o j$ @sddlmZddlmZddlmZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z dd lmZmZdd lmZmZGd d d Zed kr?ee jejdddZejddddejdddddejddddejddddejdddded Zejd!dd"d#dejd$dd%dejd&dd'dejd(dd)d*ded+Zejd,dd-d.dejd/dd0d1deejd2kree d2e!Z"e #e"j$e"j%ee"j&e"j'e"j(e"j)e"j*\Z+Z,Z-Z.Z.e"_*e+d3kre/d4e d2zee,e-e+e"Z0e01WdSe2y>Z3ze4j5ej6kr,ddl7Z7e78e9e:e3WYdZ3[3dSdZ3[3wwdS)5)division)print_function)unicode_literalsN)datetime)version)UF_ACCOUNTDISABLE)logger)parse_identity ldap_login)ldapldapasn1c@s0eZdZddZeddZddZddZd S) GetADUserscCs||_||_||_||_d|_d|_d|_|j|_|j |_ |j |_ |j |_|j|_|j|_|jdur<|jd\|_|_|jd}d|_|D] }|jd|7_qG|jdd|_gd|_gd|_dd d t|jD|_dS) N:.zdc=%s,)NameEmailPasswordLastSet LastLogon)r cSsg|] \}}d||fqS)z {%d:%ds} ).0numwidthrr/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/GetADUsers.py Hsz'GetADUsers.__init__..)options_GetADUsers__username_GetADUsers__password_GetADUsers__domain_GetADUsers__target_GetADUsers__lmhash_GetADUsers__nthashaesKey_GetADUsers__aesKeyk_GetADUsers__doKerberosdc_ip_GetADUsers__kdcIPdc_host_GetADUsers__kdcHostuser_GetADUsers__requestUserall_GetADUsers__allhashessplitbaseDN_GetADUsers__header_GetADUsers__colLenjoin enumerate_GetADUsers__outputFormat)selfusernamepassworddomaincmdLineOptions domainPartsirrr__init__*s.     zGetADUsers.__init__cCs|d8}|d}|S)Nl}*{G ir)trrr getUnixTimeJszGetADUsers.getUnixTimec Cst|tjdur dSd}d}d}d}z|dD]}t|ddkr=|ddd d d ur<|ddd }qt|dd kret|ddd krRd}qtt| t t|dd}qt|ddkrt|ddd krzd}qtt| t t|dd}qt|ddkrt|dd}qt |j j ||||gWdSty}ztjdddtdt|WYd}~dSd}~ww)NTrzN/A attributestypesAMAccountNamevalsrzutf-8$F pwdLastSet0z lastLogonmail Exception)exc_infoz-Skipping item, cannot process due to error %s) isinstancer SearchResultEntrystrasOctetsdecodeendswithr fromtimestamprDintprintr:formatrNloggingdebugerror)r;itemrGrJrMrL attributeerrr processRecordPs<  &&zGetADUsers.processRecordc Cst|j|j|j|j|j|j|j|j|j |j |j }|j |_t d|jt|jj|jtddd|jD|jrAd}ndt}|jdurR|d|j7}n|d7}zt d |tjd d }|j|gd d |g|jdWn tjy|w|dS)Nz)Querying %s for information about domain.z cSsg|]}d|qS)-r)ritemLenrrrrxsz"GetADUsers.run..z)(&(sAMAccountName=*)(objectCategory=user)zN(&(sAMAccountName=*)(mail=*)(!(UserAccountControl:1.2.840.113556.1.4.803:=%d))z(sAMAccountName:=%s)))zSearch Filter=%sd)size)rGrJrMrLr) searchFilterrE sizeLimitsearchControlsperRecordCallback)r r$r5r,r.r*r!r"r#r%r&r(_dstHostrZinforXr:rYr6r8r7r2rr0r[r SimplePagedResultsControlsearchr`LDAPSearchErrorclose)r;ldapConnectionrfscrrrrunps,2     zGetADUsers.runN)__name__ __module__ __qualname__rB staticmethodrDr`rrrrrrr )s   r __main__Tz$Queries target domain for users data)add_help descriptiontargetstorezdomain[/username[:password]])actionhelpz-userr<z Requests data for specific user )r|metavarr}z-all store_truezReturn all users, including those with no email addresses and disabled accounts. When used with -user it will return user's info even if the account is disabledz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzr<r=_criticalexecuterrrrNr_ getLoggerlevelDEBUG traceback print_excr\rRrrrrsb        h    (