o
    Žõ±jEó  ã                   @   sÄ  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZ d dlm Z  d d	l!m"Z" d d
l#m$Z$m%Z% d dl&m'Z' d dl(mZ d dl)m*Z* d dl+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 d dl3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; d dl<m=Z=m>Z>m?Z? d dl@mAZA G dd„ de0jBƒZCdd„ ZDdd„ ZEeFdkràeEƒ  dS dS )é    N)Úlogger©ÚUniCredential)Ú	UniTarget)Útabulate)Útqdm)ÚACCESS_ALLOWED_ACEÚACCESS_ALLOWED_OBJECT_ACEÚACE_OBJECT_PRESENCEÚADS_ACCESS_MASKÚAceFlagsÚACEType)ÚACL)ÚGUID)ÚSE_SACLÚSECURITY_DESCRIPTOR)ÚSID)ÚLDAPConnectionFactory)ÚMSLDAPConsolePlugin)ÚPathCompleter)Úaiocmd)ÚLeftAligned)ÚMSADGPO_ATTRSÚMSADOU_ATTRSÚMSADContainer_ATTRSÚMSADDomainTrust_ATTRSÚMSADGroup_ATTRSÚMSADInfo_ATTRSÚMSADMachine_ATTRSÚMSADUser_TSV_ATTRS)ÚEX_RIGHT_CERTIFICATE_ENROLLMENTÚCertificateNameFlagÚMSADCertificateTemplate)ÚSDFlagsRequestc                   @   s  e Zd Zdºdd„Zdºdd„Zdd„ Zdd	„ Zd
d„ Zd»dd„Zd»dd„Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ Zdd„ Zdd„ Zd¼d d!„Zd¼d"d#„Zd½d%d&„Zd¾d)d*„Zd+d,„ Zd¿d.d/„ZdÀd1d2„Zd»d3d4„Zd5d6„ Zd7d8„ Zd9d:„ Zd;d<„ Zd=d>„ Zd?d@„ ZdAdB„ ZdCdD„ Z d»dEdF„Z!dGdH„ Z"dºdIdJ„Z#dºdKdL„Z$dMdN„ Z%dOdP„ Z&dÁdRdS„Z'dTdU„ Z(dVdW„ Z)dXdY„ Z*dZd[„ Z+d\d]„ Z,d^d_„ Z-d`da„ Z.dºdbdc„Z/ddde„ Z0dfdg„ Z1dhdi„ Z2djdk„ Z3dldm„ Z4dndo„ Z5dpdq„ Z6drds„ Z7d»dtdu„Z8d»dvdw„Z9d»dxdy„Z:d»dzd{„Z;dºd|d}„Z<d~d„ Z=dÂd€d�„Z>d»d‚dƒ„Z?dºd„d…„Z@dÃd†d‡„ZAdˆd‰„ ZBdŠd‹„ ZCdŒd�„ ZDdŽd�„ ZEdÃd�d‘„ZFd’d“„ ZGd”d•„ ZHd–d—„ ZId˜d™„ ZJdšd›„ ZK	 d½dœd�„ZLdºdždŸ„ZMd d¡„ ZNdºd¢d£„ZOd¤d¥„ ZPd¦eQd§eQfd¨d©„ZRd¦eQdªeSfd«d¬„ZTd­eQd®eQfd¯d°„ZUd±eQd²eQfd³d´„ZVdµeWfd¶d·„ZXd¸d¹„ ZYdS )ÄÚMSLDAPClientConsoleNc                 C   sŠ   t jj| dd� || _|d urt|tƒdu rt |¡| _d | _d | _d | _	d | _
d | _d| _d| _d| _d| _d| _i | _i | _d | _d S )NF)Úignore_sigint)r   ÚPromptToolkitCmdÚ__init__Úconn_urlÚ
isinstancer   Úfrom_urlÚ
connectionÚadinfoÚldapinfoÚdomain_nameÚ
domain_sidÚnoisigÚnocbÚ_disable_channel_bindingÚ_disable_signingÚ_null_channel_bindingÚ"_MSLDAPClientConsole__current_dirsÚ$_MSLDAPClientConsole__loaded_pluginsÚ_current_dn)ÚselfÚurl© r:   ú�/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/msldap/examples/msldapclient.pyr'   3   s"   
zMSLDAPClientConsole.__init__c                 Ã   s2  �z�| j du r|du rtdƒ |dur t|tƒdu r t |¡| _ t | j  ¡ ¡ t | j  ¡ ¡ | j  	¡ | _
d| j
_| j| j
_| j| j
_| j| j
_| j
 ¡ I dH \}}|durY|‚t d¡ | j
j| _| j
j| _d| j
jf | _| j
j| _| j
jjdu rˆ|  | j¡I dH  W dS tdƒ W dS    t ¡  Y dS )zPerforms connection and loginNzNo URL was set, cant do logonFTzBIND OK!ú[%s]> ú9Anonymous connection. Most functionalities will not work!)r(   Úprintr)   r   r*   r   ÚdebugÚget_credentialÚ
get_targetÚ
get_clientr+   Ú	keepaliver2   r3   r4   ÚconnectÚ	domainsidr/   Ú
domainnamer.   Ú_treeÚpromptr7   Ú_conÚis_anonÚdo_cdÚ	tracebackÚ	print_exc)r8   r9   Ú_Úerrr:   r:   r;   Údo_loginG   s:   €






þzMSLDAPClientConsole.do_loginc                 Ã   ó   �d| _ dS )zDisables signingT)r3   ©r8   r:   r:   r;   Údo_nosigi   ó   €zMSLDAPClientConsole.do_nosigc                 Ã   rQ   )zDisables channel bindingT)r2   rR   r:   r:   r;   Údo_nocbn   rT   zMSLDAPClientConsole.do_nocbc                 Ã   rQ   )z#Sets incorrect channel binding dataT)r4   rR   r:   r:   r;   Ú	do_nullcbs   rT   zMSLDAPClientConsole.do_nullcbTc                 Ã   s�   �z<| j du r| j ¡ | _ |du r;| j D ]&}t| j | tƒr/| j | D ]
}td||f ƒ q#qtd|| j | f ƒ qW dS    t ¡  Y dS )z*Prints detailed LDAP connection info (DSA)NTú%s : %sF)r-   r+   Úget_server_infor)   Úlistr>   rL   rM   )r8   ÚshowÚkÚitemr:   r:   r;   Údo_ldapinfox   s   €

ÿzMSLDAPClientConsole.do_ldapinfoc                 Ã   sp   �z,| j du r"| jj| _ | j j dd¡ dd¡ dd¡| _| j j| _|du r+t| j ƒ W dS    t	 
¡  Y dS )	z%Prints detailed Active Driectory infoNÚDCÚ ú=ú,Ú.TF)r,   r+   Ú	_ldapinfoÚdistinguishedNameÚreplacer.   Ú	objectSidr/   r>   rL   rM   )r8   rZ   r:   r:   r;   Ú	do_adinfo‰   s   €

"

