mandiant / mandiant/ADFSpoof

Version should be 1 .

Open
#3 10 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
426
Forks
70
PR merge metrics
No merged PRs in 30d

Description

When running python ADFSpoof.py -b Token_sign_blob.bin DKMkey.bin dump
I am getting "Version should be 1" message and script dies.
I modified EncryptedPfx.py to output what the actual version is. The version is: "538976257"
Probably the problem lies in the way I saved EncryptedPfx and DKMkey from ADFSDump
What I did:
1. EncryptedPfx
a) I took everything between: _[-] Encrypted Token Signing Key Begin_ and _[-] Encrypted Token Signing Key End_, which looks like this:
AAAAAQAAAAAEEGXuqoRBIwFInUU[....]q6YTotIB2BA8v+zfmKuMDPw==
b) I based64 decoded and saved the output to Token_sign_blob.bin

2. DKM key
a) I took Private Key: B7-12-96-C1-50-89-CA-54-B7-D2-ED-E5-F0-8E-24-AA-4F-27-2F-1B-2C-9E-2E-8A-43-47-42-FD-55-B0-72-CB
b) I removed dashes.
c) I base64 decoded it and saved the output to DKMkey.bin

Is there any other type of conversation that needs to be done?

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing `python ADFSpoof.py -b Token_sign_blob.bin DKMkey.bin dump` with the files produced from the EncryptedPfx and DKM key values described here. Read ADFSpoof.py and the modified EncryptedPfx.py to trace how the version and inputs are read; done means identifying the required conversion or documenting why these inputs are rejected.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.