#!/usr/bin/env python

# Impacket - Collection of Python classes for working with network protocols.

#

# Copyright Fortra, LLC and its affiliated companies

#

# All rights reserved.

#

# This software is provided under a slightly modified version

# of the Apache Software License. See the accompanying LICENSE file

# for more information.

#

# Description:

# This script is a collection of functions to change or reset the password of

# a user via various protocols. It supports:

# - MS-SAMR over SMB or RPC transport (NetUserChangePassword and NetUserSetInfo protocols)

# - Kerberos change-password and reset-password protocols

# - LDAP password change and reset

#

# The last documented mechanism (XACT-SMB) is not implemented.

#

# A password change can usually be initiated when the previous password (or its

# hash) is known, by the account itself or any other user.

# A password reset requires additional permissions and may in some case bypass

# password policies.

#

# Tradeoff of the different protocols:

# - MS-SAMR over SMB: (smbpasswd)

# * SMB communication with the server or domain controller is required

# * Can perform password change when the current password is expired

# * Supports plaintext password and NTLM hashes as the new password value

# * If provided as plaintext, password policy is enforced

# * If using NTLM hashes, the new password is flagged as expired

# * If using password reset with a NTLM hash, password policy and history is ignored

# * When using hashes for change or reset, Kerberos keys are not created

# - MS-SAMR over MS-RPC:

# * RPC communication over TCP/135 and random ports

# * Cannot get a handle on user object with default AD configuration:

# - cannot use hSamrChangePasswordUser to change password with hashes only

# - cannot use hSamrSetInformationUser to reset the password

# * Password policy is enforced

# - Kerberos Change Password: (kpasswd)

# * Must use Kerberos authentication

# * Must have a valid TGT/key or valid password for the user

# * Must provide the new password as plaintext

# * Password policy is enforced

# - Kerberos Set Password:

# * Must use Kerberos authentication

# * Must have a valid TGT/key or valid password for the admin

# * Must provide the new password as plaintext

# - LDAP password change:

# * The server must support TLS. If the DC is misconfigured, you cannot connect

# * Must provide the old and new passwords as plaintext

# * Password policy is enforced

# - LDAP password set:

# * The server must support TLS. If the DC is misconfigured, you cannot connect

# * Must provide the new password as plaintext

#

# Examples:

# SAMR protocol over SMB transport to change passwords (like smbpasswd, -protocol smb-samr is implied)

# changepasswd.py j.doe@192.168.1.11

# changepasswd.py contoso.local/j.doe@DC1 -hashes :fc525c9683e8fe067095ba2ddc971889

# changepasswd.py -protocol smb-samr contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

# changepasswd.py contoso.local/j.doe:'Passw0rd!'@DC1 -newhashes :126502da14a98b58f2c319b81b3a49cb

# changepasswd.py contoso.local/j.doe@DC1 -newhashes :126502da14a98b58f2c319b81b3a49cb -k -no-pass

#

# SAMR protocol over SMB transport to reset passwords (like smbpasswd, -protocol smb-samr is implied)

# changepasswd.py -reset contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

# -altuser administrator -altpass 'Adm1nPassw0rd!'

# changepasswd.py -reset -protocol smb-samr contoso.local/j.doe:'Passw0rd!'@DC1

# -newhashes :126502da14a98b58f2c319b81b3a49cb -altuser CONTOSO/administrator -altpass 'Adm1nPassw0rd!'

# changepasswd.py -reset SRV01/administrator:'Passw0rd!'@10.10.13.37 -newhashes :126502da14a98b58f2c319b81b3a49cb

# -altuser CONTOSO/SrvAdm -althash 6fe945ead39a7a6a2091001d98a913ab

# changepasswd.py -reset SRV01/administrator:'Passw0rd!'@10.10.13.37 -newhashes :126502da14a98b58f2c319b81b3a49cb

# -altuser CONTOSO/DomAdm -k -no-pass

#

# SAMR protocol over MS-RPC transport to change passwords

# changepasswd.py -protocol rpc-samr contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

#

# Kerberos Change Password protocol (like kpasswd) (-newhashes is not supported and -k is implied)

# changepasswd.py -protocol kpasswd contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

#

# Kerberos Reset Password protocol (like kpasswd) (-newhashes is not supported and -k is implied)

# changepasswd.py -reset -protocol kpasswd contoso.local/j.doe@DC1 -newpass 'N3wPassw0rd!'

# -altuser CONTOSO/SrvAdm

#

# LDAP password change (like ldappasswd) (-newhashes is not supported)

# changepasswd.py -p ldap contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

# changepasswd.py -p ldap -k contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

#

# LDAP password set (-newhashes is not supported)

# changepasswd.py -reset -p ldap contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

# -altuser administrator -althash 6fe945ead39a7a6a2091001d98a913ab

# changepasswd.py -reset -p ldap -k contoso.local/j.doe:'Passw0rd!'@DC1 -newpass 'N3wPassw0rd!'

# -altuser CONTOSO/SrvAdm -k -no-pass

#

#

# This script is based on smbpasswd.py.

#

# Authors:

# @snovvcrash

# @alef-burzmali

# @bransh

# @Oddvarmoe

# @p0dalirius

#

# References:

# https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/password-change-mechanisms

# [MS-SAMR] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/acb3204a-da8b-478e-9139-1ea589edb880

# [MS-SAMR] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/9699d8ca-e1a4-433c-a8c3-d7bebeb01476

# [MS-SAMR] https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-samr/538222f7-1b89-4811-949a-0eac62e38dce

# [LDAP] https://learn.microsoft.com/en-us/troubleshoot/windows-server/identity/change-windows-active-directory-user-password