zMSLDAPClientConsole.do_adinfoc                 Ã   ób   �z%|   d¡I dH  | j ¡ 2 z3 dH W \}}|dur|‚t|jƒ q6 W dS    t ¡  Y dS )z$Fetches kerberoastable user accountsFNT)r]   r+   Úget_all_service_usersr>   ÚsAMAccountNamerL   rM   ©r8   ÚuserrO   r:   r:   r;   Údo_spns—   s   €ýzMSLDAPClientConsole.do_spnsc                 Ã   rh   )z%Fetches ASREP-roastable user accountsFNT)r]   r+   Úget_all_knoreq_usersr>   rj   rL   rM   rk   r:   r:   r;   Údo_asrep¥   s   €ýzMSLDAPClientConsole.do_asrepc                 Ã   s’   �z=|   d¡I dH  | jjddgd�2 z'3 dH W \}}|dur!|‚|j}|du r4d|jdd… | jf }tt|ƒƒ q6 W dS    t 	¡  Y dS )	zFetches all computer accountsFNrj   ÚdNSHostName)Úattrsz%s.%séÿÿÿÿT)
rg   r+   Úget_all_machinesrp   rj   r.   r>   ÚstrrL   rM   )r8   ÚmachinerO   Údnsr:   r:   r;   Údo_computeraddr²   s   €"ø	z#MSLDAPClientConsole.do_computeraddrc                 Ã   s4  �dt j  ¡  d¡ }�zƒ|  d¡I dH  |  d¡I dH  dt j  ¡  d¡ }d| }zst|ddd	d
��/}| d t¡d ¡ | j	 
¡ I dH \}}|durO|‚| d | t¡¡d ¡ W d  ƒ n1 sfw   Y  td| ƒ tj|dtjd��}|j||d� W d  ƒ n1 sŒw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w dt j  ¡  d¡ }d| }z‡td| d�}i }	t|ddd	d
��_}| j	 ddg¡2 z3 dH W \}
}|durã|‚| ¡  t|
jƒ|	|
j ¡ < qÕ6 t |	|¡ td| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sw   Y  W d  ƒ n	1 �s/w   Y  W zt |¡ W n   Y nzt |¡ W w    Y w dt j  ¡  d¡ }d| }z‹td| d�}t|ddd	d
��:}| d t¡d ¡ | j	 ¡ 2 z!3 dH W \}
}|du�rŒ|‚| ¡  | d |
 t¡¡d ¡ �q}6 W d  ƒ n	1 �s«w   Y  td| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sÖw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w dt j  ¡  d¡ }d| }z‹td| d�}t|ddd	d
��:}| d t¡d ¡ | j	 ¡ 2 z!3 dH W \}
}|du�r3|‚| ¡  | d |
 t¡¡d ¡ �q$6 W d  ƒ n	1 �sRw   Y  td| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �s}w   Y  W zt |¡ W n   Y nzt |¡ W w    Y w dt j  ¡  d¡ }d| }z‹td| d�}t|ddd	d
��:}| d t ¡d ¡ | j	 !¡ 2 z!3 dH W \}
}|du�rÚ|‚| ¡  | d |
 t ¡¡d ¡ �qË6 W d  ƒ n	1 �sùw   Y  td | ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �s$w   Y  W zt |¡ W n   Y nzt |¡ W w    Y w d!t j  ¡  d¡ }d| }z‹td"| d�}t|ddd	d
��:}| d t"¡d ¡ | j	 #¡ 2 z!3 dH W \}
}|du�r�|‚| ¡  | d |
 t"¡¡d ¡ �qr6 W d  ƒ n	1 �s w   Y  td#| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sËw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w d$t j  ¡  d¡ }d| }z‹td%| d�}t|ddd	d
��:}| d t$¡d ¡ | j	 %¡ 2 z!3 dH W \}
}|du�r(|‚| ¡  | d |
 t$¡¡d ¡ �q6 W d  ƒ n	1 �sGw   Y  td&| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �srw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w d't j  ¡  d¡ }d| }z‹td(| d�}t|ddd	d
��:}| d t&¡d ¡ | j	 '¡ 2 z!3 dH W \}
}|du�rÏ|‚| ¡  | d |
 t&¡¡d ¡ �qÀ6 W d  ƒ n	1 �sîw   Y  td)| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w d*t j  ¡  d¡ }d| }z‹td+| d�}t|ddd	d
��:}| d t$¡d ¡ | j	 (¡ 2 z!3 dH W \}
}|du�rv|‚| ¡  | d |
 t)¡¡d ¡ �qg6 W d  ƒ n	1 �s•w   Y  td,| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sÀw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w z™d-t j  ¡  d¡ }td.| d�}t|ddd	d
��>}| j	 *¡ 2 z/3 dH W \}}}}|du�r|‚| +¡ }d |||j,j| -¡ g¡}| |d ¡ | d/¡ �q 6 W d  ƒ n	1 �s<w   Y  td0| ƒ | ¡  tj|dtjd��}|j||d� W d  ƒ n	1 �sgw   Y  W zt |¡ W n   Y nzt |¡ W w    Y w td1| ƒ W d2S    t. /¡  Y dS )3zNFetches ALL user and machine accounts from the domain with a LOT of attributeszdump_%s.zipú%Y%m%d-%H%M%SFNz	domain_%sz%s.tsvÚwr_   Úutf8©ÚnewlineÚencodingú	ú
zAdinfo was written to %sÚa)Úcompression)Úarcnamez	schema_%sz%s.jsonzWriting schema to file %s©ÚdescÚnameÚschemaidguidzSchema dump was written to %sz	trusts_%szWriting trusts to file %szTrust dump was written to %szusers_%szWriting users to file %szUsers dump was written to %szcomputers_%szWriting computers to file %szComputer dump was written to %sz	groups_%szWriting groups to file %szGroup dump was written to %szous_%szWriting OUs to file %szOU dump was written to %szcontainers_%szWriting Containers to file %sz Container dump was written to %szgpos_%szWriting GPOs to file %szGPO dump was written to %sú
dns_%s.tsvúWriting DNS records to file %sé   zDNS dump was written to %szAll dumps were written to %sT)0ÚdatetimeÚnowÚstrftimerg   r]   ÚopenÚwriteÚjoinr   r+   Úget_ad_infoÚget_rowr>   ÚzipfileÚZipFileÚ	ZIP_BZIP2ÚosÚremover   Úget_all_schemaentryÚupdatert   ÚschemaIDGUIDr…   ÚlowerÚjsonÚdumpÚcloser   Úget_all_trustsr   Úget_all_usersr   rs   r   Úget_all_groupsr   Úget_all_ousr   Úget_all_containersÚget_all_gposr   Ú
dnsentriesÚget_formattedÚTypeÚto_linerL   rM   )r8   Úzip_filenameÚtnameÚusers_filenameÚfr,   rO   ÚdzÚpbarÚschemarl   Údns_filenameÚzonednr…   ÚdnsrecodÚ
dnsdataobjÚliner:   r:   r;   Údo_dumpÆ   s,  €ûÿ€ý üÿ€õ€ý
üþÿ€ý
üþÿ€ý
üþÿ€ý
üþÿ€ý
üþÿ€ý
üþÿ€ý
üþÿ€ý
úÿÿ€ýzMSLDAPClientConsole.do_dumpc                 C   sB   | j d u rg S g }| j D ]}| d¡dkrd| }| |¡ q|S )Nú rr   z'%s')r5   ÚfindÚappend)r8   ÚcurdirsÚdirnamer:   r:   r;   Úget_current_dirs³  s   

z$MSLDAPClientConsole.get_current_dirsc                 C   s   t | jd�S )N)rº   )r   rº   rR   r:   r:   r;   Ú_cd_completions½  s   z#MSLDAPClientConsole._cd_completionsc              
   Ã   s  �| j }zb|dkr|| _ n|dkr|| d¡d d… | _ n|| _ || jv r,| j| | _ | jj| j dd�I dH }t| ¡ ƒd }i | _||  ¡ D ]}|dt| j ƒd  … }|| j|< qId| j f | _W d	S  t	y‰ } zt
d
| ƒ || _ d| j f | _W Y d}~dS d}~ww )zChange current work directoryrb   z..ra   r‰   N©Úlevelr   r<   TzChange directory error! %sF)r7   r¶   r5   r+   Úget_tree_plotrY   ÚkeysÚlenrH   Ú	Exceptionr>   )r8   ÚpathÚoriginal_pathÚ	tree_dataÚrootÚdnÚ	lookup_dnÚer:   r:   r;   rK   À  s2   €
€üzMSLDAPClientConsole.do_cdÚNOc                 Ã   s>   �d|| j f }|  ||¡I dH }|du r|  d¡I dH  |S )z$Remove an object from the current DNz%s,%sNTrb   )r7   Ú	do_deleterK   )r8   ÚsubdnÚconfirmrÆ   Úresr:   r:   r;   Údo_rmÜ  s   €zMSLDAPClientConsole.do_rmc                 Ã   s¾   �zS|   d¡I dH  |  d¡I dH  | jjjdu r tdƒ W dS td| ƒ | ¡ dkr=tdƒ td| ƒ td	ƒ W dS | j |¡I dH \}}|durN|‚td
ƒ W dS    t 	¡  Y dS )z%Remove an object identified by its DNFNTr=   z)This will delete the following object: %sÚYESzkAs a safety measure, you have to confirm the deletion by typing YES in all caps after the DN to be deleted!zExample: "delete %s YES"zNot confirmed! Aborting!z
Delete OK!)
r]   rg   r+   rI   rJ   r>   ÚupperÚdeleterL   rM   )r8   rÆ   rÌ   rN   rO   r:   r:   r;   rÊ   ä  s*   €zMSLDAPClientConsole.do_deleteFc                 Ã   s0   �| j D ]}|}|dur| j | }t|ƒ qdS )z'Print objects in current work directoryFT)r5   r>   )r8   ÚfullpathrÆ   Úentryr:   r:   r;   Údo_lsü  s   €


