credentials
import "github.com/TheManticoreProject/Manticore/windows/credentials"
Index
- func ParseLMNTHashes(authHashes string) (string, string, error)
- type Credentials
- func NewCredentials(authDomain, authUsername, authPassword, authHashes string) (*Credentials, error)
- func (c *Credentials) CanPassTheHash() bool
- func (c *Credentials) CanUseAESKey() bool
- func (c *Credentials) CanUseCCache() bool
- func (c *Credentials) CanUseKeytab() bool
- func (c *Credentials) CanUseKirbi() bool
- func (c *Credentials) GetAESKey() string
- func (c *Credentials) GetCCache() string
- func (c *Credentials) GetDomain() string
- func (c *Credentials) GetKeytab() string
- func (c *Credentials) GetKirbi() string
- func (c *Credentials) GetLMHash() string
- func (c *Credentials) GetNTHash() string
- func (c *Credentials) GetPassword() string
- func (c *Credentials) GetUsername() string
- func (c *Credentials) IsDomainIdentity() bool
- func (c *Credentials) IsLocalIdentity() bool
- func (c *Credentials) SetAESKey(hexKey string) error
- func (c *Credentials) SetCCache(path string) error
- func (c *Credentials) SetKeytab(path string) error
- func (c *Credentials) SetKirbi(path string) error
func ParseLMNTHashes
func ParseLMNTHashes(authHashes string) (string, string, error)
ParseLMNTHashes parses the NT/LM hashes and returns the LM hash and NT hash.
type Credentials
type Credentials struct {
Domain string
Username string
Password string
LMHash string
NTHash string
// AESKey is a hex-encoded Kerberos AES key, 32 hex characters for
// aes128-cts-hmac-sha1-96 or 64 for aes256-cts-hmac-sha1-96. Set it with
// SetAESKey, which validates the encoding and length.
AESKey string
// Keytab is the path to a Kerberos keytab file holding the principal's keys.
// Set it with SetKeytab.
Keytab string
// CCache is the path to a Kerberos credential cache (FILE format) holding a
// TGT to authenticate with (pass-the-ticket). Set it with SetCCache.
CCache string
// Kirbi is the path to a .kirbi (DER KRB-CRED) file holding a TGT to
// authenticate with (pass-the-ticket). Set it with SetKirbi.
Kirbi string
}
func NewCredentials
func NewCredentials(authDomain, authUsername, authPassword, authHashes string) (*Credentials, error)
NewCredentials creates a new Credentials object. authDomain is the domain to authenticate to. authUsername is the username to authenticate as. authPassword is the password to authenticate with. authHashes is the NT/LM hashes to use for authentication.
func (*Credentials) CanPassTheHash
func (c *Credentials) CanPassTheHash() bool
CanPassTheHash returns true if the credentials can be used to pass the hash attack.
func (*Credentials) CanUseAESKey
func (c *Credentials) CanUseAESKey() bool
CanUseAESKey returns true if the credentials hold a Kerberos AES key usable for authentication.
func (*Credentials) CanUseCCache
func (c *Credentials) CanUseCCache() bool
CanUseCCache returns true if the credentials point at a Kerberos credential cache to authenticate from. Unlike the secret-based methods it does not require a username: the principal is carried by the ticket in the cache.
func (*Credentials) CanUseKeytab
func (c *Credentials) CanUseKeytab() bool
CanUseKeytab returns true if the credentials hold a Kerberos keytab usable for authentication.
func (*Credentials) CanUseKirbi
func (c *Credentials) CanUseKirbi() bool
CanUseKirbi returns true if the credentials point at a .kirbi ticket to authenticate from. Like CanUseCCache it does not require a username.
func (*Credentials) GetAESKey
func (c *Credentials) GetAESKey() string
func (*Credentials) GetCCache
func (c *Credentials) GetCCache() string
func (*Credentials) GetDomain
func (c *Credentials) GetDomain() string
func (*Credentials) GetKeytab
func (c *Credentials) GetKeytab() string
func (*Credentials) GetKirbi
func (c *Credentials) GetKirbi() string
func (*Credentials) GetLMHash
func (c *Credentials) GetLMHash() string
func (*Credentials) GetNTHash
func (c *Credentials) GetNTHash() string
func (*Credentials) GetPassword
func (c *Credentials) GetPassword() string
func (*Credentials) GetUsername
func (c *Credentials) GetUsername() string
func (*Credentials) IsDomainIdentity
func (c *Credentials) IsDomainIdentity() bool
IsDomain returns true if the credentials are for a domain.
func (*Credentials) IsLocalIdentity
func (c *Credentials) IsLocalIdentity() bool
IsLocal returns true if the credentials are for a local account.
func (*Credentials) SetAESKey
func (c *Credentials) SetAESKey(hexKey string) error
SetAESKey sets the hex-encoded Kerberos AES key, after checking that it decodes and is a valid AES key length. Validating here means a malformed key is reported when the credentials are built, rather than as a KDC failure later.
Parameters:
hexKey (string): The hex-encoded AES key, 32 or 64 hex characters.
Returns:
An error if the key is not valid hex or is not 16 or 32 bytes, nil otherwise.
func (*Credentials) SetCCache
func (c *Credentials) SetCCache(path string) error
SetCCache sets the path to a Kerberos credential cache, after checking that the file exists and is readable.
Parameters:
path (string): The path to the ccache file.
Returns:
An error if the file cannot be opened, nil otherwise.
func (*Credentials) SetKeytab
func (c *Credentials) SetKeytab(path string) error
SetKeytab sets the path to a Kerberos keytab file, after checking that the file exists and is readable.
Parameters:
path (string): The path to the keytab file.
Returns:
An error if the file cannot be opened, nil otherwise.
func (*Credentials) SetKirbi
func (c *Credentials) SetKirbi(path string) error
SetKirbi sets the path to a .kirbi ticket file, after checking that the file exists and is readable.
Parameters:
path (string): The path to the .kirbi file.
Returns:
An error if the file cannot be opened, nil otherwise.