search

DanMcInerney / icebreaker

Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment
MIT License
1.18k stars 158 forks source link

Migrate off of rpcclient dependancy for RID cycling attack #14

Open n00py opened 6 years ago

n00py commented 6 years ago

Per the research by SensePost here:

https://sensepost.com/blog/2018/a-new-look-at-null-sessions-and-user-enumeration/

"I found that when I used rpcclient against known vulnerable systems, that it would often produce error messages and fail to enumerate user information. In a penetration test scenario, this behaviour could make one believe that the remote system does not allow one to access the IPC$ share and execute RPC calls, while it could be possible."

"By default, rpcclient first opens the LSARPC pipe and then requests the remote system to execute the LsaOpenPolicy and LsaQueryInformationPolicy functions. If an anonymous user is not allowed to execute these function, rpcclient exits. Most RPC calls however don’t require the information provided by these functions. In our test for example, the smb-enum-users script could still execute QueryDisplayInfo, and enumerate user information, without access to these functions."

It seems that relying on rcpcclient could produce a false negative.

DanMcInerney commented 6 years ago

I've been thinking about implementing this since I read that article too. It's a good idea, it's just that the RID cycling and reverse bruteforce is by far the most complex part of this script so it's going to take a lot of effort to replace the current system. I haven't actually seen rpcclient catch a false negative yet in my testing environments either so at the moment this isn't worth the time I'll have to spend on it. But it is definitely an improvement I might look into the future.