zMSLDAPClientConsole.do_lsÚ*r_   c                 Ã   sÀ   �|  d¡}|dkr| j}| jjd| ||d�2 zD3 dH W \}}|dur&|‚|d D ]1}t|d | ƒtkrMt|d | ƒD ]\}}td|||f ƒ q>q*|d | }td||f ƒ q*q6 d	S )
zHPrint attributes of object. Without arguments it will cat the current DNra   r_   ú(distinguishedName=%s))ÚqueryÚ
attributesÚtreeNrØ   z%s [%s]: %sú%s: %sT)Úsplitr7   r+   ÚpagedsearchÚtyperY   Ú	enumerater>   )r8   rØ   rÆ   rÓ   rO   ÚattrÚiÚvalr:   r:   r;   Údo_cat  s"   €
&ÿúý
zMSLDAPClientConsole.do_catc                 Ã   s@   �|d|fgi}| j  ||¡I dH \}}|dur|‚tdƒ dS )zAModify an attribute of object. Only works with string data types!re   Nú
Modify OK!T)r+   Úmodifyr>   )r8   rÆ   Ú	attributeÚvalueÚchangesrN   rO   r:   r:   r;   Ú	do_modify  s   €
ÿzMSLDAPClientConsole.do_modifyú-c                 Ã   sœ  �zÂ|   d¡I dH  |du rd}| d¡r| d¡}t d| ¡ t d| ¡ | j ||¡2 z�3 dH W \}}|dur=|‚td|d  ƒ td	ƒ |d
  ¡ D ]k\}}t	|t
ƒr†td| ƒ |D ]$}t	|tƒrptd| ¡  ƒ q`t	|tƒr~td| ¡  ƒ q`td| ƒ q`qOt	|tƒr¢td|| ¡ f ƒ td|| ¡  ¡ f ƒ qOt	|tƒr²td|| ¡ f ƒ qOtd||f ƒ qOtdƒ q/6 W dS    t ¡  Y dS )zvPerforms a raw LDAP query against the server. Secondary parameter is the requested attributes SEPARATED WITH COMMA (,)FNrÕ   ra   z	Query: %szAttributes: %szDN: %sÚ
objectNamezAttributes:rØ   z  %s:z    - %sz  %s: %sz---T)r]   r¶   rÛ   Úloggingr?   r+   rÜ   r>   Úitemsr)   rY   r   Úto_sddlÚbytesÚhexÚto_bytesrL   rM   )r8   r×   rØ   rÓ   rO   Ú	attr_nameÚ
attr_valuerá   r:   r:   r;   Údo_query#  sH   €




ú


ézMSLDAPClientConsole.do_queryr‰   c                 Ã   sÂ   �zU|   d¡I dH  |du rd}t|ƒ}|dur*zt|ƒ W n   Y nt|ƒ}d}|du r:|   d¡I dH  | jj}t d| ¡ | j ||¡I dH }tƒ }t||ƒƒ W dS    t	 
¡  Y dS )zYPrints a tree from the given DN (if not set, the top) and with a given depth (default: 1)FNr‰   z
Tree on %sT)r]   Úintr+   rG   rë   r?   r¾   r   r>   rL   rM   )r8   rÆ   r½   rÄ   Útrr:   r:   r;   Údo_treeJ  s0   €zMSLDAPClientConsole.do_treec                 Ã   s†   �z7|   d¡I dH  |  d¡I dH  | j |¡I dH \}}|dur#|‚|du r6|du r2tdƒ |W S t|ƒ |W S    t ¡  Y dS )z>Feteches a user object based on the sAMAccountName of the userFNTzUser not found!)r]   rg   r+   Úget_userr>   rL   rM   )r8   ÚsamaccountnameÚto_printrl   rO   r:   r:   r;   Údo_userg  s    €þzMSLDAPClientConsole.do_userc                 Ã   s’   �z=|   d¡I dH  |  d¡I dH  | j |¡I dH \}}|dur#|‚|du r.tdƒ W dS t|ƒ t |j¡}t|ƒ W dS    t 	¡  Y dS )zDFeteches a machine object based on the sAMAccountName of the machineFNzmachine not found!T)
r]   rg   r+   Úget_machiner>   r   Ú
from_bytesÚ#allowedtoactonbehalfofotheridentityrL   rM   )r8   rø   ru   rO   Úxr:   r:   r;   Ú
do_machine{  s"   €ûzMSLDAPClientConsole.do_machinec                 Ã   sl   �z*|   d¡I dH  |  d¡I dH  | j |¡I dH \}}|dur#|‚tt|ƒƒ W dS    t ¡  Y dS )zYFeteches a schema object entry object based on the DN of the object (must start with CN=)FNT)r]   rg   r+   Úget_schemaentryr>   rt   rL   rM   )r8   ÚcnÚschemaentryrO   r:   r:   r;   Údo_schemaentry�  s   €z"MSLDAPClientConsole.do_schemaentryc                 Ã   st   �z.|   d¡I dH  |  d¡I dH  | j ¡ 2 z3 dH W \}}|dur%|‚tt|ƒƒ q6 W dS    t ¡  Y dS )z(Feteches all schema object entry objectsFNT)r]   rg   r+   r—   r>   rt   rL   rM   )r8   r  rO   r:   r:   r;   Údo_allschemaentryŸ  s   €üz%MSLDAPClientConsole.do_allschemaentryc                 Ã   ó0   �| j  |¡I dH \}}|dur|‚t|ƒ dS )z7Fetches the DN of an object based on the sAMAccountNameNT)r+   Úsam2dnr>   )r8   rj   rÆ   rO   r:   r:   r;   Ú	do_sam2dn®  ó   €zMSLDAPClientConsole.do_sam2dnc                 Ã   r  )z2Fetches the DN of an object based on the objectSidNT)r+   Úsid2dnr>   )r8   ÚsidrÆ   rO   r:   r:   r;   Ú	do_sid2dn¶  r  zMSLDAPClientConsole.do_sid2dnc                 Ã   r  )z2Fetches the objectSid of an object based on the DNNT)r+   Údn2sidr>   )r8   rÆ   r
  rO   r:   r:   r;   Ú	do_dn2sid¾  r  zMSLDAPClientConsole.do_dn2sidc                 Ã   r  )z7Fetches the sAMAccountName of an object based on the DNNT)r+   Údn2samr>   )r8   rÆ   ÚsamrO   r:   r:   r;   Ú	do_dn2samÆ  r  zMSLDAPClientConsole.do_dn2samc                 Ã   s¢   �zE|   d¡I dH  |  d¡I dH  | j | jjd ¡I dH \}}|dur'|‚| jj|dd�2 z3 dH W \}}|dur=|‚t|jƒ q/6 W dS    t	 
¡  Y dS )z4Lists all members of the domain administrators groupFNú-512T©Ú	recursive)r]   rg   r+   r	  r,   rf   Úget_group_membersr>   rd   rL   rM   )r8   rÆ   rO   Úobjr:   r:   r;   Údo_dadmsÎ  s    € ýzMSLDAPClientConsole.do_dadmsc              
   Ã   s†   �z*|dus
|dkrd}| j j||d�2 z3 dH W \}}|dur"|‚t|jƒ q6 W dS  tyB } zt ¡  W Y d}~dS d}~ww )z3Returns all member users in a group specified by DNFÚ0Tr  N)r+   r  r>   rd   rÁ   rL   rM   )r8   rÆ   r  r  rO   rÈ   r:   r:   r;   Údo_groupmembersá  s   € ý€þz#MSLDAPClientConsole.do_groupmembersc                 Ã   sÜ  �zâ|   d¡I dH  |  d¡I dH  zt |¡}W n   tdƒ dtdƒf Y W S d| }| j |ddg¡2 zI3 dH W \}}|durE|‚d|d vrvtd	ƒ tƒ }t	j
t	jB |_t d
¡|_d|_d|_tƒ |_d|j_d|j_d|j_n	t |d d ¡} n6 tdƒ dtdƒfW S |jjD ]}|j|kr¥tdƒ dtdƒf  W S q‘tdƒ tƒ }d|_d|_||_t |¡}	|	jj |¡ dd|	 ¡ fgi}
| j ||
¡I dH \}}|durÝ|‚tdƒ W dS    t  !¡  Y dS )zQAdds a SID to the msDS-AllowedToActOnBehalfOfOtherIdentity protperty of target_dnFNzIncorrect SID!zIncorrect SIDrÖ   z(msDS-AllowedToActOnBehalfOfOtherIdentityrf   rØ   z>Attribute does not exist on the current object, crafing new SDúS-1-5-32-544é   r   zTarget DN not found!zAccount is already there!zConstructing new ACEiÿ re   ú
Change OK!)"r]   rg   r   Úfrom_stringr>   rÁ   r+   rÜ   r   r   ÚSE_DACL_PRESENTÚSE_SELF_RELATIVEÚControlÚOwnerÚGroupÚSaclr   ÚDaclÚAclRevisionÚSbz1ÚSbz2rü   ÚacesÚSidr   r   ÚMaskÚcopyÚdeepcopyr·   rð   rä   rL   rM   )r8   Ú	target_dnÚother_identity_sidÚcomputer_sidr×   rÓ   rO   Ú	target_sdÚaceÚnew_sdrç   rN   r:   r:   r;   Ú)do_addallowedtoactonbehalfofotheridentityï  sb   €"
í
þ
ÿz=MSLDAPClientConsole.do_addallowedtoactonbehalfofotheridentityc                 Ã   sf   �z'|   d¡I dH  |  d¡I dH  | jj|||d�I dH \}}|dur&|‚W dS    t ¡  Y dS )zåChanges the owner in a Security Descriptor to the new_owner_sid on an LDAP object or on an LDAP object's attribute identified by target_dn and target_attribute. target_attribute can be omitted to change the target_dn's SD's ownerFN)Útarget_attribute)r]   rg   r+   Úchange_priv_ownerrL   rM   )r8   Únew_owner_sidr,  r3  rN   rO   r:   r:   r;   Údo_changeowner0  s   €ÿz"MSLDAPClientConsole.do_changeownerc                 Ã   sn   �z+|   d¡I dH  |  d¡I dH  | j || jj¡I dH \}}|dur&|‚tdƒ W dS    t ¡  Y dS )zzAdds DCSync rights to the given user by modifying the forest's Security Descriptor to add GetChanges and GetChangesAll ACEFNr  T)	r]   rg   r+   Úadd_priv_dcsyncr,   rd   r>   rL   rM   )r8   Úuser_dnÚforestrN   rO   r:   r:   r;   Údo_addprivdcsync=  s   €z$MSLDAPClientConsole.do_addprivdcsyncc                 Ã   sj   �z)|   d¡I dH  |  d¡I dH  | j ||¡I dH \}}|dur$|‚tdƒ W dS    t ¡  Y dS )zDAdds AddMember rights to the user on the group specified by group_dnFNr  T)r]   rg   r+   Úadd_priv_addmemberr>   rL   rM   ©r8   r8  Úgroup_dnrN   rO   r:   r:   r;   Údo_addprivaddmemberM  s   €z'MSLDAPClientConsole.do_addprivaddmemberc                 Ã   s¦   �zC|   d¡I dH  |  d¡I dH  zt |¡}W n   tdƒ dtdƒf Y W S | j || ¡ ¡I dH \}}|dur>|‚tdƒ W dS    tdƒ t	 
¡  Y dS )z,Updates the security descriptor of an objectFNzIncorrect SDDL input!r  Tz(Erro while updating security descriptor!)r]   rg   r   Ú	from_sddlr>   rÁ   r+   Úset_objectacl_by_dnrð   rL   rM   )r8   r,  Úsddlr1  rN   rO   r:   r:   r;   Údo_setsd]  s$   €zMSLDAPClientConsole.do_setsdrµ   c                 Ã   s  �zø|   d¡I dH  |  d¡I dH  | j |¡I dH \}}|dur#|‚t |¡}| j |j ¡ ¡I dH \}}}t	d||f ƒ | j |j
 ¡ ¡I dH \}}}t	d||f ƒ g }|jjD ]n}	t |	j ¡ ¡rot |	j ¡ ¡}
n| j |	j ¡ ¡I dH \}}}|dkr‰d||f }
n|	j ¡ }
|d dkr³g }t|	ƒ d	¡D ]}| | d
¡d ¡ q�| |
g| ¡ q\|d dkrÊt|	ƒ d	¡D ]	}| |
|g¡ qÀq\|d dkrÞt	t|g d¢d�ƒ W dS |d dkrñt	t|ddgd�ƒ W dS t	| ¡ ƒ W dS    t ¡  Y dS )ú%Feteches security info for a given DNFNzOWNER: %s\%szGROUP: %s\%sz???ú%s\%sr   ÚgÚ
ú:rr   Úp)
ÚWhor¦   ÚFlagsr   r)  Ú
ObjectTypeÚInheritedObjectTypeÚObjectFlagsÚACTyper_   )ÚheadersrI  ÚACET)r]   rg   r+   Úget_objectacl_by_dnr   rü   Ú
resolv_sidr   rí   r>   r!  r#  r'  r   Úwellknown_sid_lookupr(  rt   rÛ   r·   r   rL   rM   )r8   rÆ   ÚoptsÚsec_inforO   ÚsdÚdomainÚusernameÚoutr0  Ú	canonicalÚrowr³   r:   r:   r;   Údo_getsds  sP   €

