fixed RPC_C_AUTHN_NETLOGON auth error

[Ridter]

In the process of implementing NetSync using Impacket, I discovered an issue in the authentication section of RPC_C_AUTHN_NETLOGON within Impacket. I made modifications to address the problem, and this submission contains the updated code.
Testing details can be found below: netsync.py.

Shown in the following image:

[ThePirateWhoSmellsOfSunflowers]

Hi,
Nice work. I also played recently with netlogon, have you see my PR #1848 ?

🌻

[Ridter]

Hi, Nice work. I also played recently with netlogon, have you see my PR #1848 ?

🌻

I just saw your PR, nice job!

[anadrianmanrique]

hello @Ridter . I'm testing your changes with your netsync project. I wasn't able to execute it successfully in the context of this PR. I made a little modification in order to be able to perform AES authentication.

└─$` python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[-] can't concat str to bytes

This issue was addressed in the context of #1848. In the context of that PR the test executed successfully

└─$ python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[*] Capabilities: 1093586756
[*] Authenticated successfully! have these capabilities: SupportsRC4, DoesNotRequireValidationLevel2, SupportsRefusePasswordChange, SupportsNetrLogonSendToSam, SupportsGenericPassThroughAuthentication, SupportsConcurrentRpcCalls, SupportsStrongKeys, SupportsTransitiveTrusts, SupportsNetrServerPasswordSet2, SupportsNetrLogonGetDomainInfo, SupportsCrossForestTrusts, SupportsRodcPassThroughToDifferentDomains, SupportsAESAndSHA2, SupportsSecureRpc
[*] Tring to sync password for COMPUTEST$ using credentials for DC25$
[-] No such user: COMPUTEST$ with channel: ServerSecureChannel
[*] Decrypt Old Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
[*] Decrypt New Hash: 6135372a478be0905a376bf327cddb8b

@Ridter I'm trying to figure out which scenario triggers the issue that it's being fixed with this PR. Can you help me with that?
Also, #1848 since it's already ready to be merged, changes in this PR will have to be rebased.
Thanks

[Ridter]

hello @Ridter . I'm testing your changes with your netsync project. I wasn't able to execute it successfully in the context of this PR. I made a little modification in order to be able to perform AES authentication.

└─$` python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[-] can't concat str to bytes

This issue was addressed in the context of #1848. In the context of that PR the test executed successfully

└─$ python3 netsync.py vb25.local/'DC25$'@dc25 -hashes :f498d5e9ade8b9027377574bc6d5f060 -a COMPUTEST$ -ns 192.0.2.69

  _   _      _   ____
 | \ | | ___| |_/ ___| _   _ _ __   ___
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/

[*] HostName: dc25.vb25.local -> Resolved: 192.0.2.69
[*] Using domain controller: dc25.vb25.local for domain vb25.local
[*] Capabilities: 1093586756
[*] Authenticated successfully! have these capabilities: SupportsRC4, DoesNotRequireValidationLevel2, SupportsRefusePasswordChange, SupportsNetrLogonSendToSam, SupportsGenericPassThroughAuthentication, SupportsConcurrentRpcCalls, SupportsStrongKeys, SupportsTransitiveTrusts, SupportsNetrServerPasswordSet2, SupportsNetrLogonGetDomainInfo, SupportsCrossForestTrusts, SupportsRodcPassThroughToDifferentDomains, SupportsAESAndSHA2, SupportsSecureRpc
[*] Tring to sync password for COMPUTEST$ using credentials for DC25$
[-] No such user: COMPUTEST$ with channel: ServerSecureChannel
[*] Decrypt Old Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
[*] Decrypt New Hash: 6135372a478be0905a376bf327cddb8b

@Ridter I'm trying to figure out which scenario triggers the issue that it's being fixed with this PR. Can you help me with that? Also, #1848 since it's already ready to be merged, changes in this PR will have to be rebased. Thanks

Hi, @anadrianmanrique . The previous code only implemented netsync through strong key. Now, based on PR #1848, I have added support for AES. The current code is fully functional and ready to use.

Using AESKey authentication

Using StrongKey authentication

[ThePirateWhoSmellsOfSunflowers]

Hello,

I think you should reopen a PR with only netsync.py because the script currently works without any library modifications.

🌻

[Ridter]

Hello,

I think you should reopen a PR with only netsync.py because the script currently works without any library modifications.

🌻

@ThePirateWhoSmellsOfSunflowers Hi. To run netsync.py, you need to modify getSSPType1 in rpcrt.py, otherwise, it will fail to execute. If you need me to submit a separate PR, I can roll back the current commit and submit a separate PR.

[anadrianmanrique]

Hello @Ridter, thanks for clarification about strong key. Regarding the latest changes I think netsync.py should be removed from this PR, as it is not part of the scope of the original.
As @ThePirateWhoSmellsOfSunflowers mentioned, if you want us to evaluate netsync.py to integrate as a new example, you should create a new PR to review it in that context. Considering that netsync https://github.com/Ridter/netsync/ it's already its own project I wouldn't encourage you to do that though.
Thanks

[ThePirateWhoSmellsOfSunflowers]

@ThePirateWhoSmellsOfSunflowers Hi. To run netsync.py, you need to modify getSSPType1 in rpcrt.py, otherwise, it will fail to execute. If you need me to submit a separate PR, I can roll back the current commit and submit a separate PR.

@Ridter The script works without modifying rpcrt.py on my box

$ python netsync.py -a 'KINGSLANDING$' -hashes :1b67a814138bd1bf2d15e362935b271c sevenkingdoms.local/'KINGSLANDING$'@kingslanding.sevenkingdoms.local

  _   _      _   ____                   
 | \ | | ___| |_/ ___| _   _ _ __   ___ 
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__ 
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/            

[*] HostName: kingslanding.sevenkingdoms.local -> Resolved: 192.168.56.10
[*] Using domain controller: kingslanding.sevenkingdoms.local for domain sevenkingdoms.local
[*] Capabilities: 1093586756
[*] Authenticated successfully! have these capabilities: SupportsRC4, DoesNotRequireValidationLevel2, SupportsRefusePasswordChange, SupportsNetrLogonSendToSam, SupportsGenericPassThroughAuthentication, SupportsConcurrentRpcCalls, SupportsStrongKeys, SupportsTransitiveTrusts, SupportsNetrServerPasswordSet2, SupportsNetrLogonGetDomainInfo, SupportsCrossForestTrusts, SupportsRodcPassThroughToDifferentDomains, SupportsAESAndSHA2, SupportsSecureRpc
[*] Tring to sync password for KINGSLANDING$ using credentials for KINGSLANDING$
[*] Decrypt Old Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
[*] Decrypt New Hash: 1b67a814138bd1bf2d15e362935b271c

[anadrianmanrique]

@Ridter also, your branch should be rebased : git rebase master

[Ridter]

@Ridter also, your branch should be rebased : git rebase master

Done，😊

[Ridter]

@ThePirateWhoSmellsOfSunflowers Hi. To run netsync.py, you need to modify getSSPType1 in rpcrt.py, otherwise, it will fail to execute. If you need me to submit a separate PR, I can roll back the current commit and submit a separate PR.

@Ridter The script works without modifying rpcrt.py on my box

$ python netsync.py -a 'KINGSLANDING$' -hashes :1b67a814138bd1bf2d15e362935b271c sevenkingdoms.local/'KINGSLANDING$'@kingslanding.sevenkingdoms.local

  _   _      _   ____                   
 | \ | | ___| |_/ ___| _   _ _ __   ___ 
 |  \| |/ _ \ __\___ \| | | | '_ \ / __|
 | |\  |  __/ |_ ___) | |_| | | | | (__ 
 |_| \_|\___|\__|____/ \__, |_| |_|\___|
                       |___/            

[*] HostName: kingslanding.sevenkingdoms.local -> Resolved: 192.168.56.10
[*] Using domain controller: kingslanding.sevenkingdoms.local for domain sevenkingdoms.local
[*] Capabilities: 1093586756
[*] Authenticated successfully! have these capabilities: SupportsRC4, DoesNotRequireValidationLevel2, SupportsRefusePasswordChange, SupportsNetrLogonSendToSam, SupportsGenericPassThroughAuthentication, SupportsConcurrentRpcCalls, SupportsStrongKeys, SupportsTransitiveTrusts, SupportsNetrServerPasswordSet2, SupportsNetrLogonGetDomainInfo, SupportsCrossForestTrusts, SupportsRodcPassThroughToDifferentDomains, SupportsAESAndSHA2, SupportsSecureRpc
[*] Tring to sync password for KINGSLANDING$ using credentials for KINGSLANDING$
[*] Decrypt Old Hash: 31d6cfe0d16ae931b73c59d7e0c089c0
[*] Decrypt New Hash: 1b67a814138bd1bf2d15e362935b271c

Hi，@ThePirateWhoSmellsOfSunflowers, when I usenetsync.py with the latest code from the master branch, the following error occurs."