Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
ctr = 0
if args.out_file:
with open(os.path.join(basefolder,basefile+'_ldap_custom.tsv'), 'w', newline='') as f:
writer = csv.writer(f, delimiter = '\t')
writer.writerow(args.attrs)
for obj in connection.pagedsearch(args.filter, args.attrs):
ctr += 1
writer.writerow([str(obj['attributes'].get(x, 'N/A')) for x in args.attrs])
else:
for obj in connection.pagedsearch(args.filter, args.attrs):
ctr += 1
print('\t'.join([str(obj['attributes'].get(x, 'N/A')) for x in args.attrs]))
logging.debug('Custom search yielded %d results!' % ctr)
target = MSLDAPTarget(args.dc_ip)
else:
target = MSLDAPTarget(machine.get_domain())
connection = MSLDAPConnection(creds, target)
connection.connect()
try:
adinfo = connection.get_ad_info()
domain = adinfo.distinguishedName.replace('DC=','').replace(',','.')
except Exception as e:
logging.warning('[LDAP] Failed to get domain name from LDAP server. This is not normal, but happens. Reason: %s' % e)
domain = machine.get_domain()
if args.cmd == 'spn':
logging.debug('Enumerating SPN user accounts...')
cnt = 0
if args.out_file:
with open(os.path.join(basefolder,basefile+'_spn_users.txt'), 'w', newline='') as f:
for user in connection.get_all_service_user_objects():
cnt += 1
f.write('%s/%s\r\n' % (domain, user.sAMAccountName))
else:
print('[+] SPN users')
for user in connection.get_all_service_user_objects():
cnt += 1
print('%s/%s' % (domain, user.sAMAccountName))
logging.debug('Enumerated %d SPN user accounts' % cnt)
elif args.cmd == 'asrep':
print('\t'.join(attrs))
for user in connection.get_all_user_objects():
ctr += 1
print('\t'.join([str(x) for x in user.get_row(attrs)]))
logging.debug('Enumerated %d user accounts' % ctr)
elif args.cmd == 'custom':
if not args.filter:
raise Exception('Custom LDAP search requires the search filter to be specified!')
if not args.attrs:
raise Exception('Custom LDAP search requires the attributes to be specified!')
logging.debug('Perforing search on the AD with the following filter: %s' % args.filter)
logging.debug('Search will contain the following attributes: %s' % ','.join(args.attrs))
ctr = 0
if args.out_file:
with open(os.path.join(basefolder,basefile+'_ldap_custom.tsv'), 'w', newline='') as f:
writer = csv.writer(f, delimiter = '\t')
writer.writerow(args.attrs)
for obj in connection.pagedsearch(args.filter, args.attrs):
ctr += 1
writer.writerow([str(obj['attributes'].get(x, 'N/A')) for x in args.attrs])
else:
for obj in connection.pagedsearch(args.filter, args.attrs):
ctr += 1
print('\t'.join([str(obj['attributes'].get(x, 'N/A')) for x in args.attrs]))
logging.debug('Custom search yielded %d results!' % ctr)
ctr = 0
if args.out_file:
with open(os.path.join(basefolder,basefile+'_asrep_users.txt'), 'w', newline='') as f:
for user in connection.get_all_knoreq_user_objects():
ctr += 1
f.write('%s/%s\r\n' % (domain, user.sAMAccountName))
else:
print('[+] ASREP users')
for user in connection.get_all_knoreq_user_objects():
ctr += 1
print('%s/%s' % (domain, user.sAMAccountName))
logging.debug('Enumerated %d ASREP user accounts' % ctr)
elif args.cmd == 'dump':
logging.debug('Enumerating ALL user accounts, this will take some time depending on the size of the domain')
ctr = 0
attrs = args.attrs if args.attrs is not None else MSADUser.TSV_ATTRS
if args.out_file:
with open(os.path.join(basefolder,basefile+'_ldap_users.tsv'), 'w', newline='', encoding ='utf8') as f:
writer = csv.writer(f, delimiter = '\t')
writer.writerow(attrs)
for user in connection.get_all_user_objects():
ctr += 1
writer.writerow(user.get_row(attrs))
else:
logging.debug('Are you sure about this?')
print('[+] Full user dump')
print('\t'.join(attrs))
for user in connection.get_all_user_objects():
ctr += 1
creds = MSLDAPCredential.from_connection_string(args.credential)
target = MSLDAPTarget.from_connection_string(args.credential)
connection = MSLDAPConnection(creds, target)
connection.connect()
try:
adinfo = connection.get_ad_info()
domain = adinfo.distinguishedName.replace('DC=','').replace(',','.')
except Exception as e:
logging.warning('[LDAP] Failed to get domain name from LDAP server. This is not normal, but happens. Reason: %s' % e)
domain = machine.get_domain()
if args.cmd == 'spn':
logging.debug('Enumerating SPN user accounts...')
cnt = 0
if args.out_file:
with open(os.path.join(basefolder,basefile+'_spn_users.txt'), 'w', newline='') as f:
for user in connection.get_all_service_user_objects():
cnt += 1
f.write('%s/%s\r\n' % (domain, user.sAMAccountName))
else:
print('[+] SPN users')
for user in connection.get_all_service_user_objects():
cnt += 1
print('%s/%s' % (domain, user.sAMAccountName))
logging.debug('Enumerated %d SPN user accounts' % cnt)
elif args.cmd == 'asrep':
logging.debug('Enumerated %d ASREP user accounts' % ctr)
elif args.cmd == 'dump':
logging.debug('Enumerating ALL user accounts, this will take some time depending on the size of the domain')
ctr = 0
attrs = args.attrs if args.attrs is not None else MSADUser.TSV_ATTRS
if args.out_file:
with open(os.path.join(basefolder,basefile+'_ldap_users.tsv'), 'w', newline='', encoding ='utf8') as f:
writer = csv.writer(f, delimiter = '\t')
writer.writerow(attrs)
for user in connection.get_all_user_objects():
ctr += 1
writer.writerow(user.get_row(attrs))
else:
logging.debug('Are you sure about this?')
print('[+] Full user dump')
print('\t'.join(attrs))
for user in connection.get_all_user_objects():
ctr += 1
print('\t'.join([str(x) for x in user.get_row(attrs)]))
logging.debug('Enumerated %d user accounts' % ctr)
elif args.cmd == 'custom':
if not args.filter:
raise Exception('Custom LDAP search requires the search filter to be specified!')
if not args.attrs:
raise Exception('Custom LDAP search requires the attributes to be specified!')
logging.debug('Perforing search on the AD with the following filter: %s' % args.filter)