€üÿzMSLDAPClientConsole.do_getsdc                 Ã   sp   �z,|   d¡I dH  |  d¡I dH  | j ¡ 2 z3 dH W \}}|dur%|‚t|ƒ q6 W dS    t ¡  Y dS )rC  FNT)r]   rg   r+   r£   r>   rL   rM   )r8   ÚgporO   r:   r:   r;   Údo_gpos�  s   €
ýzMSLDAPClientConsole.do_gposc                 Ã   s–  �z¿| j  ¡ 2 z&3 dH W \}}|dur|‚d|d v r-|d d }td|d d |f ƒ q6 | j  ¡ 2 zˆ3 dH W \}}|durB|‚d|d v rZ|d d }td|d d |f ƒ d|d v rt|d d }td|d d | ¡ f ƒ d|d v rŒ|d d }td|d d |f ƒ d	|d v r¤|d d	 }td|d d |f ƒ d
|d v r¼|d d
 }td|d d |f ƒ q46 W dS    t ¡  Y dS )zFeteches all laps passwordsNzms-Mcs-AdmPwdrØ   rW   r  zmsLAPS-PasswordzmsLAPS-EncryptedPasswordzmsLAPS-EncryptedPasswordHistoryzmsLAPS-EncryptedDSRMPasswordz#msLAPS-EncryptedDSRMPasswordHistoryTF)r+   Úget_all_lapsr>   Úget_all_laps_windowsrï   rL   rM   )r8   rÓ   rO   Úpwdr:   r:   r;   Údo_laps¬  sD   €€û€ézMSLDAPClientConsole.do_lapsc              
   Ã   sØ   �zS|   d¡I dH  |  d¡I dH  g }| j |¡2 z,3 dH W \}}|dur(|‚| |¡ | j |¡I dH \}}|dur>|‚td||f ƒ q6 t|ƒdkrRtdƒ W dS  tyk } zt	 
¡  W Y d}~dS d}~ww )zDFeteches names all groupnames the user is a member of for a given DNFNz%s - %sr   zNo memberships foundT)r]   rg   r+   Úget_tokengroupsr·   Úget_dn_for_objectsidr>   rÀ   rÁ   rL   rM   )r8   rÆ   Ú
group_sidsÚ	group_sidrO   r=  rÈ   r:   r:   r;   Údo_groupmembershipÖ  s,   €
ù	€þz&MSLDAPClientConsole.do_groupmembershipc                 Ã   s   �|| j _dS )zQChanges the LDAP TREE for future queries. MUST be DN format eg. 'DC=test,DC=corp'N)r+   rG   )r8   Únewtreer:   r:   r;   Údo_bindtreeí  s   €zMSLDAPClientConsole.do_bindtreec                 Ã   sT   �z| j  ¡ 2 z3 dH W \}}|dur|‚t| ¡ ƒ q6 W dS    t ¡  Y dS )z!Feteches gives back domain trustsNTF)r+   rž   r>   Úget_linerL   rM   ©r8   rÓ   rO   r:   r:   r;   Ú	do_trustsñ  s   €ýzMSLDAPClientConsole.do_trustsc                 Ã   óJ   �z| j  ||¡I dH \}}|dur|‚tdƒ W dS    t ¡  Y dS )z'Creates a new domain user with passwordNz
User addedTF)r+   Úcreate_user_dnr>   rL   rM   )r8   r8  ÚpasswordrN   rO   r:   r:   r;   Ú
do_adduserþ  ó   €zMSLDAPClientConsole.do_adduserc                 Ã   óH   �z| j  |¡I dH \}}|dur|‚tdƒ W dS    t ¡  Y dS )ztDeletes the user! This action is irrecoverable (actually domain admins can do that but probably will shout with you)NzGoodbye, Caroline.TF)r+   Údelete_userr>   rL   rM   ©r8   r8  rN   rO   r:   r:   r;   Ú
do_deluser  ó   €zMSLDAPClientConsole.do_deluserc                 Ã   sL   �z| j  |||¡I dH \}}|dur|‚tdƒ W dS    t ¡  Y dS )zNChanges user password, if you are admin then old pw doesnt need to be suppliedNzUser password changedTF)r+   Úchange_passwordr>   rL   rM   )r8   r8  ÚnewpassÚoldpassrN   rO   r:   r:   r;   Údo_changeuserpw  s   €z#MSLDAPClientConsole.do_changeuserpwc                 Ã   rr  )z'Unlock user by setting lockoutTime to 0NzUser unlockedTF)r+   Úunlock_userr>   rL   rM   rt  r:   r:   r;   Údo_unlockuser#  rv  z!MSLDAPClientConsole.do_unlockuserc                 Ã   rr  )ú/Unlock user by flipping useraccountcontrol bitsNzUser enabledTF)r+   Úenable_userr>   rL   rM   rt  r:   r:   r;   Údo_enableuser/  rv  z!MSLDAPClientConsole.do_enableuserc                 Ã   rr  )r}  NzUser disabledTF)r+   Údisable_userr>   rL   rM   rt  r:   r:   r;   Údo_disableuser;  rv  z"MSLDAPClientConsole.do_disableuserc                 Ã   rm  )z&Adds an SPN entry to the users accountNz
SPN added!TF)r+   Úadd_user_spnr>   rL   rM   ©r8   r8  ÚspnrN   rO   r:   r:   r;   Ú	do_addspnG  rq  zMSLDAPClientConsole.do_addspnc                 Ã   rm  )z)Removes an SPN entry to the users accountNzSPN removed!TF)r+   Údel_user_spnr>   rL   rM   rƒ  r:   r:   r;   Ú	do_delspnS  rq  zMSLDAPClientConsole.do_delspnc                 Ã   rm  )z,Adds additional hostname to computer accountNzHostname added!TF)r+   Úadd_additional_hostnamer>   rL   rM   )r8   r8  ÚhostnamerN   rO   r:   r:   r;   Údo_addhostname_  rq  z"MSLDAPClientConsole.do_addhostnamec                 Ã   rm  )zGAdds user to specified group. Both user and group must be in DN format!NzUser added to group!TF)r+   Úadd_user_to_groupr>   rL   rM   r<  r:   r:   r;   Údo_addusertogroupk  rq  z%MSLDAPClientConsole.do_addusertogroupc                 Ã   rm  )zLRemoves user from specified group. Both user and group must be in DN format!NzUser removed from group!TF)r+   Údel_user_from_groupr>   rL   rM   r<  r:   r:   r;   Údo_deluserfromgroupw  rq  z'MSLDAPClientConsole.do_deluserfromgroupc                 Ã   óf   �z'g }| j  ¡ 2 z3 dH W \}}|dur|‚| |¡ |du r$t|ƒ q	6 |W S    t ¡  Y dS )zLists Root CA certificatesNTF)r+   Úlist_root_casr·   r>   rL   rM   ©r8   rù   ÚcasÚcarO   r:   r:   r;   Ú
do_rootcasƒ  ó   €
€ûzMSLDAPClientConsole.do_rootcasc                 Ã   r�  )zLists NT CA certificatesNTF)r+   Ú
list_ntcasr·   r>   rL   rM   r‘  r:   r:   r;   Údo_ntcas’  r•  zMSLDAPClientConsole.do_ntcasc                 Ã   r�  ©zLists AIA CA certificatesNTF)r+   Úlist_aiacasr·   r>   rL   rM   r‘  r:   r:   r;   Ú	do_aiacas¡  r•  zMSLDAPClientConsole.do_aiacasc                 Ã   r�  r˜  )r+   Úlist_enrollment_servicesr·   r>   rL   rM   )r8   rù   ÚservicesÚsrvrO   r:   r:   r;   Údo_enrollmentservices°  r•  z)MSLDAPClientConsole.do_enrollmentservicesc                 Ã   sÎ   �z[d}| j  |¡2 z3 dH W \}}|dur|‚ n6 |du r#tdƒ‚t t|¡}|dur2t|ƒ}n
tt|jƒtj	B ƒ}dd|fgi}| j  
|j|¡I dH \}}|durV|‚tdƒ W dS    t ¡  Y dS )z¿Modifyies the msPKI-Certificate-Name-Flag value of the specified certificate template and enables ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME bit. If 'flags' is present then it will assign that value.NúTemplate could not be found!zmsPKI-Certificate-Name-Flagre   rã   TF)r+   Úlist_certificate_templatesrÁ   ÚtypingÚcastr"   rô   r!   ÚCertificate_Name_FlagÚ"ENROLLEE_SUPPLIES_SUBJECT_ALT_NAMErä   rd   r>   rL   rM   )r8   ÚcerttemplatenameÚflagsÚtemplaterO   rç   rN   r:   r:   r;   Ú!do_addcerttemplatenameflagaltname¿  s0   €ý

