# Changelog

In 

All notable changes to this project will be documented in this file.

The format is based on Keep a Changelog, and this project adheres to Semantic Versioning.

# [1.6.3] - 2021-03-26

# Change

  • Only final cert in chain used to verify when signing PKINIT requests, /verifycerts flag added for full verification

# Fixed

  • Replaced /certificate info for help and README

# [1.6.2] - 2021-03-12

# Added

  • Adapted/integrated the PR from @RiccardoAncarani for /delay:MILLISECONDS and /jitter:% (1-100) flags for kerberoast
  • Rubeus.yar yara rule from FireEye's red team tool countermeasure repo

# Changed

  • arguments can now use /arg=value form in addition to /arg:value

# Fixed

  • few kerberoasting fixes

# [1.6.1] - 2020-12-09

# Added

  • /autoenterprise flag to automate retrying failed kerberoasting attempts (@0xe7)
  • support for CVE-2020-17049 using the /bronzebit switch (@0xe7)
  • initial support for basic silver tickets, without a PAC (@0xe7)

# Fixed

  • Cross domain enterprise principal kerberoasting (@0xe7)
  • Kerberoasting using DC IP and supplying a TGT (@0xe7)

# [1.6.0] - 2020-11-06

# Added

  • OPSEC
    • /opsec switch to make asktgt / asktgs / s4u build requests more realistic (@0xe7)
    • Randomized sequence numbers (@0xe7)
    • Added proper checksums (@0xe7)
    • Added enc-authorization-data to TGS-REQs (@0xe7)
    • Don't send AS-REQ when preauth is disabled (@0xe7)
    • Automation of requesting forwarded TGT when requesting a service ticket for unconstrained systems (@0xe7)
    • Added PA-DATA PA-PAC-OPTIONS to normal TGS-REQ when using /opsec (@0xe7)
  • Start of smartcard/PKINIT support (@CCob)
    • /password support
  • Support for /spns option when kerberoasting (@0xe7)
  • Support for NT-Enterprise principals for service ticket requests on both the asktgs and kerberoast commands (@0xe7)
  • Support for modifying S4U2Self tickets to be able to impersonate any user on the requesting machine (@0xe7)
  • Cross-domain s4u / asktgs support (@0xe7)
  • /runfor:X flag for the monitor command (@G0ldenGunSec)
  • IPv6support (@royreinders)

# Changed

  • kerberoast /user:X now takes multiple comma separated values

# Fixed

  • Casing fix for AES key salts
  • Kerberoasting when using TGT to authenticate but not supplying SPNs (@0xe7)
  • GetDCName() issue on non-domain-joined systems
  • Nonced randomized
  • Fixes for issues from non domain machines (@VbScrub)
  • Replaced checks for "NT Authority\System" string with SID comparison
  • /rc4opsec service name fix
  • LDAP paged searching (@cnotin)
  • TGS-REQ AES formatting (@Ion Todd)

# [1.5.0] - 2020-01-31

# Added

  • to any command that outputs base64 ticket blobs

    • the universal /nowrap argument prevents base64 ticket blobs from being display-wrapped

  • the /consoleoutfile argument to redirect console output to a file, and the public MainString("command") function to work over PSRemoting (see end of README.md)

  • brute action (from @Zer1t0)

    • Performs password bruteforcing attacks using raw AS-REQs

  • to triage/klist/dump actions

    • More flexible targeting with /user//LUID//service//server/

  • to the kerberoast action

    • /pwdsetafter, /pwdsetbefore, and /resultlimit arguments for better targeting (from @pkb1s)
    • /stats flag to list statistics of user accounts without actually roasting them
    • /ldapfilter argument for adding custom LDAP filters to the user search query
    • /simple argument for output file formatting but to the console

  • to the asreproast action

    • /ldapfilter argument for adding custom LDAP filters to the user search query

  • to the asktgt/asktgs/s4u actions

    • option to save .kirbi file to disk (from @audrummer15)

  • to the s4u action

    • the cross-domain s4u support (from @0xe7)

  • currentluid command to display the current logon sesion ID

# Changed

  • LSA.cs got a complete overhaul for reusability and flexibility (thanks for the help @leechristensen !)
  • kerberoast action updated to exclude disabled accounts by default
  • harvest mode's /interval argument is now in seconds, to match /monitor
  • harvest / /monitor modes revamped
    • now no longer depend on searching the event logs for 4624 events
    • full set of current TGTs are extracted each monitor round

# Fixed

  • Some timestamp converting code in the ticket extraction section
  • KERB_RETRIEVE_TKT_REQUEST fix for x32 systems (from @0xRCA)
  • Fixed AES salt generation (from @monoxgas)
  • Fixed accidental ticket request behavior when dumping from LsaCallAuthenticationPackage
  • Fixed renew command invocation
  • Fixed asreproast LDAP querying (broke at some point)

# [1.4.2] - 2019-03-01

# Added

  • tgssub action
    • Substitutes in alternate sname (cifs) or SPN (ldap/computer.domain.com) into an existing service ticket

# [1.4.1] - 2019-02-25

# Added

  • to asktgs action
    • /enctype:[RC4/AES128/AES256/DES] now forces that particular encryption type in the TGS-REQ

# Changed

  • asktgt action
    • Returned tickets now run through the describe command
  • describe action
    • Kerberoast hash now only extracted from RC4_HMAC tickets

# [1.4.0] - 2019-02-16

# Added

  • hash action
    • hashes a given password to rc4_hmac form, and if /user and /domain supplied, calculates aes128_cts_hmac_sha1, aes256_cts_hmac_sha1, and des_cbc_md5 forms

