Impacket raiseChild.py
Back to the category index / Back to the command index
Overview
Section titled “Overview”Examines a privilege escalation path from a child domain to the forest root. It retrieves credentials through DRS and creates a ticket containing SIDHistory.
| Item | Details |
|---|---|
| Implementation | examples/raiseChild.py |
| Category | Kerberos / ticket handling |
| Size | 1,306 lines |
| Distribution | Installed as a script through scripts=examples/*.py in setup.py |
CLI and input
Section titled “CLI and input”Run python examples/raiseChild.py -h for the current option definitions.
| Argument | Description |
|---|---|
target | domain/username[:password] |
-ts | Add a timestamp to each log message |
-debug | Enable debug output |
-w | Write the Golden Ticket in ccache format to the specified path |
-target-exec | Host on which to run PSEXEC after the main attack completes |
-targetRID | RID of the user whose credentials to dump; defaults to Administrator (500) |
-hashes | NTLM hashes in LMHASH:NTHASH format |
-no-pass | Do not prompt for a password (useful with -k) |
-k | Use Kerberos authentication. Look for matching credentials in the ccache file named by KRB5CCNAME; if none are valid, use those specified on the command line |
-aesKey | AES key for Kerberos authentication (128 or 256 bits) |
Detailed processing flow
Section titled “Detailed processing flow”The tool discovers the child and parent domains, SIDs, and DCs, then obtains account and krbtgt keys through NRPC, LSA, and DRS. It builds and signs a ticket with the parent enterprise admin RID and other values in the PAC, then obtains a service ticket in the root domain. With -target-exec, it passes control to the PSEXEC path.
How it works
Section titled “How it works”The child and root domains in a forest have separate krbtgt keys and domain SIDs. This command examines the trust and replication path from privileges in the child domain to the root. It gathers the required SIDs and key material, then builds a PAC and ticket with additional SIDs, covering the full process.
During discovery, NRPC obtains DC and domain information, and LSA resolves SIDs and names.
To obtain credentials, it uses DRSUAPI name cracking and replication requests,
then selects RC4 or AES keys from the target account record. Fallbacks such as
_get_preferred_aes_key() account for differences in enctypes supported by the KDC and account.
At the ticket stage, it adds privileged SIDs from the root domain to the child identity’s validation information and signs the PAC checksums and encrypted ticket part with the correct keys. The resulting ticket is saved or passed to service execution on a root-domain host. Domain discovery, DRS secret parsing, PAC generation, and PSEXEC cleanup have separate failure boundaries. A single generic exception must not obscure how far execution progressed.
Key implementation elements
Section titled “Key implementation elements”| Symbol | Location | Where to trace its responsibility |
|---|---|---|
RemComMessage | 113 | Structure or constant definition |
RemComResponse | 123 | Structure or constant definition |
RetryableGoldenTicketError | 135 | Structure or constant definition |
PSEXEC | 138 | __init__(), run(), openPipe() |
Pipes | 266 | __init__(), connectPipe() |
RemoteStdOutPipe | 298 | __init__(), run() |
RemoteStdErrPipe | 325 | __init__(), run() |
RemoteShell | 343 | __init__(), connect_transferClient(), do_help(), do_shell(), do_get(), do_put(), do_lcd(), emptyline(), default(), send_data() |
RemoteStdInPipe | 451 | __init__(), run() |