ÿz5MSLDAPClientConsole.do_addcerttemplatenameflagaltnamec           	      Ã   s$  �z†| j  |¡I dH \}}|dur|‚d}| j  |¡2 z3 dH W \}}|dur)|‚ n6 |du r4tdƒ‚t t|¡}t |j	¡}t
ƒ }t |¡|_t t¡|_tdƒ|_tjtjB tjB |_tj|_|jj |¡ | j j|j| ¡ t j!d�I dH \}}|dur�|‚t"dƒ W dS    t# $¡  Y dS )zRGrants enrollment rights to a user (by DN) for the specified certificate template.NrŸ  r   ©r¦  úSD set sucessfullyTF)%r+   Úget_objectsid_for_dnr   rÁ   r¡  r¢  r"   r*  r+  ÚnTSecurityDescriptorr	   r   r  r(  r   r    rK  r   r   Ú	READ_PROPÚ
WRITE_PROPÚCONTROL_ACCESSr)  r
   ÚACE_OBJECT_TYPE_PRESENTrJ  r#  r'  r·   r@  rd   rð   r#   ÚDACL_SECURITY_INFORMATIONr>   rL   rM   )	r8   r¥  r8  Úuser_sidrO   r§  r1  r0  rN   r:   r:   r;   Údo_addenrollmentrightá  s<   €ý
$z)MSLDAPClientConsole.do_addenrollmentrightc           	      Ã   sä   �zf| j dd�I dH }g }| j |¡2 zP3 dH W \}}|dur!|‚d}|jdur:| j |j¡I dH \}}|dur:|‚||_|D ]}|j|jv rS|j 	d|j
|jf ¡ q?| 	|¡ |du rct| ¡ ƒ q6 |W S    t ¡  Y dS )zLists certificate templatesF©rù   NrD  T)rž  r+   r   r¬  Ú	resolv_sdÚsid_lookup_tabler…   ÚcertificateTemplatesÚenroll_servicesr·   rp   r>   ÚprettyprintrL   rM   )	r8   r…   rù   rœ  Ú	templatesr§  rO   Últr�  r:   r:   r;   Údo_certtemplates  s4   €
€
€ðz$MSLDAPClientConsole.do_certtemplatesc                 Ã   s^   �z#| j  |¡I dH \}}}|dur|‚d||f }|du r"t|ƒ |W S    t ¡  Y dS )z'Returns the domain and username for SIDNrD  TF)r+   rR  r>   rL   rM   )r8   r
  rù   rW  rX  rO   rÍ   r:   r:   r;   Údo_sidresolv  s   €z MSLDAPClientConsole.do_sidresolvc              
   Ã   s¶  �zÏ| j dd�I dH }|du rtd| ƒ‚|du rtdƒ‚| jdd�I dH }|du r0td| ƒ‚|du r8tdƒ‚g }d}|durR| j |¡I dH \}}|durQ|‚n| j ¡ I dH \}}|durb|‚|d }|D ]e}| |¡}t|ƒd	krvqh|j}d
}	t|ƒd	kr†dg}d}	|D ]D\}
}d|j	 }|d| 7 }|d|
 7 }|d|	 7 }|d7 }|D ]}|d|||  
dd¡f 7 }q©t|ƒ |	|j	||
|dœ}| |¡ qˆqh|W S    t ¡  Y dS )z ADCA security test - new versionFr´  Nú%Listing enrollment Services error! %sú)No Enrollment Services present, stopping!úListing templates error! %súNo templates exists!Útokengroupsr   T©NNzTemplate Name: %s
zEnrollment Service Name: %s
zEnrollment Service Host: %s
zEnabled: %s
zVulnerabilities:
z		%s - %s
ÚReasonr_   )Úenabledr§  Úservicer‰  Úvulns)rž  rÁ   r¼  r+   Úget_tokengroups_userÚ
whoamifullÚis_vulnerable2rÀ   Úenrollment_servicesr…   Úgetr>   r·   rL   rM   )r8   rX  Úesrº  ÚresultsrÂ  rO   rÍ   r§  Ú
is_enabledr‰  rÆ  ÚtÚrrÓ   r:   r:   r;   Údo_certify2,  sj   €ÿ

