CravateRouge / bloodyAD

BloodyAD is an Active Directory Privilege Escalation Framework
MIT License
1.12k stars 112 forks source link

Execute addComputer. An error is reported when executing the new version, but the old version can execute normally #30

Closed zzb1999 closed 1 year ago

zzb1999 commented 1 year ago

Hello, I encountered a problem during the local environment test old

┌──(root㉿kali)-[/home/laot/桌面/bloodyAD-main]
└─# python3 bloodyAD.py -d test.lcoal -u 'test' -p 'Pass123' --host 192.168.1.15 addComputer pwnmachine 'CVEPassword1234*'
Opening domain TEST...
Successfully added machine account pwnmachine$ with password CVEPassword1234*.

new

┌──(root㉿kali)-[/home/laot/桌面/bloodyAD-0.1.8]
└─# python3 bloodyAD.py -d test.lcoal -u 'test' -p 'Pass123' --host 192.168.1.15 addComputer pwnmachine 'CVEPassword1234*'
Traceback (most recent call last):
  File "/home/laot/桌面/bloodyAD-0.1.8/bloodyAD.py", line 5, in <module>
    main.main()
  File "/home/laot/桌面/bloodyAD-0.1.8/bloodyAD/main.py", line 71, in main
    args.func(conn, **params)
  File "/home/laot/桌面/bloodyAD-0.1.8/bloodyAD/modules.py", line 157, in addComputer
    ldap_conn.add(computer_dn, attributes=attr)
  File "/usr/lib/python3/dist-packages/ldap3/core/connection.py", line 1013, in add
    response = self.post_send_single_response(self.send('addRequest', request, controls))
  File "/usr/lib/python3/dist-packages/ldap3/strategy/sync.py", line 160, in post_send_single_response
    responses, result = self.get_response(message_id)
  File "/usr/lib/python3/dist-packages/ldap3/strategy/base.py", line 403, in get_response
    raise LDAPOperationResult(result=result['result'], description=result['description'], dn=result['dn'], message=result['message'], response_type=result['type'])
ldap3.core.exceptions.LDAPConstraintViolationResult: LDAPConstraintViolationResult - 19 - constraintViolation - None - 0000200B: AtrErr: DSID-033E0F1B, #1:
        0: 0000200B: DSID-033E0F1B, problem 1005 (CONSTRAINT_ATT_TYPE), data 0, Att 9026b (dNSHostName)
 - addResponse - None

The same test environment, I don't understand why

CravateRouge commented 1 year ago

Which version (or commit version) did you use before?

Maybe you made a mistake in the domain provided -d test.lcoal should be -d test.local ?

zzb1999 commented 1 year ago

Reboot the target and kali. Everything is normal. That's strange. The orders are exactly the same. I use this version "https://github.com/CravateRouge/bloodyAD/tree/5d52174f0b07959551022720937778d8999cf4b1" The previous test shows that this version is normal, and the latest version will show the above error Suddenly both of them are OK again

CravateRouge commented 1 year ago

Previous version was using SAMR instead of LDAP to add a computer object in AD. Two options here:

zzb1999 commented 1 year ago

Thank you I understand. It should be a configuration problem. Actually, it is not 'test. local', but modified in 'issus'. The input is wrong. Sorry to have troubled you.My online translation of English may seem awkward