Part V Support Libraries

Chapter 7 A Quick Tour of the Common Libraries

These are impacket's foundational modules — a quick pass is enough.

ICMP6.py — IPv6 Ping

Implements ICMPv6 echo (ping) support for IPv6 hosts.

IP6_Address.py — IPv6 Address Parsing

IPv6 address parsing.

IP6.py — IPv6 Protocol

IPv6 protocol support.

IP6_Extension_Headers.py — IPv6 Extension Headers

IPv6 extension header support.

version.py — Version Information

Prints the current impacket version.

Dot11Crypto.py — 802.11 RC4 Encryption

RC4 encryption/decryption.

Dot11KeyManager.py — 802.11 Key Manager

802.11 (Wi-Fi) key manager support.

ImpactDecoder.py — Network Protocol Decoder

Convenient packet decoders for various network protocols.

ImpactPacket.py — Low-level Packet Codec

The basic building blocks of network packet codecs — low-level codecs for various Internet protocols, for building packets programmatically.

NDP.py — IPv6 Neighbor Discovery

Neighbor Discovery Protocol (NDP) support for IPv6.

cdp.py — Cisco Discovery Protocol

CDP support. CDP (Cisco Discovery Protocol) is a proprietary Layer-2 protocol by Cisco running on most Cisco gear; Cisco devices use it to share OS version, IP address, hardware platform and related information with directly connected devices.

crypto.py — Generic Algorithms incl. AES-CMAC (SMB3 signing)

Generic cryptographic check algorithms such as AES-CMAC (used for SMB3 signing etc.; distinct from krb5/crypto.py)

dhcp.py — DHCP Protocol

DHCP protocol support.

dns.py — DNS Protocol

DNS protocol support.

dot11.py — 802.11 Protocol

802.11 (Wi-Fi) protocol support.

dpapi.py — Windows Data Protection API (Chrome credential decryption)

DPAPI support — the Data Protection API. DPAPI is widely used across Windows applications and subsystems: file encryption, storage of wireless passwords, Windows Credential Manager, Internet Explorer, Outlook, Skype, Windows CardSpace, Windows Vault, Google Chrome and more. It is simple to use, exposing just a couple of functions to encrypt and decrypt data: CryptProtectData and CryptUnprotectData.

https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#13

On the victim host, decrypt Chrome credentials in the user's security context;
With the Chrome database pulled offline, decrypt Chrome credentials with mimikatz.

User master key files live in %APPDATA%\Microsoft\Protect\%SID%.

System master key files live in %WINDIR%\System32\Microsoft\Protect\S-1-5-18\User.

https://paper.seebug.org/1755/#2-windowsdpapi

eap.py — 802.1X Authentication

Wi-Fi 802.11 authentication protocol support.

ese.py — NTDS.dit Database Parsing

Parses NTDS.dit.

helper.py — Basic Packet Data Types

Basic packet data type definitions — bit, byte and friends.

hresult_errors.py — Windows Error Code Catalog

Windows error code catalog.

http.py — RPC over HTTP 401 Authentication

HTTP 401 authentication support for RPC over HTTP v2.

mapi_constants.py — Exchange MAPI Constants

Exchange error codes and MAPI properties.

mqtt.py — MQTT Protocol

MQTT protocol support.

nmb.py — NetBIOS Name Service

NetBIOS library.

smb3.py — SMB2/3 Protocol Implementation

MS-SMB2 protocol implementation (SMB2 and SMB3)

smb3structs.py — SMB2/3 Data Structures

SMB 2/3 protocol structures and constants [MS-SMB2].

smbconnection.py — SMB Connection Wrapper Class

Wrapper class over SMB1/2/3 — the SMB connection implementation.

smbserver.py — SMB Server

SMB server implementation.

system_errors.py — System Error Code Catalog

System error code catalog.

tds.py — SQL Server TDS Protocol

SQL Server (TDS) protocol support.

uuid.py — UUID ↔ Binary Conversion

Conversions between UUID and binary representations.

winregistry.py — Windows Registry Parser

Windows registry hive parser.

wps.py — WPS / WSC Wireless Configuration

WPS protocol support.

WPS (Wi-Fi Protected Setup) is the early name of the WSC (Wi-Fi Simple Configuration) specification, a technology that simplifies configuring and using wireless networks in SOHO environments. For example, setting up a wireless network normally requires the admin to configure the AP's SSID and security properties (authentication, encryption...) and then communicate the SSID and passphrase to every user — fiddly for ordinary people. With WSC, users just enter a PIN, press the Push Button, or tap an NFC phone against an NFC-capable AP, and the security settings are configured automatically — after which the phone can join the network. Clearly far simpler than memorizing SSIDs and passphrases. WPS appeared shortly after the Wi-Fi Alliance (WFA) introduced WPA, and with WPA2 the WFA produced its upgrade, WSC.

