o j@sddlZddlZddlZddlZddlZddlZddlmZddlm Z ddl m Z ddl Z ddl mZddlmZddlmZmZmZmZmZddlmZdd lmZddlZGd d d ejZdS) N)RESULT_UNWILLING_TO_PERFORMescape_filter_chars)PY2)LOG)security_descriptor_control)ACCESS_ALLOWED_OBJECT_ACE ACCESS_MASKACCESS_ALLOWED_ACEACEOBJECTTYPE_GUID_MAP) ldaptypes)shadow_credentialsc@seZdZdZddZddZddZdd Zd d Zd d Z ddZ ddZ ddZ ddZ ddZddZddZddZddZd d!Zd"d#Zd$d%Zd&d'Zd(d)Zd*d+Zd,d-Zd.d/Zd0d1Zd2d3Zd4d5Zd6d7Zd8d9Zd:d;Z dd?Z"d@dAZ#dBdCZ$dDS)E LdapShellz1.2.840.113556.1.4.1941cCstjj||j|jdtrtttd|jt_|jt_|jt_ d|_ ||_ d|_ d|_ d|_d|_d|_g|_||_||_dS)N)stdinstdoututf8Fz # zType help for list of commandsT)cmdCmd__init__rrrreloadsyssetdefaultencodingstderr use_rawinputshellprompttidintrologgedIn last_output completionclient domain_dumper)self tcp_shellr#r"r&/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/impacket/examples/ldap_shell.pyr&s"  zLdapShell.__init__cCsdSNr&)r$r&r&r' emptyline=szLdapShell.emptylinec Cs`d}z tj||}W|Sty/}zt|t|tjdddWYd}~|Sd}~ww)NFzException infoT)exc_info)rronecmd Exceptionprintrerrordebug)r$sret_valer&r&r'r+@s zLdapShell.onecmdcCs|t}d|d<d|d<d|d<t|d<|ddd |d <d |d <t}d |d <d|d<d|d<g|_||d<|S)NRevisionSbz1iControlOwnerSidz S-1-5-32-544GroupSidSacl AclRevisionrSbz2Dacl)r SR_SECURITY_DESCRIPTORLDAP_SID fromCanonicalACLaces)r$sdaclr&r&r'create_empty_sdKs zLdapShell.create_empty_sdcCsbt}tjj|d<d|d<t}t|d<d|dd<t|d<|d|||d<|S)NAceTyperAceFlagsMaskiSidAce)r r r ACE_TYPEr rArB)r$sidnaceacedatar&r&r'create_allow_ace]s    zLdapShell.create_allow_acec Csnt|}td|d|dft|dkrtd|d}|d}|jj|jjd|dgdt|jj dkr=td |jj d}t d d }|jj|jjd |dd g|dt|jj dkrdtd|jj d}|d j d}t j |d} |t|d} | dd| | } |jj|jd tj| gfi|d|jjddkrtddStdt|jjd)NzAdding %s to GPO with GUID %srz*A samaccountname and GPO sid are required.z*(&(objectclass=person)(sAMAccountName=%s)) objectSid attributeszDidnt find the given userr<sdflagsz.(&(objectclass=groupPolicyContainer)(name=%s))nTSecurityDescriptorrVcontrolszDidnt find the given gpodatar?Datar[resultz&z,LdapShell.do_add_computer..z,DC=.zDC=)flagszInferred Domain DN: %szInferred Domain Name: %szCN=%s,CN=Computers,%szNew Computer DN: %sz HOST/%s.%szInvalid third argument: %szHOST/%szRestrictedKrbHost/%szRestrictedKrbHost/%s.%sz%s.%si"{}" utf-16-le) dnsHostNameuserAccountControlservicePrincipalNamesAMAccountName unicodePwd)toppersonorganizationalPersonrtcomputerr`z>Failed to add a new computer. The server denied the operation.z Failed to add a new computer: %szAAdding new computer with username: %s and password: %s result: OK)rbrcr"serverssl tls_startedr-rdr,endswithjoinranger#rfresubfindIrirqformatencodeaddr`r) r$rprq computer_namepassword domain_dndomaincomputer_hostname computer_dnspnsucdresr&r&r'do_add_computersn $  *                  zLdapShell.do_add_computercCs(t|}t|dkrtd|d}|d}|jj|jjdt|ddgd|jj dj }|s7td ||jj d}|d j }t d |t d ||j |dtj|gfi|jjd dkrit ddS|jjd dkrztd|jjd|jjd dkrtd|jjdtd|jjd)NrSziCurrent Computer sAMAccountName and New Computer sAMAccountName required (rename_computer comp1$ comp2$).rrR(sAMAccountName=%s)rTrrUzComputer not found in LDAP: %ssamAccountNamezOriginal sAMAccountName: %szNew sAMAccountName: %sr`z#Updated sAMAccountName successfully2CCould not modify object, the server reports insufficient rights: %smessageGCould not modify object, the server reports a constrained violation: %s The server returned an error: %s)rbrcrdr,r"rer#rfrrgrmvaluer-rlrnror`)r$rprq current_namenew_namerentryrr&r&r'do_rename_computers*  "      zLdapShell.do_rename_computerc Cs&t|}|jjjs|jjstdt|dkrtd|d}t|dkr-d|j j }n|d}d ddt d D}d ||f}d |j j ||||||d d |d |dd }td||j|gd|}|s|jjdtkr}|jjjs}tdtdt|jjdtd||fdS)Nz1Error adding a new user with LDAP requires LDAPS.rzA username is required.rRz CN=Users,%sr|csr~r(rrr&r&r'rrz(LdapShell.do_add_user..rzCN=%s,%sz'CN=Person,CN=Schema,CN=Configuration,%si0rr) objectCategorydistinguishedNamecnsn givenName displayNamenameraccountExpiresrrz Attempting to create user in: %s)rrrrtr`zFailed to add a new user. The server denied the operation. Try relaying to LDAP with TLS enabled (ldaps) or escalating an existing user.zFailed to add a new user: %sraz=Adding new user with username: %s and password: %s result: OK)rbrcr"rrrr-rdr,r#rfrrrrrr`rri) r$rprqnew_user parent_dn new_password new_user_dnrrr&r&r' do_add_users<      zLdapShell.do_add_usercCst|\}}||}|std|||}|s!td||dddd}|dddd}|j|dtj|gfgi}|rQtd||fdStd|t |jj d f) NUser not found in LDAP: %sGroup not found in LDAP: %s,rrzmemberz&Adding user: %s to group %s result: OKz"Failed to add user to %s group: %sra) rbrcget_dnr,r"rlrn MODIFY_ADDr-rir`)r$rp user_name group_nameuser_dngroup_dnrr&r&r'do_add_user_to_group"s    zLdapShell.do_add_user_to_groupcCst|}t|dkrt|dkrtdt|||d}td|d}t|dkr;dddtd D}n|d}td ||jj j ||}|jj d dkr\td dS|jj d d krmtd|jj d|jj d dkr~td|jj dtd|jj d)NrRrSz_Error expected a username and an optional password argument. Instead %d arguments were providedrz Got User DN: r|csr~r(rrr&r&r'rArz/LdapShell.do_change_password..rz%Attempting to set new password of: %sr`zPassword changed successfully!rrrrrr) rbrcrdr,rr-rrr"extend microsoftmodify_passwordr`)r$rprqrrsuccessr&r&r'do_change_password6s$     zLdapShell.do_change_passwordcCs|jj|jjdt|ddgd}|dust|jjdkr&tdt|jj|jjd}|d j}t d |j t d || }|j |j dt j|ggi|jjd dkr`t d dS|jjd dkrqtd|jjd|jjd dkrtd|jjdtd|jjd)NrrT(msDS-AllowedToActOnBehalfOfOtherIdentityrUFrR4Error expected only one search result got %d resultsr objectsidFound Target DN: %sTarget SID: %s r`z'Delegation rights cleared successfully!rrrrrr)r"rer#rfrrdrgr,rr-rmrGrlrnrorkr`)r$rrtarget target_sidrEr&r&r' do_clear_rbcdRs "     zLdapShell.do_clear_rbcdcCs(td|j|jtddS)NzDumping