HackTool.Python.Impacket.RSC

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It does not have any backdoor routine.

Arrival Details

This Hacking Tool arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Hacking Tool does not have any propagation routine.

Backdoor Routine

This Hacking Tool does not have any backdoor routine.

Rootkit Capabilities

This Hacking Tool does not have rootkit capabilities.

Information Theft

This Hacking Tool gathers the following data:

• Note that this hacking tool does not have any routine to gather or steal information from the host machine running the script.
• However, when executed against an Active Directory environment, it extracts and steals the following forest-level credentials:
  • Child-domain krbtgt account NTLM hashes and Kerberos encryption keys
  • Forest root Enterprise Admin account credentials and password hashes
  • Security Identifiers (SIDs) of the child domain and parent forest domains

Other Details

This Hacking Tool does the following:

• It displays the list of parameters that can be used when executed without parameters in a console:
  
• Operates as an Active Directory domain escalation script within the open-source Impacket framework, utilizing Impacket Kerberos, Netlogon, and DRSUAPI libraries to forge Golden Tickets and achieve forest root administrative access.
• Connects to the child domain controller using Netlogon Remote Protocol ([MS-NRPC]) to discover domain topology and locate the forest root domain FQDN.
• Queries the Local Security Authority ([MS-LSAT]) to resolve and obtain the Enterprise Admins SID of the forest root domain.
• Performs a DCSync attack via Directory Replication Service ([MS-DRSR]) against the child domain controller to dump the child domain's krbtgt account secret key.
• Forges a forged Kerberos Ticket-Granting Ticket (Golden Ticket) in memory, injecting the forest's Enterprise Admin SID into the KERB_VALIDATION_INFO structure's ExtraSids array and configuring a 10-year expiration timestamp.
• Authenticates into the forest root domain controller using the forged ticket to query and retrieve credentials of the forest root Administrator (or specified target RID).
• If the -w parameter is specified: Saves the forged ticket to disk in CCache format for persistence and lateral movement.
• If the -target-exec parameter is specified: Automatically installs a temporary service on the target host over SMB running cmd.exe as SYSTEM or Enterprise Admin, communicating over dedicated named pipes (RemCom_communicaton, RemCom_stdin, RemCom_stdout, RemCom_stderr), supporting interactive shell subcommands (shell, get, put, lcd), and uninstalls the service upon completion.

It accepts the following parameters:

• -aesKey {Hex Key} → used to specify an AES key (128 or 256 bits) for Kerberos authentication.
• -dc-ip {IP Address} → used to specify the IP address of the domain controller.
• -debug → used to enable diagnostic debug logging output.
• -hashes {LMHASH:NTHASH} → used to specify NTLM password hashes for Pass-the-Hash authentication.
• -k → used to enable Kerberos authentication using credentials from a Kerberos credential cache file (KRB5CCNAME).
• -no-pass → used to disable password prompting when using Kerberos authentication.
• -target-exec {Target Address} → used to specify the target host to launch a PsExec shell against with Enterprise Admin privileges.
• -targetRID {RID} → used to specify the target user RID to dump credentials for (default: 500 / Administrator).
• -ts → used to prepend timestamps to console logging output.
• -w {File Path} → used to specify the pathname to write the generated Golden Ticket in CCache format.
• target → positional argument specifying child domain administrator credentials in domain/username[:password] format.

It does not exploit any vulnerability.