modified the GoRelayServer.dll, webdav_server.go file.
in my current version I loop prompting for
targetDN, key and value instead of the original
But basically:
modify := ldap.NewModifyRequest(c.TargetDN, nil)
modify.Replace("msDS-AllowedToActOnBehalfOfOtherIdentity", []string{string(c.RBCDSecurityDescriptor[:])})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)
I've tried hardcoded like:
modify := ldap.NewModifyRequest("CN=MS01,DC=mist,DC=htb", nil)
modify.Add("msDS-KeyCredentialLink", []string{"key credential string from pywhisker"})
err = c.RelayInstanceList[relayInstanceIndex].LdapClient.Modify(modify)
but I'm getting insufficient access rights error.
(04-01-2024, 07:46 PM)Xavipolero Wrote: xxxbfacc dateline='[url=tel:1711994396' Wrote: 1711994396[/url]']
Ok. Someone posted and deleted a comment this morning related to Webdav->LDAP relaying using DavRelayUp.
I've managed to modify that a bit, and now have it providing an interactive ldap session authenticated to DC as MS01$, where I can try to update keys. Seems to work, for example I can see that an update I made to msDS-AllowedToActOnBehalfOfOtherIdentity to MS01$ is reflected when I access it from impacket-rbcd -action read from linux.
Anyone have thoughts on an exploitation path from there?
or am I just wasting more of my time...
What modifications did you make? You should be able to add shadow credentials to ms01
Some people seem to have had luck with Impacket-ntlmrelayx