domain info...z Domain info dumped into lootdir!)r-rflushr# domainDumpr$rpr&r&r'do_dumpjs   zLdapShell.do_dumpcCsD|jjs|jjjstd|jstdtddStddS)NzSending StartTLS command...zStartTLS failedz+StartTLS succeded, you are now using LDAPS!z9It seems you are already connected through a TLS channel.)r"rrrr- start_tlsr,rr&r&r' do_start_tlsps    zLdapShell.do_start_tlscC||ddS)NFtoggle_account_enable_disabler$usernamer&r&r'do_disable_accountzzLdapShell.do_disable_accountcCrNTrrr&r&r'do_enable_account}rzLdapShell.do_enable_accountcCs,d}|jj|jjdt|ddgdt|jjdkr$tdt|jj|jjdj}|s3td ||jjd}|dj }t d ||rL||@}n||B}|j |dt j |gfi|jjd dkrkt d dS|jjd d kr|td|jjd|jjd dkrtd|jjdtd|jjd)NrSrrTrrUrRrrrOriginal userAccountControl: %dr`1Updated userAccountControl attribute successfullyrrrrrr)r"rer#rfrrdrgr,rmrr-rlrnror`)r$renableUF_ACCOUNT_DISABLErrrr&r&r'rs*"      z'LdapShell.toggle_account_enable_disablecst|tdkrtdgd}|dd}|dddD]}||q$dfdd|D}|jd |g|RdS) NrA query is required.)rrrrTrRr|c3s$|] }d|tdfVqdS)z (%s=*%s*)rNr)r attribute argumentsr&r'rs"z&LdapShell.do_search..z(|%s))rbrcrdr,rjrre)r$rpfilter_attributesrVargument search_queryr&rr' do_searchs     zLdapShell.do_searchc Csd}t|}t|dkrtd|d}|d}d}|dkr$d}n |d kr-d}ntd |jj|jjd t |d d gdt|jj dkrStdt|jj |jj dj }|sbtd||jj d}|d j } t d| |rz| |B} n| |@} t d| |j|d tj| gfi|jjddkrt ddS|jjddkrtd|jjd|jjddkrtd|jjdtd|jjd)Ni@rSzJUsername (SAMAccountName) and true/false flag required (e.g. jsmith true).rrRFtrueTfalsez/The specified flag must be either true or falserrTrrUrrrzUpdated userAccountControl: %dr`rrrrrrr)rbrcrdr,lowerr"rer#rfrrgrmrr-rlrnror`) r$rpUF_DONT_REQUIRE_PREAUTHrqrflag_strflagrrrr&r&r'do_set_dontreqpreauthsB    "        zLdapShell.do_set_dontreqpreauthcCs6||}|s td||dtjt|fdS)Nrz(member:%s:=%s)rr,rerLDAP_MATCHING_RULE_IN_CHAINr)r$rrr&r&r'do_get_user_groupss  zLdapShell.do_get_user_groupscCs:||}|s td||dtjt|fdddS)Nrz(memberof:%s:=%s)rrr)r$rrr&r&r'do_get_group_userss   zLdapShell.do_get_group_userscCs|jj|jjdt|dgdt|jjdkr!tdt|jj|jjd}td|j |dj }|dur?td|dStd dS) Nrz ms-MCS-AdmPwdrUrRrrzFound Computer DN: %szLAPS Password: %sz)Unable to Read LAPS Password for Computer) r"rer#rfrrdrgr,r-rmr)r$rrrr&r&r'do_get_laps_passwords    zLdapShell.do_get_laps_passwordc Csbt|}t|dkr|\}}|jj}nt|dkr |\}}}n tdt|d|dr7|dr7|}ndt|d}t dd }|j j |jjdt|dd g|d |j j s_td t|j j d krktd|j j dd j }td|d||j j ||dg|d |j j stdt|j j d krtd|j j d} td|d| jz tj| djdd} Wn ty|} Ynw| dj|||j j| jdtj| ggi|d|j jddkrtdt|d| jdS|j jddkrtd|j jd|j jddkr&td|j jdtd |j jd)!NrSrzzJExpecting target and grantee or search base, target and grantee. Received z arguments instead.