period'>.</span><span class='id identifier rubyid_decode'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/KrbCred.html#decode-instance_method" title="Rex::Proto::Kerberos::Model::KrbCred#decode (method)">decode</a></span></span><span class='lparen'>(</span><span class='const'>File</span><span class='period'>.</span><span class='id identifier rubyid_binread'>binread</span><span class='lparen'>(</span><span class='id identifier rubyid_path'>path</span><span class='rparen'>)</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_ccache'>ccache</span> <span class='op'>=</span> <span class='const'><span class='object_link'><a href="../../../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../Exploit.html" title="Msf::Exploit (class)">Exploit</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../Remote.html" title="Msf::Exploit::Remote (class)">Remote</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../Kerberos.html" title="Msf::Exploit::Remote::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="TicketConverter.html" title="Msf::Exploit::Remote::Kerberos::TicketConverter (module)">TicketConverter</a></span></span><span class='period'>.</span><span class='id identifier rubyid_kirbi_to_ccache'><span class='object_link'><a href="TicketConverter.html#kirbi_to_ccache-class_method" title="Msf::Exploit::Remote::Kerberos::TicketConverter.kirbi_to_ccache (method)">kirbi_to_ccache</a></span></span><span class='lparen'>(</span><span class='id identifier rubyid_krb_cred'>krb_cred</span><span class='rparen'>)</span>
|
|
<span class='id identifier rubyid_print_ccache_contents'>print_ccache_contents</span><span class='lparen'>(</span><span class='id identifier rubyid_ccache'>ccache</span><span class='comma'>,</span> <span class='label'>key:</span> <span class='id identifier rubyid_key'>key</span><span class='rparen'>)</span>
|
|
<span class='kw'>else</span>
|
|
<span class='id identifier rubyid_fail_with'>fail_with</span><span class='lparen'>(</span><span class='const'><span class='object_link'><a href="../../../../Msf.html" title="Msf (module)">Msf</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../Module.html" title="Msf::Module (class)">Module</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../Module/Failure.html" title="Msf::Module::Failure (module)">Failure</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../Module/Failure.html#BadConfig-constant" title="Msf::Module::Failure::BadConfig (constant)">BadConfig</a></span></span><span class='comma'>,</span> <span class='tstring'><span class='tstring_beg'>'</span><span class='tstring_content'>Unknown file format</span><span class='tstring_end'>'</span></span><span class='rparen'>)</span>
|
|
<span class='kw'>end</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="tgs_flags-instance_method">
|
|
|
|
#<strong>tgs_flags</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
231
|
|
232
|
|
233
|
|
234
|
|
235
|
|
236
|
|
237
|
|
238</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 231</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_tgs_flags'>tgs_flags</span>
|
|
<span class='lbracket'>[</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html#FORWARDABLE-constant" title="Rex::Proto::Kerberos::Model::TicketFlags::FORWARDABLE (constant)">FORWARDABLE</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html#PROXIABLE-constant" title="Rex::Proto::Kerberos::Model::TicketFlags::PROXIABLE (constant)">PROXIABLE</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html#RENEWABLE-constant" title="Rex::Proto::Kerberos::Model::TicketFlags::RENEWABLE (constant)">RENEWABLE</a></span></span><span class='comma'>,</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html#PRE_AUTHENT-constant" title="Rex::Proto::Kerberos::Model::TicketFlags::PRE_AUTHENT (constant)">PRE_AUTHENT</a></span></span>
|
|
<span class='rbracket'>]</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="tgt_flags-instance_method">
|
|
|
|
#<strong>tgt_flags</strong> ⇒ <tt>Object</tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
240
|
|
241
|
|
242</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 240</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_tgt_flags'>tgt_flags</span>
|
|
<span class='id identifier rubyid_tgs_flags'>tgs_flags</span> <span class='op'><<</span> <span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model.html" title="Rex::Proto::Kerberos::Model (module)">Model</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html" title="Rex::Proto::Kerberos::Model::TicketFlags (class)">TicketFlags</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/TicketFlags.html#INITIAL-constant" title="Rex::Proto::Kerberos::Model::TicketFlags::INITIAL (constant)">INITIAL</a></span></span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
<div class="method_details ">
|
|
<h3 class="signature " id="ticket_as_krb5ccache-instance_method">
|
|
|
|
#<strong>ticket_as_krb5ccache</strong>(ticket, opts:) ⇒ <tt><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5Ccache.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5Ccache (class)">Rex::Proto::Kerberos::CredentialCache::Krb5Ccache</a></span></tt>
|
|
|
|
|
|
|
|
|
|
|
|
</h3><div class="docstring">
|
|
<div class="discussion">
|
|
|
|
|
|
</div>
|
|
</div>
|
|
