LDAP error bind 49 about krbrelay HOT 7 CLOSED

hi!
use FQDN in the spn parameter and try the latest version i just pushed

from krbrelay.

I have tried the latest version and the spn param with FQDN, the whole command like KrbRelay.exe -spn ldap/WIN-1TCHOPTDEJ5.tempad.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -console
and the same error returned:

[*] Relaying context: tempad.local\PC-01$
[*] Rewriting function table
[*] Rewriting PEB
[*] GetModuleFileName: System
[*] Init com server
[*] CoInitializeSecurity hResult 0x80010119
[*] GetModuleFileName: C:\Users\test1\Desktop\kerberosRelay\KrbRelay.exe
[*] Register com server
objref:TUVPVwEAAAAAAAAAAAAAAMAAAAAAAABGgQIAAAAAAACyVuRV/xS6Pa9PMFEoKzG1AoAAAJAU//8q63PhyIL6VyIADAAHADEAMgA3AC4AMAAuADAALgAxAAAAAAAJAP//AAAeAP//AAAQAP//AAAKAP//AAAWAP//AAAfAP//AAAOAP//AAAAAA==:

[*] Forcing SYSTEM authentication
[*] Using CLSID: 90f18417-f0f1-484e-9d3c-59dceee5dbd8
[*] apReq: 05000b0710000000db00330002000000d016d0160000000003000000000001004301000000000000c00000000000004600000000045d888aeb1cc9119fe808002b10486002000000010001004301000000000000c0000000000000460000000033057171babe37498319b5dbef9ccc3601000000020001004301000000000000c000000000000046000000002c1cb76c129840450300000000000000010000000a050000000000004e544c4d535350000100000097b208e2060006002d00000005000500280000000a0063450000000f50432d303154454d504144
[*] bind: 49
[*] ldap_get_option: LDAP_INVALID_CREDENTIALS
[-] Ldap failed

I just review james forshaw's article found that maybe the problem is about CoInitializeSecurity
I modified the code in Program.cs line 865 to print the return value

Console.WriteLine("[*] Init com server");
var hResult = CoInitializeSecurity(IntPtr.Zero, svcs.Length, svcs,
IntPtr.Zero, AuthnLevel.RPC_C_AUTHN_LEVEL_DEFAULT,
ImpLevel.RPC_C_IMP_LEVEL_IMPERSONATE, IntPtr.Zero,
Natives.EOLE_AUTHENTICATION_CAPABILITIES.EOAC_DYNAMIC_CLOAKING,
IntPtr.Zero);
string hResultStr = "0x" + hResult.ToString("X");
Console.WriteLine("[*] CoInitializeSecurity hResult {0}", hResultStr);

from krbrelay.

a valid apReq starts with "60", you cannot expect it to work with an invalid apReq :p
check your environment and parameters

from krbrelay.

a valid apReq starts with "60", you cannot expect it to work with an invalid apReq :p check your environment and parameters

I got same error however my apReq starts with 60 which is valid packet as you said...
Besides, I also got error [*] ldap_modify: LDAP_NO_SUCH_OBJECT , I had tried FQDN, hostname with $ & hostname only, none of them worked, please check this, thanks a lot!!

Tested on Win10 1909 & Win10 20H2, the DC is Server 16.

from krbrelay.

when I use FQDN, it printed like this:
[*] System.ArgumentNullException: value cannot be null

The command is krbrelay.exe -spn ldap/dc.local.com -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -shadowcred pc$.local.com -port 10.

And I'm sure the apReq starts with 60.

@cube0x0

from krbrelay.

when I use FQDN, it printed like this: [*] System.ArgumentNullException: value cannot be null

The command is krbrelay.exe -spn ldap/dc.local.com -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -shadowcred pc$.local.com -port 10.

And I'm sure the apReq starts with 60.

@cube0x0

Same issue here. Anyone found a solution ?

from krbrelay.

It looks like it has been patched. https://blog.0patch.com/2022/08/micropatching-krbrelay-local-privilege.html
It works when I uninstall the MS Security patches installed (in November in my case).

from krbrelay.