()z(sAMAccountName=r<rWrTrZzGrantee not foundrRzGrantee not uniquerz Resolved z to rYzTarget not foundzTarget not uniquer\r?r_r`zDACL modified successfully!z now has control of rzACould not modify object, the server reports insufficient rights: rrzECould not modify object, the server reports a constrained violation: zThe server returned an error: )rbrcrdr#rfr, startswithrrrr"rergrr-rmr r@rh IndexErrorrGrDrjrQrlrnrorkr`) r$rprq target_spec grantee_name target_base target_filterr[ grantee_sid target_entryrEr&r&r'do_grant_controlsP      &   $zLdapShell.do_grant_controlc Cst|}t|dkrt|dkrtdt||d}|d}|d}|d}|jj|jjdt|ddgd}|d usFt|jj dkrOtd t|jj |jj d}|dj }t d |j t d ||jj|jjdt|dgd}|d ust|jj dkrtd t|jj |jj d} | dj }t d | j t d|z7t j|djdd} t d| djD] } t d| dd| dd|krt dWdSqWn ty|} Ynw| dj|||j|j dtj| ggi|jjddkrt dt d||fdS|jjddkr-td|jjd|jjddkr?td|jjdtd|jjd)NrRrSzXError expecting target and grantee names for RBCD attack. Recieved %d arguments instead.rrrTrrUFrrrzFound Grantee DN: %szGrantee SID: %sr\zCurrently allowed sids:r?z %srLrKzEGrantee is already permitted to perform delegation to the target hostr`z(Delegation rights modified successfully!z0%s can now impersonate users on %s via S4U2Proxyrrrrrr)rbrcrdr,r"rer#rfrrgrr-rmr r@rhrDformatCanonicalrrGrjrQrlrnrorkr`) r$rprq target_namerrrrrgranteerEacer&r&r' do_set_rbcd/sX "          zLdapShell.do_set_rbcdc Cs>t|}t|dkrtdt||d}|jj|jjdt|ddgd}|dus4t|jj dkr=td t|jj |jj d}|dj }t d |j t d |t j|d \}}t } t j|| t d } t dtj| dz|djt | |j g} |j|j dtj| git d|jjddkrdddtdD} dddtdD} t j||| | dt d| dt d| WdS|jjddkrt d|jjdWdS|jjddkrt d |jjdWdSt d!|jjdWdSty}z t d"WYd}~dSd}~ww)#NrRzYError expecting target name for shadow credentials attack. Recieved %d arguments instead.rrrTmsDS-KeyCredentialLinkrUFrrr)subject)deviceId currentTimez)KeyCredential generated with DeviceID: %s)bytesz&Shadow credentials successfully added!r`r|cs"|] }ttjtjVqdSr(rrrrrrir&r&r'r z0LdapShell.do_set_shadow_creds..csr r(r!r"r&r&r'rr$)r path_to_filez1Saved PFX (#PKCS12) certificate & key at path: %sz.pfxzMust be used with password: %srrrrrrz/Attribute msDS-KeyCredentialLink does not exist)rbrcrdr,r"rer#rfrrgrr-rmrcreateSelfSignedX509Certificate getDeviceId KeyCredential getTicksNowuuidUUIDrhtoDNWithBinary2String dumpBinaryrlrnror`rr exportPFXr)r$rprqrrrrkey certificate device_id keyCredential new_valuespathrr2r&r&r'do_set_shadow_credshsN  "    zLdapShell.do_set_shadow_credscCs|jj|jjdt|ddgd}|dust|jjdkr&tdt|jj|jjd}|d j}t d |j t d ||j |j dt j ggi|jjd dkrYt d dS|jjd dkrjtd|jjd|jjd dkr{td|jjdtd|jjd)NrrTrrUFrRrrrrrr`z(Shadow credentials cleared successfully!rrrrrr)r"rer#rfrrdrgr,rr-rmrlrnror`)r$rrrr&r&r'do_clear_shadow_credss"    zLdapShell.do_clear_shadow_credscGsp|jj|jj||d|jjD]&}t|j|D]}||j}|r,td|||jfqt|r5tdqdS)NrUz%s: %sz---) r"rer#rfrgr-rmrany)r$queryrVrrrr&r&r'res   zLdapShell.searchcCsRd|vr|Sz|jj|jjdt|dgd|jjdjWSty(YdSw)NrrrTrUr)r"rer#rfrrgrmr)r$sam_namer&r&r'rs  zLdapShell.get_dncCst|jjjdSr()r-r"rstandardwho_am_irr&r&r' do_whoamiszLdapShell.do_whoamic Cst|}t|dkrtd|jj}|d}ttgd|dd}|jj j j |||dd}g}|j r?