# [KPASSWD] https://www.rfc-editor.org/rfc/rfc3244.txt

# https://snovvcrash.github.io/2020/10/31/pretending-to-be-smbpasswd-with-impacket.html

# https://www.n00py.io/2021/09/resetting-expired-passwords-remotely/

# https://github.com/samba-team/samba/blob/master/source3/utils/smbpasswd.c

# https://github.com/fortra/impacket/pull/381

# https://github.com/fortra/impacket/pull/1189

# https://github.com/fortra/impacket/pull/1304

#

import argparse

import logging

import sys

from getpass import getpass

from impacket import version

from impacket.dcerpc.v5 import transport, samr, epm

from impacket.krb5 import kpasswd

from impacket.ldap import ldap, ldapasn1

from impacket.examples import logger

from impacket.examples.utils import parse_target

EMPTY_LM_HASH = "aad3b435b51404eeaad3b435b51404ee"

class PasswordHandler:

return self._setPassword(targetUsername, targetDomain, newPassword, newPwdHashLM, newPwdHashNT)

class KPassword(PasswordHandler):

logging.info(f"Password was set successfully for {targetDomain}\\{targetUsername}.")

class SamrPassword(PasswordHandler):

return res

class RpcPassword(SamrPassword):

super()._setPassword(targetUsername, targetDomain, newPassword, newPwdHashLM, newPwdHashNT)

class SmbPassword(SamrPassword):

def rpctransport(self):

return transport.SMBTransport(self.address, filename=r"\samr")

class LdapPassword(PasswordHandler):

return self._modifyPassword(False, targetUsername, targetDomain, None, newPasswordEncoded)

def init_logger(options):

logging.getLogger().setLevel(logging.INFO)

def parse_args():

return parser.parse_args()

if __name__ == "__main__":

print(version.BANNER)

options = parse_args()

init_logger(options)

handlers = {

"kpasswd": KPassword,

"rpc-samr": RpcPassword,

"smb-samr": SmbPassword,

"ldap": LdapPassword,

}

try:

PasswordProtocol = handlers[options.protocol]

except KeyError:

logging.critical(f"Unsupported password protocol {options.protocol}")

sys.exit(1)

# Parse account whose password is changed

targetDomain, targetUsername, oldPassword, address = parse_target(options.target)

if not targetDomain:

if options.protocol in ("rpc-samr", "smb-samr"):

targetDomain = "Builtin"

else:

targetDomain = address

if options.hashes is not None:

try:

oldPwdHashLM, oldPwdHashNT = options.hashes.split(":")

except ValueError:

oldPwdHashLM = EMPTY_LM_HASH

oldPwdHashNT = options.hashes

else:

oldPwdHashLM = ""

oldPwdHashNT = ""

if oldPassword == "" and oldPwdHashNT == "":

if options.reset:

pass # no need for old one when we reset

elif options.no_pass:

logging.info("Current password not given: will use KRB5CCNAME")

else:

oldPassword = getpass("Current password: ")

if options.newhashes is not None:

newPassword = ""

try:

newPwdHashLM, newPwdHashNT = options.newhashes.split(":")

if not newPwdHashLM:

newPwdHashLM = EMPTY_LM_HASH

except ValueError:

newPwdHashLM = EMPTY_LM_HASH

newPwdHashNT = options.newhashes

else:

newPwdHashLM = ""

newPwdHashNT = ""

if options.newpass is None:

newPassword = getpass("New password: ")

if newPassword != getpass("Retype new password: "):

logging.critical("Passwords do not match, try again.")

sys.exit(1)

else:

newPassword = options.newpass

# Parse account of password changer

if options.altuser is not None:

try:

authDomain, authUsername = options.altuser.split("/")

except ValueError:

authDomain = targetDomain

authUsername = options.altuser

if options.althash is not None:

try:

authPwdHashLM, authPwdHashNT = options.althash.split(":")

except ValueError:

authPwdHashLM = ""

authPwdHashNT = options.althash

else:

authPwdHashLM = ""

authPwdHashNT = ""

authPassword = ""

if options.altpass is not None:

authPassword = options.altpass

if options.altpass is None and options.althash is None and not options.no_pass:

logging.critical(

"Please, provide either alternative password (-altpass) or NT hash (-althash) for authentication, "

"or specify -no-pass if you rely on Kerberos only"

)

sys.exit(1)

else:

authDomain = targetDomain

authUsername = targetUsername

authPassword = oldPassword

authPwdHashLM = oldPwdHashLM

authPwdHashNT = oldPwdHashNT

doKerberos = options.k

if options.protocol == "kpasswd" and not doKerberos:

logging.debug("Using the KPassword protocol implies Kerberos authentication (-k)")

doKerberos = True

# Create a password management session

handler = PasswordProtocol(

address,

authDomain,

authUsername,

authPassword,

authPwdHashLM,

authPwdHashNT,

doKerberos,

options.aesKey,

kdcHost=options.dc_ip,

)

# Attempt the password change/reset

if options.reset:

handler.setPassword(targetUsername, targetDomain, newPassword, newPwdHashLM, newPwdHashNT)

else:

if (authDomain, authUsername) != (targetDomain, targetUsername):

logging.warning(

f"Attempting to *change* the password of {targetDomain}/{targetUsername} as {authDomain}/{authUsername}. "

"You may want to use '-reset' to *reset* the password of the target."

)

handler.changePassword(

targetUsername, targetDomain, oldPassword, newPassword, oldPwdHashLM, oldPwdHashNT, newPwdHashLM, newPwdHashNT

)