Resign a ticket (priv)
(self, tkt, spn, hash=None, kdc_hash=None)
| 2331 | self.update_ticket(i, tkt, hash=hash) |
| 2332 | |
| 2333 | def _resign_ticket(self, tkt, spn, hash=None, kdc_hash=None): |
| 2334 | """ |
| 2335 | Resign a ticket (priv) |
| 2336 | """ |
| 2337 | # [MS-PAC] 2.8.1 - 2.8.5 |
| 2338 | rpac = tkt.authorizationData.seq[0].adData.seq[0].adData # real pac |
| 2339 | tmp_tkt = tkt.copy() # fake ticket and pac used for computation |
| 2340 | pac = tmp_tkt.authorizationData.seq[0].adData.seq[0].adData |
| 2341 | # Variables for Signatures, indexed by ulType |
| 2342 | sig_i = {} |
| 2343 | sig_type = {} |
| 2344 | # Read PAC buffers to find all signatures, and set them to 0 |
| 2345 | for k, buf in enumerate(pac.Buffers): |
| 2346 | if buf.ulType in [0x00000006, 0x00000007, 0x00000010, 0x00000013]: |
| 2347 | sig_i[buf.ulType] = k |
| 2348 | sig_type[buf.ulType] = pac.Payloads[k].SignatureType |
| 2349 | try: |
| 2350 | pac.Payloads[k].Signature = ( |
| 2351 | b"\x00" * _checksums[pac.Payloads[k].SignatureType].macsize |
| 2352 | ) |
| 2353 | except KeyError: |
| 2354 | raise ValueError("Unknown/Unsupported signatureType") |
| 2355 | rpac.Buffers[k].cbBufferSize = None |
| 2356 | rpac.Buffers[k].Offset = None |
| 2357 | |
| 2358 | # There must at least be Server Signature and KDC Signature |
| 2359 | if any(x not in sig_i for x in [0x00000006, 0x00000007]): |
| 2360 | raise ValueError("Cannot sign PAC: missing a compulsory signature") |
| 2361 | |
| 2362 | # Build the 2 necessary keys |
| 2363 | key_srv = self._prompt_hash( |
| 2364 | spn, |
| 2365 | cksumtype=sig_type[0x00000006], |
| 2366 | hash=hash, |
| 2367 | ) |
| 2368 | key_kdc = self._prompt_hash( |
| 2369 | "krbtgt/" + "@".join(spn.split("@")[1:] * 2), |
| 2370 | cksumtype=sig_type[0x00000007], |
| 2371 | hash=kdc_hash, |
| 2372 | ) |
| 2373 | |
| 2374 | # Doc was updated after feedback ! it's now very clear. |
| 2375 | |
| 2376 | # [MS-PAC] sect 2.8.1 |
| 2377 | # Signatures are computed in this order: |
| 2378 | # - Ticket signature |
| 2379 | # - Extended KDC signature |
| 2380 | # - Server signature |
| 2381 | # - KDC signature |
| 2382 | |
| 2383 | # sect 2.8.2 - Ticket Signature |
| 2384 | |
| 2385 | if 0x00000010 in sig_i: |
| 2386 | # "The ad-data in the PAC’s AuthorizationData element ([RFC4120] |
| 2387 | # section 5.2.6) is replaced with a single zero byte" |
| 2388 | tmp_tkt.authorizationData.seq[0].adData.seq[0].adData = b"\x00" |
| 2389 | rpac.Payloads[sig_i[0x00000010]].Signature = ticket_sig = ( |
| 2390 | key_kdc.make_checksum( |
no test coverage detected