Open
Conversation
azoxlpf
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
Collaborator
|
What is the impacket equivalent of u2u ? getST.py ? |
Contributor
Author
Yes getST.py with -u2u |
Member
|
Very nice, thanks for the PR! |
mpgn
reviewed
Feb 6, 2026
Collaborator
interesting, does you domain force rc4 ? |
Collaborator
|
The auth part is working, nice but something is missing because if you try another command it stacktrace 
|
Contributor
Author
No, the KDC encrypts the session key with AES about one in two times, it's pretty random. But to force RC4 encryption, we can authenticate with the NT hash : 
|
Contributor
Author
Hmm, indeed some commands work but not others. I'll check that out 
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR adds
User-to-User (U2U)authentication support to NetExec, enabling Resource-Based Constrained Delegation (RBCD) exploitation using normal user accounts that don't have aService Principal Name (SPN)configured.Traditional RBCD attacks via S4U2Self/S4U2Proxy fail with
KDC_ERR_S_PRINCIPAL_UNKNOWNwhen attempting to use accounts without SPNs, as the KDC cannot select the correct encryption key for UPN-based tickets :The U2U extension solves this limitation by requesting tickets encrypted with the user's TGT session key instead.
Based on research by James Forshaw : https://www.tiraniddo.dev/2022/05/exploiting-rbcd-using-normal-user.html
Type of change
Insert an "x" inside the brackets for relevant items (do not delete options)
Screenshots (if appropriate):
Generate a TGT and obtain the session key :
Change the user's NT hash with the session key :
Use the TGT for RBCD with S4U and U2U :
Checklist:
Insert an "x" inside the brackets for completed and relevant items (do not delete options)
poetry run python -m ruff check . --preview, use--fixto automatically fix what it can)tests/e2e_commands.txtfile if necessary (new modules or features are required to be added to the e2e tests)