Merge branch 'fortra:master' into master

Author: aconite33

examples/smbclient.py

@@ -51,6 +51,12 @@ def main():
     group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '
                                                                             '(128 or 256 bits)')
 
+    group = parser.add_argument_group('dfs')
+
+    group.add_argument('-dfs-follow', action='store_true', default=False,
+                       help='Automatically follow DFS links by creating new SMB connections to target servers. '
+                            'Disabled by default for OPSEC reasons (use dfs_mode command in shell to toggle at runtime)')
+
     group = parser.add_argument_group('connection')
 
     group.add_argument('-dc-ip', action='store', metavar="ip address",
@@ -98,7 +104,7 @@ def main():
         else:
             smbClient.login(username, password, domain, lmhash, nthash)
 
-        shell = MiniImpacketShell(smbClient, None, options.outputfile)
+        shell = MiniImpacketShell(smbClient, None, options.outputfile, dfs_auto_follow=options.dfs_follow)
 
         if options.outputfile is not None:
             f = open(options.outputfile, 'a')

impacket/dcerpc/v5/epm.py

@@ -642,8 +642,7 @@ def __str__( self ):
 'F093FE3D-8131-4B73-A742-EF54C20B337B':'[MS-ISTM]: iSCSI Software Target Management Protocol',
 '28BC8D5E-CA4B-4F54-973C-ED9622D2B3AC':'[MS-ISTM]: iSCSI Software Target Management Protocol',
 '22E5386D-8B12-4BF0-B0EC-6A1EA419E366':'[MS-LREC]: Live Remote Event Capture (LREC) Protocol',
-'12345778-1234-ABCD-EF00-0123456789AB':'[MS-LSAD]: Local Security Authority (Domain Policy) Remote Protocol',
-'12345778-1234-ABCD-EF00-0123456789AB':'[MS-LSAT]: Local Security Authority (Translation Methods) Remote',
+'12345778-1234-ABCD-EF00-0123456789AB':'[MS-LSAD]/[MS-LSAT]: Local Security Authority (Domain Policy / Translation Methods) Remote Protocol',
 '708CCA10-9569-11D1-B2A5-0060977D8118':'[MS-MQDS]: Message Queuing (MSMQ):',
 '77DF7A80-F298-11D0-8358-00A024C480A8':'[MS-MQDS]: Message Queuing (MSMQ):',
 '76D12B80-3467-11D3-91FF-0090272F9EA3':'[MS-MQMP]: Message Queuing (MSMQ):',
@@ -715,7 +714,6 @@ def __str__( self ):
 'DB90832F-6910-4D46-9F5E-9FD6BFA73903':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
 '4E934F30-341A-11D1-8FB1-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
 '879C8BBE-41B0-11D1-BE11-00C04FB6BF70':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
-'00000000-0000-0000-C000-000000000046':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
 '69AB7050-3059-11D1-8FAF-00A024CB6019':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
 '7D07F313-A53F-459A-BB12-012C15B1846E':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',
 'BB39332C-BFEE-4380-AD8A-BADC8AFF5BB6':'[MS-RSMP]: Removable Storage Manager (RSM) Remote Protocol',

impacket/examples/ntlmrelayx/attacks/httpattacks/sccmpoliciesattack.py

@@ -281,7 +281,7 @@ def mscrypt_derive_key_sha1(secret:bytes):
     digest2.update(buf2)
     hash2 = digest2.finalize()
 
-    derived_key = hash1 + hash2[:4]
+    derived_key = hash1 + hash2
     return derived_key
 
 def deobfuscate_secret_policy_blob(output):
@@ -292,12 +292,20 @@ def deobfuscate_secret_policy_blob(output):
     buffer = output[64:64+data_length]
 
     key = mscrypt_derive_key_sha1(output[4:4+0x28])
-    iv = bytes([0] * 8)
-    cipher = Cipher(algorithms.TripleDES(key), modes.CBC(iv), backend=default_backend())
+    blob_prefix = output[:2]
+
+    if blob_prefix == b'\x89\x13':
+        block_cipher_algorithm = algorithms.TripleDES(key[:24])
+    elif blob_prefix == b'\x8a\x13':
+        block_cipher_algorithm = algorithms.AES256(key[:32])
+
+    iv = bytes([0] * (block_cipher_algorithm.block_size // 8))
+    cipher = Cipher(block_cipher_algorithm, modes.CBC(iv), backend=default_backend())
+
     decryptor = cipher.decryptor()
     decrypted_data = decryptor.update(buffer) + decryptor.finalize()
 
-    padder = padding.PKCS7(64).unpadder() # 64 is the block size in bits for DES3
+    padder = padding.PKCS7(block_cipher_algorithm.block_size).unpadder()
     decrypted_data = padder.update(decrypted_data) + padder.finalize()
 
     try:
@@ -545,7 +553,22 @@ def secret_policy_process(self, policyID, policy, private_key, client_guid, loot
 
         LOG.debug(f"Found {len(blobs_set.keys())} obfuscated blob(s) in secret policy.")
         for i, blob_name in enumerate(blobs_set.keys()):
-            data = deobfuscate_secret_policy_blob(blobs_set[blob_name])
+            blob_prefix = bytes.fromhex(blobs_set[blob_name])[:2]
+            if blob_prefix in (b'\x89\x13', b'\x8a\x13'):
+                data = deobfuscate_secret_policy_blob(blobs_set[blob_name])
+            else:
+                LOG.debug(f"Unable to decrypt obfuscated blob due to unknown blob type with prefix '{blob_prefix.hex()}'.")
+                continue
+
+            # Attempt to pretty-print decrypted XML task sequence blobs prior to file write.
+            if blob_name == "TS_Sequence":
+                try:
+                    blobroot = ET.fromstring(clean_junk_in_XML(data))
+                    ET.indent(blobroot)
+                    data = ET.tostring(blobroot, encoding="unicode")
+                except:
+                    pass
+
             filename = f'{loot_dir}/{policyID}/secretBlob_{str(i+1)}-{blob_name}.txt'
             with open(filename, 'w') as f:
                 f.write(f"Secret property name: {blob_name}\n\n")