DanMcInerney / icebreaker

Gets plaintext Active Directory credentials if you're on the internal network but outside the AD environment
MIT License
1.18k stars 170 forks source link

Attack 1: RID Cycling fails #22

Open lacuta opened 1 year ago

lacuta commented 1 year ago

udo ./icebreaker.py -l target.txt -c "net user /add User1 [email protected]" [] Nmap running: 0.0 min [] Nmap running: 0.5 min [] Nmap running: 1.0 min [] Nmap running: 1.5 min [] Nmap running: 2.0 min [] Nmap running: 2.5 min [*] Parsing hosts [+] SMB open:

[] Attack 1: RID cycling in null SMB sessions into reverse bruteforce [] Checking for null SMB sessions [] Example command that will run: rpcclient -U "" 172.46.100.9 -N -c "lsaquery" /home/menace/icebreaker/./icebreaker.py:339: RuntimeWarning: coroutine 'create_subprocess_shell' was never awaited p = yield from asyncio.create_subprocess_shell(cmd, stdout=PIPE, stderr=PIPE) RuntimeWarning: Enable tracemalloc to get the object allocation traceback Traceback (most recent call last): File "/home/menace/icebreaker/./icebreaker.py", line 1603, in main(report, args) File "/home/menace/icebreaker/./icebreaker.py", line 1539, in main prev_creds, prev_users, domains = smb_reverse_brute(loop, hosts, args, passwords, prev_creds, prev_users, DCs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/menace/icebreaker/./icebreaker.py", line 597, in smb_reverse_brute rpc_output = async_get_outputs(loop, dom_cmds) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/home/menace/icebreaker/./icebreaker.py", line 370, in async_get_outputs output += loop.run_until_complete(asyncio.gather(coros)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/lib/python3.11/asyncio/base_events.py", line 653, in run_until_complete return future.result() ^^^^^^^^^^^^^^^ File "/home/menace/icebreaker/./icebreaker.py", line 339, in get_output p = yield from asyncio.create_subprocess_shell(cmd, stdout=PIPE, stderr=PIPE) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ TypeError: cannot 'yield from' a coroutine object in a non-coroutine generator