ûïzMSLDAPClientConsole.do_certify2c                 Ã   s,  �zŠ| j dd�I dH }|du rtd| ƒ‚|du rtdƒ‚| jdd�I dH }|du r0td| ƒ‚|du r8tdƒ‚|D ]}t|ƒ q:|dur€| ¡  d¡d	u r}d}|dure| j |¡I dH \}}|dure|‚|D ]}| |¡\}	}
|	d	u r|t|
ƒ t|ƒ qgW d	S |D ]}t|ƒ q‚W d	S    t	 
¡  Y dS )
zADCA security testFr´  Nr¾  r¿  rÀ  rÁ  ÚvulnT)rž  rÁ   r¼  r>   rš   Ú
startswithr+   rÈ  Úis_vulnerablerL   rM   )r8   ÚcmdrX  rÍ  rº  Ú
enrollmentrÂ  rO   r§  ÚisvulnÚreasonr:   r:   r;   Ú
do_certifyk  sD   €
€ý
zMSLDAPClientConsole.do_certifyc                 Ã   sF   �z| j  ¡ I dH \}}|dur|‚t|ƒ W dS    t ¡  Y dS )zSimple whoamiNF)r+   Úwhoamir>   rL   rM   )r8   rÍ   rO   r:   r:   r;   Údo_whoamiraw”  ó   €z MSLDAPClientConsole.do_whoamirawc              	   Ã   s®   �zK| j  ¡ I dH \}}|dur|‚|D ]5}t|| tƒdu r*td||| f ƒ qt|| tƒdu rI|| D ]}td|d || | ¡f ƒ q7qW dS    t ¡  Y dS )zFull whoamiNTrÚ   zGroup: %s (%s)ú\)FN)	r+   rÉ  r)   rt   r>   Údictr�   rL   rM   )r8   rÍ   rO   rþ   r[   r:   r:   r;   Ú	do_whoamiŸ  s    € €zMSLDAPClientConsole.do_whoamic           	      Ã   s  �z�t dƒ | j ¡ 2 zs3 dH W \}}}}|dur|‚t d| ƒ g }|dur]|jjD ]&}|jtjkrQz| j|j	dd�I dH }| 
|¡ W q+   | 
|j	¡ Y q+q+|D ]}t d| ƒ qT|durvt d|jdd…  ¡  ƒ t d	|j ƒ nt d
ƒ t dƒ q6 W dS    t ¡  Y dS )zcLists all managed service accounts (MSA). If user has permissions it retrieves the password as wellz----------------------------------------------NzUsername: %sFr´  zAllowed machine: %súPassword: %séþÿÿÿzPassword -NT-: %szPassword: <EMPTY>)r>   r+   Ú	list_gmsar#  r'  ÚAceTyper   ÚACCESS_ALLOWED_ACE_TYPEr½  r(  r·   ÚCurrentPasswordrï   Únt_hashrL   rM   )	r8   rø   ÚmembershipsÚpwblobrO   Úallowed_machinesrÓ   rl   Úmnamer:   r:   r;   Údo_gmsa±  s8   €û
ìzMSLDAPClientConsole.do_gmsac           	      Ã   sD  �z–ddl }i }i }| j ¡ 2 z03 dH W \}}|dur|‚| ¡ ||j< z|jdur1| ¡ ||j< W q   tt| ¡ ƒƒ Y q6 tddƒ�}| 	||¡ W d  ƒ n1 sWw   Y  tdddd��*}| 
d¡ d}|D ]}|d	||| f 7 }qm| 
|¡ | 
d
¡ W d  ƒ W dS 1 s�w   Y  W dS    t ¡  Y dS )z2Generates schema data. This will take a long time.r   Nzadschema.jsonry   zadschema.pyr_   )r|   zLDAP_WELL_KNOWN_ATTRS = {
z	"%s" : %s,
Ú}F)r›   r+   r—   Úto_dictÚlDAPDisplayNameÚisSingleValuedÚget_typer>   r�   rœ   rŽ   rL   rM   )	r8   r›   rØ   Útestattrrå   rO   r«   r³   Úattrnamer:   r:   r;   Údo_genschemaÏ  s<   €
€ø	ÿ

&úz MSLDAPClientConsole.do_genschemac                 Ã   sf   �z'| j  ||¡I dH \}}}|dur|‚t|ƒ td|j ƒ td| ƒ W dS    t ¡  Y dS )zAdds a new computer accountNzsAMAccountName: %srá  F)r+   Úadd_computerr>   rj   rL   rM   )r8   Úcomputernamero  ÚcomputerrO   r:   r:   r;   Údo_addcomputerë  s   €z"MSLDAPClientConsole.do_addcomputerc                 Ã   sF   �z| j  ||¡I dH }|dur|‚tdƒ W dS    t ¡  Y dS )z(Changes the sAMAccountName of a given DNNÚOKF)r+   Úchange_samaccountnamer>   rL   rM   )r8   rÆ   ÚnewnamerO   r:   r:   r;   Údo_changesamaccountnameø  rÝ  z+MSLDAPClientConsole.do_changesamaccountnamec                 Ã   sŠ   �z9t dƒ | j ¡ 2 z3 dH W \}}|dur|‚t |ƒ q6 | j ¡ 2 z3 dH W \}}|dur2|‚t |ƒ q$6 W dS    t ¡  Y dS )z*Lists all unconstrained delegation objectsz*Objects with Unconstrained Delegation set:NF)r>   r+   Úget_unconstrained_machinesÚget_unconstrained_usersrL   rM   rk  r:   r:   r;   Údo_unconstrained  s    €
ý
ýz$MSLDAPClientConsole.do_unconstrainedc                 Ã   s~   �z3t dƒ | j ¡ 2 z%3 dH W \}}|dur|‚| dd¡}| dg ¡D ]
}t d||f ƒ q%q6 W dS    t ¡  Y dS )z(Lists all constrained delegation objectsz(Objects with Constrained Delegation set:Nrj   r_   zmsDS-AllowedToDelegateToz%s -> %sF)r>   r+   Úget_all_constrainedrÌ  rL   rM   )r8   rÓ   rO   Úsnamerþ   r:   r:   r;   Údo_constrained  s   €ÿüz"MSLDAPClientConsole.do_constrainedc                 Ã   sX   �z t dƒ | j ¡ 2 z3 dH W \}}|dur|‚t |ƒ q6 W dS    t ¡  Y dS )zLists all S4U2Proxy objectszS4U2Proxy set:NF)r>   r+   Úget_all_s4u2proxyrL   rM   rk  r:   r:   r;   Údo_s4u2proxy%  s   €
ýz MSLDAPClientConsole.do_s4u2proxyc                 Ã   s`   �z$| j  ¡ 2 z3 dH W \}}|dur|‚|jd dkr!t|jƒ q6 W dS    t ¡  Y dS )ztesting, dontuseNrr   rl   TF)r+   Úget_all_objectaclÚobjectClassr>   rL   rM   rk  r:   r:   r;   Údo_test2  s   €
€ûzMSLDAPClientConsole.do_testc                 Ã   sv   �z/| j  ¡ 2 z%3 dH W \}}}|dur|‚t|ƒ |du rq|D ]}td|ƒ q!tƒ  q6 W dS    t ¡  Y dS )zLists all DNS zonesNFrµ   T)r+   Údnslistzonesr>   rL   rM   )r8   Úto_print_propsrÓ   ÚpropsrO   Úpropr:   r:   r;   Údo_dnszonesI  s    €ôzMSLDAPClientConsole.do_dnszonesc              
   Ã   s  �zi|dkrd }dt j  ¡  d¡ }td| d�}t|dddd��?}| j |¡2 z-3 d H W \}}}}|d ur8|‚| ¡ }	d	 |||j	j
|	 ¡ g¡}
| |
d
 ¡ | d¡ q(6 W d   ƒ W dS 1 scw   Y  W dS  ty� } zt ¡  W Y d }~dS d }~ww )Nr_   r‡   rx   rˆ   rƒ   ry   rz   r{   r~   r   r‰   TF)rŠ   r‹   rŒ   r   r�   r+   r¤   r¥   r�   r¦   r…   r§   rŽ   r˜   rÁ   rL   rM   )r8   Úzoner¯   r­   r«   r°   r…   r±   rO   r²   r³   rÈ   r:   r:   r;   Ú
do_dnsdump_  s0   € ø
ÿõ€þzMSLDAPClientConsole.do_dnsdumpc                 Ã   s\   �z"d}| j j|dgd�2 z3 dH W \}}|dur|‚t|ƒ q6 W dS    t ¡  Y dS )zNLists potentially abusable machine accounts created with pre windows-2000 flagz*(&(userAccountControl=4128)(logonCount=0))rj   )rØ   NTF)r+   rÜ   r>   rL   rM   )r8   r×   rÓ   rO   r:   r:   r;   Ú
do_pre2000v  s   €"
üzMSLDAPClientConsole.do_pre2000c                 Ã   sà   �zd|| j vr/tj dt| j ƒ |¡}tj |¡}|tjdt| j ƒ < |j 	|¡ || j |< n| j | }t
|ƒD ]&}t||ƒ}t|tƒr^t|tƒr^|tur^|| | jƒ}| |¡I dH   W S q8tdƒ W dS    t ¡  Y dS )zLoads a plugin and runs itzplugin_module_%sNzoNo plugin class found in that module! Please make sure you have a class that inherits from MSLDAPConsolePlugin!F)r6   Ú	importlibÚutilÚspec_from_file_locationrÀ   Úmodule_from_specÚsysÚmodulesÚloaderÚexec_moduleÚdirÚgetattrr)   rÝ   Ú
issubclassr   r+   Úrunr>   rL   rM   )r8   Ú
pluginpathÚrunargsÚspecÚplugin_moduler\   r  Úplugin_instancer:   r:   r;   Ú	do_plugin„  s(   €


