Add example script to enum, parse and extract gMSA passwords - gmsadump.py#2171
Open
ThatTotallyRealMyth wants to merge 9 commits into
Open
Add example script to enum, parse and extract gMSA passwords - gmsadump.py#2171ThatTotallyRealMyth wants to merge 9 commits into
ThatTotallyRealMyth wants to merge 9 commits into
Conversation
…p_connection so it gets negotatied at the start and now it functions
Removed start_tls()
Updated the extraction to make sure that we can get the password even in cases in which there is no tls cert or ldaps is not configured.
14 tasks
…_kerberos_keys and fixed resolution issue when using kerberos auth + additional logging for -dc-host arg
anadrianmanrique
added
in review
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hi there!
This PR adds
gmsadump.py, a new example script for enumerating Group Managed Service Accounts (gMSAs) as well as extracting their current(and previous) NT, and AES kerberos keys credentials. This script is heavily based on https://github.com/micahvandeusen/gMSADumperMany differences exist but credit goes to micahvandeusen for doing a lot of the heavy lifting. Additionally, this script was also a team effort by myself and @chin-tech
Additionally, all ldap3 elements from gMSADumper were extracted in favor of impackets. Mainly due to the fact that ldap3 cant support connecting to a DC enforcing LDAP signing using NTLM(no sasl support).
Features
msDS-ManagedPasswordattribute t to extract the NT, and AES creds format-gmsa) object to enumerate who can read itsmsDS-ManagedPassword(name and sid)-gmsa. It also accepts wild cards, appends the$when not given-enumflag that allows user to avoid extraction and only enum all gMSA objects and the readers ACLsSample Output
For example using the -enum flag with specifying a target, it will only enum that:
By default, it will extract all the gmsas your calling user can extract while also printing out which other gMSA objects are present + who can read those:
I made a PR prior but realized it was from my main branch instead of a separate one since I also opened a separate PR for badsuccor, in #2170 so I had to close it.
This one comes with many more improvements, better exception handling and more control over enumeration vs cred extraction.