Module: Msf::Exploit::Remote::Kerberos::Client

Includes:
AsRequest, AsResponse, Base, CacheCredential, Pac, TgsRequest, TgsResponse
Defined in:
lib/msf/core/exploit/kerberos/client.rb,
lib/msf/core/exploit/kerberos/client/pac.rb,
lib/msf/core/exploit/kerberos/client/base.rb,
lib/msf/core/exploit/kerberos/client/as_request.rb,
lib/msf/core/exploit/kerberos/client/as_response.rb,
lib/msf/core/exploit/kerberos/client/tgs_request.rb,
lib/msf/core/exploit/kerberos/client/tgs_response.rb,
lib/msf/core/exploit/kerberos/client/cache_credential.rb

Defined Under Namespace

Modules: AsRequest, AsResponse, Base, CacheCredential, Pac, TgsRequest, TgsResponse

Instance Attribute Summary collapse

Instance Method Summary collapse

Methods included from CacheCredential

#create_cache, #create_cache_credential, #create_cache_key_block, #create_cache_principal, #create_cache_times

Methods included from Pac

#build_pa_pac_request, #build_pac, #build_pac_authorization_data

Methods included from TgsResponse

#extract_kerb_creds

Methods included from TgsRequest

#build_ap_req, #build_authenticator, #build_enc_auth_data, #build_subkey, #build_tgs_body_checksum, #build_tgs_request, #build_tgs_request_body

Methods included from AsResponse

#extract_logon_time, #extract_session_key

Methods included from AsRequest

#build_as_pa_time_stamp, #build_as_request, #build_as_request_body

Methods included from Base

#build_client_name, #build_server_name

Instance Attribute Details

#client ⇒ Rex::Proto::Kerberos::Client

Returns The kerberos client.

Returns:


27
28
29
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 27

def client
  @client
end

Instance Method Details

#cleanup ⇒ Object

Performs cleanup as necessary, disconnecting the Kerberos client if it's still established.


107
108
109
110
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 107

def cleanup
  super
  disconnect
end

#connect(opts = {}) ⇒ Rex::Proto::Kerberos::Client

Creates a kerberos connection

Parameters:

  • opts (Hash{Symbol => <String, Integer>}) (defaults to: {})

Options Hash (opts):

  • :rhost (String)
  • :rport (<String, Integer>)

Returns:


75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 75

def connect(opts={})
  kerb_client = Rex::Proto::Kerberos::Client.new(
    host: opts[:rhost] || rhost,
    port: (opts[:rport] || rport).to_i,
    timeout: (opts[:timeout] || timeout).to_i,
    context:
      {
        'Msf'        => framework,
        'MsfExploit' => self,
      },
    protocol: 'tcp'
  )

  disconnect if client
  self.client = kerb_client

  kerb_client
end

#disconnect(kerb_client = client) ⇒ Object

Disconnects the Kerberos client

Parameters:


97
98
99
100
101
102
103
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 97

def disconnect(kerb_client = client)
  kerb_client.close if kerb_client

  if kerb_client == client
    self.client = nil
  end
end

#initialize(info = {}) ⇒ Object 


29
30
31
32
33
34
35
36
37
38
39
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 29

def initialize(info = {})
  super

  register_options(
    [
      Opt::RHOST,
      Opt::RPORT(88),
      OptInt.new('Timeout', [true, 'The TCP timeout to establish connection and read data', 10])
    ], self.class
  )
end

#peer ⇒ String

Returns the kdc peer

Returns:

  • (String) 

65
66
67
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 65

def peer
  "#{rhost}:#{rport}"
end

#rhost ⇒ String

Returns the target host

Returns:

  • (String) 

44
45
46
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 44

def rhost
  datastore['RHOST']
end

#rport ⇒ Integer

Returns the remote port

Returns:

  • (Integer) 

51
52
53
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 51

def rport
  datastore['RPORT']
end

#send_request_as(opts = {}) ⇒ Rex::Proto::Kerberos::Model::KdcResponse

Sends a kerberos AS request and reads the response

Parameters:

  • opts (Hash) (defaults to: {})

Returns:

See Also:


118
119
120
121
122
123
124
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 118

def send_request_as(opts = {})
  connect(opts)
  req = build_as_request(opts)
  res = client.send_recv(req)
  disconnect
  res
end

#send_request_tgs(opts = {}) ⇒ Rex::Proto::Kerberos::Model::KdcResponse

Sends a kerberos AS request and reads the response

Parameters:

  • opts (Hash) (defaults to: {})

Returns:

See Also:


132
133
134
135
136
137
138
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 132

def send_request_tgs(opts = {})
  connect(opts)
  req = build_tgs_request(opts)
  res = client.send_recv(req)
  disconnect
  res
end

#timeout ⇒ Integer

Returns the TCP timeout

Returns:

  • (Integer) 

58
59
60
 
# File 'lib/msf/core/exploit/kerberos/client.rb', line 58

def timeout
  datastore['Timeout']
end