|| 7}|j s6|D]}t|d|dD] \} } t| | qOtqAdS) Nrr)rrrrRF)rV sync_filterincremental_valuesdnrV)rbrcrdr,r#rflistsetr"rrdir_sync more_resultsloopr-items) r$rprrr?rVsyncresultsr`kvr&r&r' do_dirsyncs"     zLdapShell.do_dirsynccCs|jdur |jdSr)rcloserr&r&r'do_exits  zLdapShell.do_exitcCs tddS)Na add_computer computer [password] [nospns] - Adds a new computer to the domain with the specified password. If nospns is specified, computer will be created with only a single necessary HOST SPN. Requires LDAPS. rename_computer current_name new_name - Sets the SAMAccountName attribute on a computer object to a new value. add_user new_user [parent] - Creates a new user. add_user_to_group user group - Adds a user to a group. change_password user [password] - Attempt to change a given user's password. Requires LDAPS. clear_rbcd target - Clear the resource based constrained delegation configuration information. clear_shadow_creds target - Clear shadow credentials on the target (sAMAccountName). disable_account user - Disable the user's account. enable_account user - Enable the user's account. dump - Dumps the domain. search query [attributes,] - Search users and groups by name, distinguishedName and sAMAccountName. get_user_groups user - Retrieves all groups this user is a member of. get_group_users group - Retrieves all members of a group. get_laps_password computer - Retrieves the LAPS passwords associated with a given computer (sAMAccountName). grant_control [search_base] target grantee - Grant full control on a given target object (sAMAccountName or search filter, optional search base) to the grantee (sAMAccountName). set_dontreqpreauth user true/false - Set the don't require pre-authentication flag to true or false. set_rbcd target grantee - Grant the grantee (sAMAccountName) the ability to perform RBCD to the target (sAMAccountName). set_shadow_creds target - Set shadow credentials on the target object (sAMAccountName). start_tls - Send a StartTLS command to upgrade from LDAP to LDAPS. Use this to bypass channel binding for operations necessitating an encrypted channel. write_gpo_dacl user gpoSID - Write a full control ACE to the gpo for the given user. The gpoSID must be entered surrounding by {}. whoami - get connected user dirsync - Dirsync requested attributes exit - Terminates this session.r-rr&r&r'do_helps zLdapShell.do_helpcCs tddS)NzBye! TrOrr&r&r'do_EOFszLdapShell.do_EOFN)%__name__ __module__ __qualname__rrr)r+rGrQryrrrrrrrrrrrrrrr r rrr7r8rerr>rLrNrPrQr&r&r&r'r#sF  !M!* !029+   r)rrrrrrnldap3.core.resultsrldap3.utils.convrsixrrbimpacketrldap3.protocol.microsoftrimpacket.ldap.ldaptypesrr r r r impacket.ldapr "impacket.examples.ntlmrelayx.utilsrr,rrr&r&r&r's"