€zMSLDAPClientConsole.do_pluginc                 Ã   sP   �z| j  ¡ 2 z3 dH W \}}|dur|‚t|ƒ q6 W dS    t ¡  Y dS )z3Lists all delegated managed service accounts (DMSA)NTF)r+   Úget_all_dmsasr>   rL   rM   rk  r:   r:   r;   Údo_dmsasœ  s   €
ýzMSLDAPClientConsole.do_dmsasrÆ   Úmanagedaccountprecededbylinkc                 Ã   óX   �z dd|fgi}| j  ||¡I dH \}}|dur|‚tdƒ W dS    t ¡  Y dS )z1Adds a managed account preceded by link to a DMSAz!msDS-ManagedAccountPrecededByLinkre   Nrù  F©r+   rä   r>   rL   rM   )r8   rÆ   r$  rç   rN   rO   r:   r:   r;   Ú&do_dmsaaddmanagedaccountprecededbylink¨  s   €
ÿz:MSLDAPClientConsole.do_dmsaaddmanagedaccountprecededbylinkÚdelegatedmsastatec                 Ã   r%  )z&Sets the delegated MSA state of a DMSAzmsDS-DelegatedMSAStatere   Nrù  Fr&  )r8   rÆ   r(  rç   rN   rO   r:   r:   r;   Údo_dmsasetdelegatedmsastate¶  s   €
ÿz/MSLDAPClientConsole.do_dmsasetdelegatedmsastater8  Úcomputersidc                 Ã   sJ   �z| j  ||¡I dH \}}|dur|‚tdƒ W dS    t ¡  Y dS )zsThis will create a dmsa service user that can be used for neferious reasons, but DO NOT USE THIS FOR ANYTHING ELSE!Nrù  F)r+   Úcreate_broken_dmsa_userr>   rL   rM   )r8   r8  r*  rN   rO   r:   r:   r;   Údo_create_broken_dmsa_userÅ  s   €z.MSLDAPClientConsole.do_create_broken_dmsa_userÚtargetdnÚuserdnc           
      Ã   sð   �zl| j  |d¡I dH \}}|dur|‚| j  |¡I dH \}}|dur%|‚t |¡}t|d d ƒ}t |¡}tƒ }t	 
|¡|_tdƒ|_tj|_|jj |¡ | j j|| ¡ tjd�I dH \}	}|durg|‚tdƒ W dS    t ¡  Y dS )z+Adds a generic write ACE to a target objectNrØ   rf   r‰   r©  rª  F)r+   Úget_obj_by_dnrQ  r   rü   rt   r*  r+  r   r   r  r(  r   r   ÚGENERIC_WRITEr)  r#  r'  r·   r@  rð   r#   r±  r>   rL   rM   )
r8   r-  r.  Ú	userentryrO   Útargetsdr²  r1  r0  rN   r:   r:   r;   Údo_add_genericwriteÐ  s.   €


"z'MSLDAPClientConsole.do_add_genericwriterV  c                 ƒ   sÌ  �dt f‡ fdd„}|jdu rdS g }||jƒdu r:ˆ j |j¡I dH \}}|du r:| g dg |j|jdœgdœ¡ |jjD ]¥}g }g }g }	|jt	j
t	jfv rntjtjtjtjtjtjtjfD ]}
|
t|jƒv rm| |
¡ q_t|ƒd	kruq>|jt	jkr‘t |jƒd
v rŠ| t |jƒ¡ t|ƒd	kr‘q>|t |jƒƒdu r›q>|	 t |jƒ¡ t|	ƒd	krªq>g }|	D ]"}ˆ j |¡I dH \}}|durÀq®|du rÅq®|j}| ||dœ¡ q®| |d dd„ |D ƒ¡||dœ¡ q>|S )z.Checks if the SD has the badsuccessor flag setr
  c                    sJ   t | ƒ} | dv r
dS |  ˆ j¡du rdS dD ]}|  |¡du r" dS qdS )N)r  zS-1-5-18TF)r  z-519)rt   rÔ  r/   Úendswith)r
  ÚsuffixrR   r:   r;   Úis_excluded_sidî  s   ÿzBMSLDAPClientConsole.check_badsuccessor_sd.<locals>.is_excluded_sidNFÚOWNER)r…   r
  )ÚrightsÚ
rights_strÚotypesÚusersr   )z$00000000-0000-0000-0000-000000000000z$0feb936f-47b3-49f2-9386-1dedc2c23765Tú|c                 S   s   g | ]}|j ‘qS r:   )r…   )Ú.0Úrightr:   r:   r;   Ú
<listcomp>7  s    z=MSLDAPClientConsole.check_badsuccessor_sd.<locals>.<listcomp>)rt   r#  r   r+   Úget_user_by_sidr·   rj   r'  rä  r   rå  ÚACCESS_ALLOWED_OBJECT_ACE_TYPEr   ÚGENERIC_ALLr0  ÚWRITE_OWNERÚ
WRITE_DACLÚCREATE_CHILDr®  r¯  r)  rÀ   rK  r(  r�   )r8   rV  r6  rÎ  rl   rO   r0  r8  r:  ÚsidsÚmaskr;  r
  Ú	user_namer:   rR   r;   Úcheck_badsuccessor_sdë  sr   €
þÿü$
€
þ
üz)MSLDAPClientConsole.check_badsuccessor_sdc           	      Ã   s^  �z£g }| j  ¡ 2 z$3 dH W \}}|dur|‚|du rq	|jdu r"q	d|jv r-| |j¡ q	6 t|ƒdkr=tdƒ tdƒ | j  ¡ 2 z^3 dH W \}}|durP|‚|du rUqB| j  |j	¡I dH \}}|durfqBt
 |¡}|du rpqB|jdu rvqB|  |¡I dH }|D ]}|d D ]}t|j	› d|d › d	|d
 › d|d › �ƒ q†q€qB6 W dS    t ¡  Y dS )z=Checks if Badsuccessor vulnerability is present on the domainNÚ2025r   z2[-] No domain controllers with Windows 2025 found!z[*] Checking OUs regardless...r;  z, r…   z (r
  z) r9  F)r+   Úget_all_domain_controllersÚoperatingSystemr·   rj   rÀ   r>   r¡   rQ  rd   r   rü   r#  rI  rL   rM   )	r8   Údc_listr÷  rO   rÓ   rV  rÎ  Úresultrl   r:   r:   r;   Údo_badsuccessor_check=  sP   €

€ø


.ÿÿòz)MSLDAPClientConsole.do_badsuccessor_check)N)T)rÉ   )F)rÕ   r_   )ré   )Nr‰   )rµ   )NTrÃ  )ZÚ__name__Ú
__module__Ú__qualname__r'   rP   rS   rU   rV   r]   rg   rm   ro   rw   r´   rº   r»   rK   rÎ   rÊ   rÔ   râ   rè   ró   rö   rú   rÿ   r  r  r  r  r  r  r  r  r2  r6  r:  r>  rB  r\  r^  rb  rg  ri  rl  rp  ru  rz  r|  r  r�  r…  r‡  rŠ  rŒ  rŽ  r”  r—  rš  rž  r¨  r³  r¼  r½  rÒ  rÚ  rÜ  rà  rì  rô  rø  rü  rÿ  r  r  r  r  r  r  r!  r#  rt   r'  rô   r)  r,  r3  r   rI  rO  r:   r:   r:   r;   r$   2   s®    

"

 n




	

'


A

**





"
!