# Changed

  • kerberoast action
    • Fixed query that checks that rc4_hmac is flipped in msds-supportedencryption types, because "lol Microsoft"
  • asktgt action
    • /aes128 and /aes now supported for /enctype when used with /password
  • crypto
    • Replaced @qlemaire's PR of Kevin-Robertson' Get-KerberosAESKey hash code with @gentilkiwi's KERB_ECRYPT HashPassword approach
  • README
    • added @elad_shamir into the references

# [1.3.6] - 2019-02-14

# Added

  • kerberoast action
    • /rc4opsec option to use tgtdeleg and filter out AES-enabled accounts
    • /aes option to AES roast only AES-enabled accounts

# Changed

  • kerberoast action
    • Default user query searches for accounts with RC4 enabled
    • Default behavior when using the /tgtdeleg flag requests RC4 for ALL accounts (including AES)
    • Display "Supported ETypes" in enumerated output
  • tgtdeleg action
    • Changed the default requested SPN from HOST/dc.domain.com to cifs/dc.domain.com

# Fixed

  • Kerberoast hash display for some option combinations

# [1.3.5] - 2019-02-13

# Changed

  • kerberoast action
    • now has /ticket option to use an existing TGT for Kerberoasting
    • now has /usetgtdeleg option to use tgtdeleg option as the TGT for Kerberoasting
    • LDAP user search path and number of found users now output
  • describe action
    • Kerberoast hash output now generated for service tickets

# Fixed

  • Kerberoast hash display but when /spn and /outfile were specified
  • Kerberoast samaccountname now properly put into hash output

# [1.3.4] - 2019-02-12

# Changed

  • kerberoast action now has /domain and /dc like asreproast action
  • kerberoast and asreproast now properly work over domain trusts
  • triage command now works for the current non-elevated user, outputting current LUID as well
  • Current LUID output also added for non-elevated dump and klist commands
  • Added Opsec section in README.md

# [1.3.3] - 2019-02-11

# Changed

  • Landed @leechristensen's cleanup of the Monitor4624 code
  • Restructed the README.md to match the help output, updated all examples, added table of contents

# [1.3.3] - 2019-02-07

# Added

  • triage action
    • Quickly triages the users and present tickets on a machine

# Changed

  • dump and klist changed default LUID output to hex format

# [1.3.2] - 2019-02-06

# Added

  • kerberoast and asreproast actions
    • Added /outfile:X to output hashes to a file, one hash per line

# Changed

  • asreproast changed asreproast's default behavior to match kerberoast
  • Clustered the default output help menu around function (things were getting crowded)

# [1.3.1] - 2019-02-06

# Fixed

  • Changed underlying LUID logic to handle UInt64s

# [1.3.0] - 2019-02-05

# Added

  • klist action
    • lists current user's (or if elevated, all users') ticket information

# Changed

  • s4u landed @eladshamir's pull requests
    • RBCD support
    • support loading TGS from Kirbi to skip S4U2Self and perform S4U2Proxy only
    • perform S4U2Self only
    • print output for each stage
  • asreproast landed @rvrsh3ll's pull request
    • added hashcat output format
  • asktgt landed @qlemaire's pull request
    • now accepts a /password:X parameter
  • monitor and harvest landed @djhohnstein's pull request
    • ticket extraction can now be saved to the registry with the "/registry:X" flag

# Fixed

  • dump display of service tickets with multiple slashes
  • response buffer size in lib/Networking.cs increased for large ticket responses
  • landed @BlueSkeye's fixes for PTT bug fix, TicketFlags display, and dead code removal in PA_DATA.Encode

# [1.2.1] - 2018-10-09

# Changed

  • Merged @mark-s' PR that broke out Program.cs' commands into 'Command' classes for easier command addition.
  • Commands that pass /dc:X are now passed through Networking.GetDCIP(), which resolves the DC name (if null) and returns the DC IP. Code refactored to use this centralized resolver.
  • The /user:USER flag can now be /user:DOMAIN.COM\USER (auto-completes /domain:Y).
  • The harvest command now returns the user ticket with the latest renew_till time on intial extraction.

# [1.2.0] - 2018-10-03

# Added

  • changepw action
    • implements the AoratoPw user password reset from a TGT .kirbi
    • equivalent to Kekeo's misc::changepw function

# [1.1.0] - 2018-09-31

# Added

  • asktgs action - takes /ptt:X, /dc:X, /ticket:X flags like asktgt, /service:X takes one or more SPN specifications
  • tgtdeleg action - reimplements @gentilkiwi's Kekeo tgt::deleg function
    • uses the GSS-API Kerberos specification (RFC 4121) to request a "fake" delegation context that stores a KRB-CRED in the Authenticator Checksum. Combined with extracting the service session key from the local cache, this allows us to recover usable TGTs for the current user without elevation.
  • Added CHANGELOG.md

# Changed

  • s4u action now accepts multiple alternate snames (/altservice:X,Y,...)
    • This executes the S4U2self/S4U2proxy process only once, and substitutes the multiple alternate service names into the final resulting service ticket structure(s) for as many snames as specified
  • asreproast action
    • added eventual hashcat output format, use "/format:<john/hashcat>" (default of "john")

# Fixed

  • dump action now correctly extracts ServiceName/TargetName strings
  • asreproast action - fixed salt demarcation line for "asreproast" hashes
  • kerberoast action
    • Added reference for @machsosec for the KerberosRequestorSecurityToken.GetRequest Kerberoasting Method()
    • Corrected encType extraction for the hash output

# [1.0.0] - 2018-08-24

  • Initial release