Update Program.cs

[ricardojba]

Hi,
The original only supports the RC4 encryption scheme which is bad for OPSEC and breaks the exploit if the target domain has RC4 disabled.
The MR supports DES, RC4, AES128 and AES256 (default) and also the code changes will allow the exploit to be reflectively loaded by Powershell like this: https://github.com/ricardojba/Invoke-noPac

[KINGSABRI]

This code returns

[+] Domain: vulnerable.com
[+] User account: user99
[+] Encryption type: AES256 (default when no /enctype is specified and for better opsec)
[+] Distinguished Name = CN=noPacFakeComp1,CN=Computers,DC=vulnerable,DC=com
[+] Machine account noPacFakeComp1 added
[+] Machine account noPacFakeComp1 attribute serviceprincipalname cleared
[+] Machine account noPacFakeComp1 attribute samaccountname updated

[X] KRB-ERROR (24) : KDC_ERR_PREAUTH_FAILED


Unhandled Exception: System.NullReferenceException: Object reference not set to an instance of an object.
   at noPac.Program.Main(String[] args)

even with specifying accepted encryption (e.g. rc4)

Additionally, it doesn't handle an existing object properly

System.DirectoryServices.DirectoryServicesCOMException (0x80071392): The object already exists.

   at System.DirectoryServices.DirectoryEntry.CommitChanges()
   at noPac.Program.SetMachineAccountAttribute(String container, String distinguishedName, String domain, String domainController, String attribute, String machineAccount, String value, Boolean append, Boolean clear, Boolean verbose, NetworkCredential credential)

Unhandled Exception: System.DirectoryServices.DirectoryServicesCOMException: The object already exists.

   at System.DirectoryServices.DirectoryEntry.CommitChanges()
   at noPac.Program.SetMachineAccountAttribute(String container, String distinguishedName, String domain, String domainController, String attribute, String machineAccount, String value, Boolean append, Boolean clear, Boolean verbose, NetworkCredential credential)
   at noPac.Program.Main(String[] args)

[KINGSABRI]

Is there any delegate way to detect the supported encryption before executing the command? or let the scan and/or exploit functions detect the supported algorithm?