<div class="tags">
|
|
<p class="tag_title">Parameters:</p>
|
|
<ul class="param">
|
|
|
|
<li>
|
|
|
|
<span class='name'>ticket</span>
|
|
|
|
|
|
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/Model/Ticket.html" title="Rex::Proto::Kerberos::Model::Ticket (class)">Rex::Proto::Kerberos::Model::Ticket</a></span></tt>)</span>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
<li>
|
|
|
|
<span class='name'>opts</span>
|
|
|
|
|
|
<span class='type'>(<tt>Hash</tt>)</span>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
<p class="tag_title">Returns:</p>
|
|
<ul class="return">
|
|
|
|
<li>
|
|
|
|
|
|
<span class='type'>(<tt><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5Ccache.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5Ccache (class)">Rex::Proto::Kerberos::CredentialCache::Krb5Ccache</a></span></tt>)</span>
|
|
|
|
|
|
|
|
</li>
|
|
|
|
</ul>
|
|
|
|
</div><table class="source_code">
|
|
<tr>
|
|
<td>
|
|
<pre class="lines">
|
|
|
|
|
|
247
|
|
248
|
|
249
|
|
250
|
|
251
|
|
252
|
|
253
|
|
254
|
|
255
|
|
256
|
|
257
|
|
258
|
|
259
|
|
260
|
|
261
|
|
262
|
|
263
|
|
264
|
|
265
|
|
266
|
|
267</pre>
|
|
</td>
|
|
<td>
|
|
<pre class="code"><span class="info file"># File 'lib/msf/core/exploit/remote/kerberos/ticket.rb', line 247</span>
|
|
|
|
<span class='kw'>def</span> <span class='id identifier rubyid_ticket_as_krb5ccache'>ticket_as_krb5ccache</span><span class='lparen'>(</span><span class='id identifier rubyid_ticket'>ticket</span><span class='comma'>,</span> <span class='label'>opts:</span><span class='rparen'>)</span>
|
|
<span class='const'><span class='object_link'><a href="../../../../Rex.html" title="Rex (module)">Rex</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto.html" title="Rex::Proto (module)">Proto</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos.html" title="Rex::Proto::Kerberos (module)">Kerberos</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache.html" title="Rex::Proto::Kerberos::CredentialCache (module)">CredentialCache</a></span></span><span class='op'>::</span><span class='const'><span class='object_link'><a href="../../../../Rex/Proto/Kerberos/CredentialCache/Krb5Ccache.html" title="Rex::Proto::Kerberos::CredentialCache::Krb5Ccache (class)">Krb5Ccache</a></span></span><span class='period'>.</span><span class='id identifier rubyid_new'>new</span><span class='lparen'>(</span>
|
|
<span class='label'>default_principal:</span> <span class='id identifier rubyid_create_ccache_principal'>create_ccache_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:client</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|
<span class='label'>credentials:</span> <span class='lbracket'>[</span>
|
|
<span class='lbrace'>{</span>
|
|
<span class='label'>client:</span> <span class='id identifier rubyid_create_ccache_principal'>create_ccache_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:client</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|
<span class='label'>server:</span> <span class='id identifier rubyid_create_ccache_principal'>create_ccache_principal</span><span class='lparen'>(</span><span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:server</span><span class='rbracket'>]</span><span class='comma'>,</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:realm</span><span class='rbracket'>]</span><span class='rparen'>)</span><span class='comma'>,</span>
|
|
<span class='label'>keyblock:</span> <span class='lbrace'>{</span>
|
|
<span class='label'>enctype:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:enc_type</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>data:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:session_key</span><span class='rbracket'>]</span>
|
|
<span class='rbrace'>}</span><span class='comma'>,</span>
|
|
<span class='label'>authtime:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:auth_time</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>starttime:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:start_time</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>endtime:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:end_time</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>renew_till:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:renew_till</span><span class='rbracket'>]</span><span class='comma'>,</span>
|
|
<span class='label'>ticket_flags:</span> <span class='id identifier rubyid_opts'>opts</span><span class='lbracket'>[</span><span class='symbol'>:flags</span><span class='rbracket'>]</span><span class='period'>.</span><span class='id identifier rubyid_to_i'>to_i</span><span class='comma'>,</span>
|
|
<span class='label'>ticket:</span> <span class='id identifier rubyid_ticket'>ticket</span><span class='period'>.</span><span class='id identifier rubyid_encode'>encode</span>
|
|
<span class='rbrace'>}</span>
|
|
<span class='rbracket'>]</span>
|
|
<span class='rparen'>)</span>
|
|
<span class='kw'>end</span></pre>
|
|
</td>
|
|
</tr>
|
|
</table>
|
|
</div>
|
|
|
|
</div>
|
|
|
|
</div>
|
|
|
|
<div id="footer">
|
|
Generated on Fri May 8 17:02:18 2026 by
|
|
<a href="https://yardoc.org" title="Yay! A Ruby Documentation Tool" target="_parent">yard</a>
|
|
0.9.37 (ruby-3.1.5).
|
|
</div>
|
|
|
|
</div>
|
|
</body>
|
|
</html> |