RAISECHILD | 460 | __init__(), getChildInfo(), getMachineName(), getDNSMachineName(), getParentSidAndTargetName(), DRSCrackNames(), DRSGetNCChanges(), getCredentials(), makeGolden(), raiseUp(), exploit() |
Dependencies
Section titled “Dependencies”Within Impacket
Section titled “Within Impacket”| Module | Main names used |
|---|---|
impacket | version |
impacket.krb5.types | KerberosTime, Principal |
impacket.krb5 | constants |
impacket.krb5.kerberosv5 | KerberosError, getKerberosTGS, getKerberosTGT |
impacket.krb5.asn1 | AD_IF_RELEVANT, AS_REP, AuthorizationData, EncTicketPart |
impacket.krb5.crypto | _enctype_table, get_kerberos_key_for_enctype, get_matching_aes_key |
impacket.dcerpc.v5.ndr | NDRULONG |
impacket.dcerpc.v5.samr | GROUP_MEMBERSHIP, NULL, SE_GROUP_ENABLED, SE_GROUP_ENABLED_BY_DEFAULT, SE_GROUP_MANDATORY |
impacket.examples | logger, remcomsvc, serviceinstall |
impacket.examples.utils | parse_identity |
impacket.ntlm | LMOWFv1, NTOWFv1 |
impacket.dcerpc.v5.dtypes | MAXIMUM_ALLOWED, RPC_SID |
impacket.dcerpc.v5.rpcrt | RPC_C_AUTHN_GSS_NEGOTIATE, RPC_C_AUTHN_LEVEL_PKT_PRIVACY |
impacket.dcerpc.v5.nrpc | MSRPC_UUID_NRPC, hDsrGetDcNameEx |
impacket.dcerpc.v5.lsat | LSAP_LOOKUP_LEVEL, MSRPC_UUID_LSAT, POLICY_LOOKUP_NAMES, hLsarLookupSids |
impacket.dcerpc.v5.lsad | POLICY_INFORMATION_CLASS, hLsarOpenPolicy2, hLsarQueryInformationPolicy2 |
impacket.krb5.pac | KERB_SID_AND_ATTRIBUTES, PACTYPE, PAC_CLIENT_INFO_TYPE, PAC_INFO_BUFFER, PAC_LOGON_INFO, PKERB_SID_AND_ATTRIBUTES_ARRAY, VALIDATION_INFO, sign_pac |
impacket.dcerpc.v5 | drsuapi, epm, samr, transport |
impacket.smbconnection | SMBConnection, SessionError, smb |
impacket.nt_errors | STATUS_NO_LOGON_SERVERS |
impacket.structure | Structure |
impacket.krb5.ccache | CCache |
External packages (used directly)
Section titled “External packages (used directly)”| Import name | Distribution package | Import path and declaration status |
|---|---|---|
pyasn1 | pyasn1 | Imported directly; declared |
six | six | Imported directly; declared |
Output, side effects, and required privileges
Section titled “Output, side effects, and required privileges”- The tool primarily makes queries and authentication attempts. Frequent runs can affect audit logs, account lockouts, and target load.
- Options may create or update local files. Check how existing files are handled and the permissions on output containing secrets.
- Some paths use temporary resources such as remote services, tasks, files, shares, and WMI/RPC resources. Cleaning them up after an abnormal exit is part of the behavior contract.
Failure paths and cleanup
Section titled “Failure paths and cleanup”- On failure, use protocol status codes to determine whether name resolution, connection, authentication, service state, or permissions caused the stop.
- Even without an explicit cleanup function, check for
finally-equivalent paths and closure or deletion of protocol handles.
When changing the implementation
Section titled “When changing the implementation”The code depends on drsuapi, nrpc, lsad, samr, krb5.*, PAC/NDR, and SMB/serviceinstall. RAISECHILD separates discovery, credentials, and tickets into distinct methods. If you change cryptographic key fallbacks or retries, preserve the basis for selecting RC4 or AES.
Verification
Section titled “Verification”- Syntax:
python -m py_compile examples/raiseChild.py - CLI:
python examples/raiseChild.py -h - Related test:
tests/SMB_RPC/test_ndr.py - Related test:
tests/SMB_RPC/test_ntlm.py - Related test:
tests/SMB_RPC/test_rpcrt.py - Related test:
tests/dcerpc/test_lsad.py - Related test:
tests/dcerpc/test_lsat.py - Related test:
tests/dcerpc/test_nrpc.py