Metadata-Version: 2.1
Name: ipapocket
Version: 0.1.0
Summary: Toolset for interaction with FreeIPA
Home-page: https://github.com/nu11zy/ipapocket
Author: nu11zy
Maintainer: nu11zy
Platform: Unix
Classifier: Programming Language :: Python :: 3.12
Classifier: Programming Language :: Python :: 3.11
Classifier: Programming Language :: Python :: 3.10
Description-Content-Type: text/markdown
Requires-Dist: annotated-types==0.7.0
Requires-Dist: asn1crypto==1.5.1
Requires-Dist: bitarray==2.9.2
Requires-Dist: pycryptodomex==3.20.0
Requires-Dist: setuptools==72.2.0
Requires-Dist: typing_extensions==4.12.2
Requires-Dist: pyparsing==3.1.2

# ipapocket

`ipapocket` is a python library for interacting with FreeIPA network protocols. `ipapocket` is focused on providing low-level programmatic access to protocols through a convenient object-oriented API, with which you can construct packets from scratch or parse them from raw data. `ipapocket` also provides several tools as an example of what can be done with this library.

## Why?

Due to lack of [support for FreeIPA](https://github.com/fortra/impacket/pull/1684#issuecomment-1986367074) features in impacket and attempts to make a more user-friendly interface for interacting with kerberos (we plan to add more network protocols in the future).

## For developers

**WARNING: This version of the codebase is under active development so the API may change over time**

Install it via `pip` form GitHub:

```sh
pip install git+https://github.com/nu11zy/ipapocket
```

Consider to use a Python virtual environment.

## For pentesters

You can install the tools from the examples using `pipx`:

```sh
pipx install git+https://github.com/nu11zy/ipapocket
```

## Examples AKA the pentest tools

`ipp-cve-2024-3183.py`: PoC for CVE-2024-3183. To crack hashes with AES256-SHA1 (etype 18) you can use this [fork of hashcat](https://github.com/nu11zy/hashcat) with mode `32900`

`ipp-id2entry.py`: parse output of `dbscan -f id2entry.db` and decrypt principals keys (can be used for creation of tickets)

`ipp-get-tgt.py`: get AS-REP and save TGT to CCACHE (normal authentication flow with PASSWORD)

`ipp-get-tgt-spake.py`: get AS-REP and save TGT to CCACHE (SPAKE hardened password)

`ipp-get-tgs.py`: get TGS-REP and save TGS to CCACHE (only use TGT from KRB5CCNAME)

`ipp-user-enum.py`: enumarate users via Kerberos

`ipp-show-ccache.py`: describe credentials in CCACHE
