Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fixed RPC_C_AUTHN_NETLOGON auth error #1868

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

Ridter
Copy link

@Ridter Ridter commented Jan 8, 2025

In the process of implementing NetSync using Impacket, I discovered an issue in the authentication section of RPC_C_AUTHN_NETLOGON within Impacket. I made modifications to address the problem, and this submission contains the updated code.
Testing details can be found below: netsync.py.

Shown in the following image:

@ThePirateWhoSmellsOfSunflowers
Copy link
Contributor

Hi,
Nice work. I also played recently with netlogon, have you see my PR #1848 ?

🌻

@Ridter
Copy link
Author

Ridter commented Jan 8, 2025

Hi, Nice work. I also played recently with netlogon, have you see my PR #1848 ?

🌻

I just saw your PR, nice job!

@anadrianmanrique anadrianmanrique self-assigned this Jan 16, 2025
@anadrianmanrique anadrianmanrique added the in review This issue or pull request is being analyzed label Jan 16, 2025
@anadrianmanrique
Copy link
Contributor

hello @Ridter . I'm testing your changes with your netsync project. I wasn't able to execute it successfully in the context of this PR. I made a little modification in order to be able to perform AES authentication.

└─$` python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[-] can't concat str to bytes

This issue was addressed in the context of #1848. In the context of that PR the test executed successfully

└─$ python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[*] Capabilities: 1093586756
[*] Authenticated successfully! have these capabilities: SupportsRC4, DoesNotRequireValidationLevel2, SupportsRefusePasswordChange, SupportsNetrLogonSendToSam, SupportsGenericPassThroughAuthentication, SupportsConcurrentRpcCalls, SupportsStrongKeys, SupportsTransitiveTrusts, SupportsNetrServerPasswordSet2, SupportsNetrLogonGetDomainInfo, SupportsCrossForestTrusts, SupportsRodcPassThroughToDifferentDomains, SupportsAESAndSHA2, SupportsSecureRpc
[*] Tring to sync password for COMPUTEST$ using credentials for DC25$
[-] No such user: COMPUTEST$ with channel: ServerSecureChannel
[*] Decrypt Old Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
[*] Decrypt New Hash: 6135372a478be0905a376bf327cddb8b

@Ridter I'm trying to figure out which scenario triggers the issue that it's being fixed with this PR. Can you help me with that?
Also, #1848 since it's already ready to be merged, changes in this PR will have to be rebased.
Thanks

@anadrianmanrique anadrianmanrique added the waiting for response Further information is needed from people who opened the issue or pull request label Feb 20, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
in review This issue or pull request is being analyzed waiting for response Further information is needed from people who opened the issue or pull request
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants