Add new Ldap session type #19058
Merged
Add new Ldap session type #19058
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
dwelch-r7
force-pushed
the
ldap-session-type
branch
from
a7ba39c
to
3257a29
Compare
|
We recently added the Shadow Credentials module in #19051 and I think that was after this branch was created. Would you mind pulling in those changes and adding LDAP session support to that module when the time comes? |
dwelch-r7
force-pushed
the
ldap-session-type
branch
from
3257a29
to
6bbbae7
Compare
dwelch-r7
force-pushed
the
ldap-session-type
branch
4 times, most recently
from
16e969d
to
cd4b2ca
Compare
dwelch-r7
force-pushed
the
ldap-session-type
branch
4 times, most recently
from
9827e4a
to
03f4ce7
Compare
lib/rex/post/ldap/ui/console.rb
Outdated
| # Runs the specified command wrapper in something to catch exceptions. | ||
| # | ||
| def run_command(dispatcher, method, arguments) | ||
| # TODO: double check these are the correct errors to handle |
| module Ui | ||
| ### | ||
| # | ||
| # Core SMB client commands |
There was a problem hiding this comment.
Suggested change
| # Core SMB client commands | |
| # Core LDAP client commands |
| # | ||
| # Shares | ||
| # | ||
| def name |
| @@ -45,7 +45,7 @@ def initialize(opts = {}) | |||
| # @raise [RuntimeError] if the connection can not be created | |||
| def connect | |||
| return connection if connection | |||
|
|
|||
| raise ArgumentError, 'Missing remote address' unless self.host && self.port | |||
There was a problem hiding this comment.
Note: Maybe a better fix in Rex is needed here
dwelch-r7
force-pushed
the
ldap-session-type
branch
from
03f4ce7
to
771c183
Compare
bwatters-r7
reviewed
May 10, 2024
| if datastore['CreateSession'] | ||
| print_status("#{sessions.size} LDAP #{sessions.size == 1 ? 'session was' : 'sessions were'} opened successfully.") | ||
| else | ||
| print_status('You can open an LDAP session with these credentials and %grnCreateSession%clr set to true') |
There was a problem hiding this comment.
Suggested change
| print_status('You can open an LDAP session with these credentials and %grnCreateSession%clr set to true') | |
| print_status('You can open an LDAP session with these credentials and %grnCreateSession%clr set to true') if framework.features.enabled?(Msf::FeatureManager::LDAP_SESSION_TYPE) |
|
I'm confused by I can readily create an smb session, but it fails when I give it to the ldap_query module, which makes sense? Am I missing something? |
|
I think either he's saying to test that SMB sessions still work with SMB modules, or it's a typo and it should have been LDAP and not SMB. Either way, an SMB session isn't compatible with the |
|
Apologies I lifted the testing steps from the SMB PR to make sure we were testing these new sessions in all the same ways, I've updated the verification steps now to read LDAP instead of SMB |
|
When I use |
|
Same result for |
|
I was unable to replicate these errors in the light of day; we think it might be because the session timed out and then silently failed. |
Did some poking arpund on this, seems that the default idle timeout for ldap connections is 15 minutes, after leaving a session idle for 15+ minutes I was able to replicate the issue you reported and I've added in some extra handling for inactive sessions and killing them when they are next interacted with At some point we'll probably want some sort of keep alive function so the sessions can stay around longer but I think we don't need it for MVP |
dwelch-r7
force-pushed
the
ldap-session-type
branch
from
14deefb
to
68f7334
Compare
bwatters-r7
closed this pull request by merging all changes
into
rapid7:master
in
f3a8b35
Release notesThis adds an LDAP session type allowing users and modules to interact directly with LDAP servers without uploading a payload. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Similar to adding the SMB session type here #18539 and here #18596 but for LDAP sessions/modules that can take advantage of re-using an ldap session
This PR adds in a new session type for LDAP following on from the recently added SQL and SMB sessions
Verification Steps:
Enable the new LDAP session feature
features set ldap_session_type trueRun
auxiliary/scanner/ldap/ldap_loginagainst an ldap server to get a session (an example of running an ldap container can be found in the ldap acceptance tests heremetasploit-framework/.github/workflows/ldap_acceptance.yml
Lines 67 to 71 in 33ffc14
Interact with the session with
sessions -i <session_id>and withsessions -i -1Run the
querycommand (example queries used by theldap_querymodule found here https://github.com/rapid7/metasploit-framework/blob/97f75c19e43bff214ec408854f30b0144a0a2347/data/auxiliary/gather/ldap_query/ldap_queries_default.yaml )Run
bgto background the sessionuse auxiliary/gather/ldap_queryand thenset SESSION <session_id>run the module and you should get successful results backExit the session with
exitfrom within the session context and viasessions -K/sessions -k <session_id>make sure the feature is off first
features set ldap_session_type falseRun through the standard usage of the modules, ensure the
SESSIONdatastore option is not visible and the modules succeedTurn the feature on
features set ldap_session_type trueRun through the modules again creating or using an LDAP session type where applicable, the results should be identical to the modules standard usage
Ensure authentication with
LDAP::Auth=kerberosworks with theldap_loginmodule and that that session works with another module e.g. ldap_query