?)



Rr$   c                 Ã   sê  �dd l }| jd urt| jƒ}nŠ| ¡ dkrtdƒ‚ddlm} ddlm} ddl	m
}m} | | j¡}|ƒ }| jd urV| j}	| j d¡d urO| j d¡\}	}
||	|
d�}n;|d	 d ur�t|d	 ƒdkr�||d	 |d	 |d	 |d
 d�}| jdu rŒ||d	 |d	 |jd|d	 |d
 d�}ntdƒ‚t||ƒ}t|ƒ}t| jƒdkrÄ| jdu r¬tdƒ d S | dg ¡I d H }|du r»d S | ¡ I d H  d S | jD ]+}|dkr×| ¡ I d H   d S t |¡}| |d |dd … ¡I d H }|du rò d S qÇd S )Nr   ÚWindowsz,This function only works on Windows systems!r   )Úget_logon_info)ÚMSLDAPTargetÚUniProtorG  )ÚipÚportÚlogonserverÚdnsdomainname)rW  r‰  Údc_iprW  Ti|  )rW  r‰  ÚprotocolrX  r[  rW  z8Couldnt find logonserver! Are you connected to a domain?zNot starting interactive!ÚloginFrà   r‰   )Úplatformr9   r$   ÚsystemrÁ   Úasyauth.common.credentialsr   Úwinacl.functions.highlevelrT  Úmsldap.commons.targetrU  rV  Úget_sspiÚauthtypeÚtargetr¶   rÛ   rÀ   ÚldapsÚCLIENT_SSL_TCPr   ÚcommandsÚno_interactiver>   Ú_run_single_commandr  Úshlex)Úargsr^  Úclientr   rT  rU  rV  ÚcredÚuserinforW  rX  re  ÚfactoryrÍ   ÚcommandrÖ  r:   r:   r;   Úamaind  sl   €

ü
ú€




ÿúrr  c            	      C   sR  dd l } dd l}d}d}t ||d¡}|t ¡ 7 }|d7 }| jd|d�}|jdd	d
ddd� |jdddd� | ¡ dkrg|jdd�}|jddd� |jdd�}|jdddd� |jddd� |jdddd� n|jd dd� |jd!d"d#d$� | 	¡ }|j
dkr‡tjtjd%� nt tj¡ t tj¡ t tj¡ tjtjd%� t t|ƒ¡ d S )&Nr   zgLDAP : basic LDAP protocol
	LDAPS: LDAP over SSL
	GC   : Global Catalog
	GCS  : Global Catalog over SSLa¦  ntlm     : SASL NTLM authentication
	kerberos : SASL Kerberos authentication
	sspi-ntlm: SSPI authentication using NTLM (Windows only, uses SASL)
	sspi-kerberos: SSPI authentication using Kerberos (Windows only, uses SASL)
	simple   : LDAP SIMPLE authentication
	plain    : PLAIN authentication
	sicily   : SICILY authentication
	ssl      : Authenticate with SSL certificate
	none     : No authentication, anonymous bind
	r_   aó  
Examples:
All of the following examples show LDAP auth to the DC of TEST.corp domain at Win2019AD.test.corp(10.10.10.2)
Kerberos authentication needs the FQDN of the DC, so we use the 'dc' parameter to specify the DC.

Anonymous BIND:
	ldap://10.10.10.2
Username and password authentication using NTLM over plaintext LDAP:
	ldap+ntlm-password://TEST\victim:password@10.10.10.2
Username and password authentication using NTLM over SSL/TLS:
	ldaps+ntlm-password://TEST\victim:password@10.10.10.2
Username and password authentication using Kerberos over plaintext LDAP:
	ldap+kerberos-password://TEST\victim:password@<hostname>/?dc=10.10.10.2
Username and password authentication using Kerberos over SSL/TLS:
	ldaps+kerberos-password://TEST\victim:password@<hostname>/?dc=10.10.10.2
NTLM authentication using the NT hash over plaintext LDAP:
	ldap+ntlm-nt://TEST\victim:<NThash>@10.10.10.2
Kerberos authentication using the RC4 key over plaintext LDAP:
	ldap+kerberos-rc4://TEST\victim:<RC4key>@<hostname>/?dc=10.10.10.2
SICILY authentication using the NT hash over plaintext LDAP:
	ldap+sicily-nt://TEST\victim:<NThash>@10.10.10.2
Kerberos authentication using AES key over plaintext LDAP:
	ldap+kerberos-aes://TEST\victim:<AESkey>@<hostname>/?dc=10.10.10.2
Kerberos authentication using CCACHE file over plaintext LDAP:
	ldap+kerberos-ccache://TEST\victim:<CCACHEfile>@<hostname>/?dc=10.10.10.2
Kerberos authentication using keytab file over plaintext LDAP:
	ldap+kerberos-keytab://TEST\victim:<KEYTABfile>@<hostname>/?dc=10.10.10.2
Kerberos authentication using P12 or PFX file over plaintext LDAP (notice that keyfile password is at the 'password' filed):
	ldap+kerberos-pfx://TEST\victim:admin@<hostname>/?dc=10.10.10.2&keydata=<P12file>
SSL authentication using P12 or PFX file over plaintext LDAP, automatically performs STARTTLS:
	ldap+ssl://10.10.10.2/?sslcert=<P12file>&sslpassword=<P12password>'
SSL authentication using P12 or PFX file over SSL/TLS LDAP:
	ldaps+ssl://10.10.10.2/?sslcert=<P12file>&sslpassword=<P12password>'
zMS LDAP library)ÚdescriptionÚusagez-vz	--verboseÚcountzVerbosity, can be stacked)ÚactionÚdefaultÚhelpz-nz--no-interactiveÚ
store_true)rv  rS  ÚURL)Útitlez--urlz Connection string in URL format.)rx  zWithout URLz
--authtypeÚntlm)rw  rx  z--targetzAddress of LDAP server.z--ldapsz	Use LDAPS)rv  rx  r9   rh  rÕ   z¤Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.)Únargsrx  r¼   )Úargparser^  r   Úget_helpr   ÚArgumentParserÚadd_argumentr_  Úadd_argument_groupÚ
parse_argsÚverboserë   ÚbasicConfigÚINFOÚsocksloggerÚsetLevelÚDEBUGr   Ú
authloggerÚasyncior  rr  )	r~  r^  Ú	protocolsÚ
authprotosrt  ÚparserÚgroupÚgroup2rl  r:   r:   r;   Úmain   s6   
"
r‘  Ú__main__)Gr‹  r*  rŠ   Úimportlib.utilr  r›   rë   r•   rk  r  rL   r¡  r’   Úasyauthr   rŠ  r`  r   Úasysocksr‡  Úasysocks.unicomm.common.targetr   r   r   Úwinacl.dtyp.acer   r	   r
   r   r   r   Úwinacl.dtyp.aclr   Úwinacl.dtyp.guidr   Úwinacl.dtyp.security_descriptorr   r   Úwinacl.dtyp.sidr   ÚmsldapÚmsldap.commons.factoryr   Úmsldap.commons.pluginr   Ú msldap.examples.utils.completersr   Úmsldap.external.aiocmd.aiocmdr   Ú#msldap.external.asciitree.asciitreer   Úmsldap.ldap_objectsr   r   r   r   r   r   r   r   Ú)msldap.ldap_objects.adcertificatetemplater    r!   r"   Ú#msldap.wintypes.asn1.sdflagsrequestr#   r&   r$   rr  r‘  rP  r:   r:   r:   r;   Ú<module>   sh    (              @<U
ÿ