References:

This manual leaned on a great many articles written by predecessors — standing on the shoulders of giants. Time was tight during writing, so citations may be incomplete; please point out omissions and they will be added promptly (never deliberately omitted).

https://paper.seebug.org/1755/

https://www.passcape.com/index.php?section=docsys&cmd=details&id=28#13

https://learn.microsoft.com/zh-cn/windows/win32/api/wbemcli/nf-wbemcli-iwbemclassobject-spawninstance

http://www.yfvb.com/help/wmi/index.htm

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-wmi/485026a6-d7e0-4ef8-a44f-43e5853fff9d

https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process#methods

https://blog.csdn.net/Ping_Pig/article/details/119446154

https://learn.microsoft.com/en-us/openspecs/windows_protocols/

https://learn.microsoft.com/en-us/windows/win32/shell/shellwindows-item

https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/

https://www.ibm.com/docs/zh/db2/10.1.0?topic=routines-ole-automation

https://www.anquanke.com/post/id/215960

https://blog.csdn.net/guxch/article/details/6880335

https://payloads.online/archivers/2020-07-16/1/

https://blog.51cto.com/u_15075510/3505281

https://www.zhihu.com/question/49433640/answer/115952604

https://learning.oreilly.com/library/view/learning-dcom

https://zh.wikipedia.org/wiki/%E9%81%A0%E7%A8%8B%E9%81%8E%E7%A8%8B%E8%AA%BF%E7%94%A8

https://learn.microsoft.com/en-us/openspecs/windows_protocols/

https://github.com/OTRF/ThreatHunter-Playbook

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/cca27429-5689-4a16-b2b4-9325d93e4ba2

https://blog.csdn.net/zhuhuan_5/article/details/107593368

https://pubs.opengroup.org/onlinepubs/9629399/chap14.htm

https://learn.microsoft.com/zh-cn/windows/win32/rpc/

http://diswww.mit.edu/menelaus.mit.edu/cvs-krb5/25862

https://payloads.online/archivers/2022-03-04/1/#0x03-impacket%E7%9A%84%E9%80%9A%E7%94%A8%E5%BC%80%E5%8F%91%E6%B5%81%E7%A8%8B

https://www.freebuf.com/articles/network/265320.html

https://myzxcg.com/2021/08/Kerberos-%E8%AE%A4%E8%AF%81%E8%BF%87%E7%A8%8B%E8%AF%A6%E7%BB%86%E5%88%86%E6%9E%90%E4%B8%80/

https://www.cnblogs.com/yokan/p/16102699.html

https://www.4hou.com/posts/5KG8

https://googleprojectzero.blogspot.com/2021/10/using-kerberos-for-authentication-relay.html

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-spng/f377a379-c24f-4a0f-a3eb-0d835389e28a

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-smb2/06451bf2-578a-4b9d-94c0-8ce531bf14c4

https://docs.oracle.com/cd/E19253-01/819-7056/6n91eac42/index.html

https://silvermissile.github.io/2020/08/16/%E6%95%B0%E6%8D%AE%E5%8A%A8%E6%80%81%E5%AE%89%E5%85%A8%E5%8D%8F%E8%AE%AE%E7%BB%BC%E8%BF%B0/

https://zhuanlan.zhihu.com/p/68583311

https://zhuanlan.zhihu.com/p/266491528

https://juejin.cn/post/6844903955416219661

https://www.ietf.org/rfc/rfc4615.txt

https://www.ietf.org/rfc/rfc4493.txt

https://www.ibm.com/docs/en/zos/2.3.0?topic=kpi-krb5-get-cred-from-kdc-obtain-kdc-server-service-ticket

https://web.mit.edu/kerberos/krb5-devel/doc/appdev/refs/types/krb5_creds.html

https://www.rfc-editor.org/rfc/rfc6448.html

https://repo.or.cz/w/krb5dissect.git/blob_plain/HEAD:/keytab.txt

https://en.wikipedia.org/wiki/Generic_Security_Services_Application_Program_Interface

https://datatracker.ietf.org/doc/html/rfc4121

http://tech.sina.com.cn/roll/2007-08-05/2043381729.shtml

https://fossies.org/dox/freedce-1.1.0.7/mgmt_8c.html#aa683fdbf3f0ae0f068468426f0f5ae3e

https://pubs.opengroup.org/onlinepubs/9629399/apdxq.htm

https://learn.microsoft.com/en-us/openspecs/windows_protocols

https://tttang.com/archive/1403/

https://www.anquanke.com/post/id/219374#h3-6

https://devco.re/blog/2022/10/19/a-new-attack-surface-on-MS-exchange-part-4-ProxyRelay/

https://twitter.com/_mohemiv

https://devco.re/blog/2022/10/19/a-new-attack-surface-on-MS-exchange-part-4-ProxyRelay/

https://swarm.ptsecurity.com/attacking-ms-exchange-web-interfaces/

https://cloud.tencent.com/developer/article/1937702

https://xie1997.blog.csdn.net/article/details/119457498

https://www.freebuf.com/articles/network/285345.html

https://www.akamai.com/blog/security-research/cold-hard-cache-bypassing-rpc-with-cache-abuse