Repository navigation
ENG-8820 fix(network-ops): pass bloodyAD hashes via -p for pass-the-hash - #176
Merged
Merged
Conversation
…8820) bloodyAD has no --hashes flag; the shared connection-options builder now supplies a hash through the password field (-p LMHASH:NTHASH, or -p :NTHASH for an NT-only hash), restoring pass-the-hash across all bloodyAD tool methods. Password and Kerberos auth are unchanged. Adds unit tests for the built argv, including one per public bloodyad_* method so a method that forgets to forward its hash fails loudly.
…s-the-hash # Conflicts: # capabilities/network-ops/tests/test_tool_fixes.py
mkultraWasHere
approved these changes
Oct 14, 2026
danielvaughn
approved these changes
Oct 15, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bloodyAD has no
--hashesflag, so every hash-auth (pass-the-hash) call failed withunrecognized arguments: --hashes— the hash fell through to the positional subcommand and errored. The shared_build_connection_optionshelper now passes a hash through the password field (-p LMHASH:NTHASH, or-p :NTHASHfor an NT-only hash), restoring pass-the-hash across all bloodyAD tool methods. Password and Kerberos auth are unchanged.Changes
tools/bloodyad.py— route hashes through-p; drop the nonexistent--hashesflag. Handles both a fullLMHASH:NTHASHvalue (passed through) and a bare NT hash (normalized to:NTHASH).tests/test_tool_fixes.py— assert the built argv for the hash path (bare NT →:NTHASH, full pair passthrough, password-over-hash precedence,--hashesnever emitted), plus a parametrized test over every publicbloodyad_*method so a tool that forgets to forward its hash fails loudly rather than silently losing hash auth.Testing
--hashesform reproduces the original bug (argparse rejects it); the new-p :NTHASHform authenticates with a valid NT hash (clears the LDAP bind) and is denied at the bind with a wrong hash (SEC_E_LOGON_DENIED).Note
bloodyAD credentials (NT hash or password) are passed as
-p <value>, so they land in the child process argv and in the SDK's command logs (execute()logs the full command on debug and on non-zero exit). This is inherent to bloodyAD's CLI — there is no argv-free credential path — but redacting-pvalues inexecute()'s log lines is worth a separate follow-up before public release.