swisskyrepo
/
NetExec
mirror of https://github.com/swisskyrepo/NetExec.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

fix/feat: remove unnecessary and ugly ldap-attributes functionality; add in badPwdCount to --users

main
Marshall Hallenbeck 2024-03-21 19:20:05 -04:00 committed by Marshall Hallenbeck
parent 3a1e93a386
commit 6a4852e013
2 changed files with 6 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
nxc/protocols/ldap.py
View File

@ -773,11 +773,9 @@ class ldap(connection):
search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)" search_filter = "(sAMAccountType=805306368)" if self.username != "" else "(objectclass=*)"
# default to these attributes to mirror the SMB --users functionality # default to these attributes to mirror the SMB --users functionality
default_attributes = ["sAMAccountName", "description", "pwdLastSet"] request_attributes = ["sAMAccountName", "description", "badPwdCount", "pwdLastSet"]
request_attributes = default_attributes + self.args.ldap_attributes if self.args.ldap_attributes else default_attributes
self.logger.debug(f"{request_attributes=}")
resp = self.search(search_filter, request_attributes, sizeLimit=0) resp = self.search(search_filter, request_attributes, sizeLimit=0)
if resp: if resp:
# I think this was here for anonymous ldap bindings, so I kept it, but we might just want to remove it # I think this was here for anonymous ldap bindings, so I kept it, but we might just want to remove it
if self.username == "": if self.username == "":
@ -791,16 +789,16 @@ class ldap(connection):
users = parse_result_attributes(resp) users = parse_result_attributes(resp)
# we print the total records after we parse the results since often SearchResultReferences are returned # we print the total records after we parse the results since often SearchResultReferences are returned
self.logger.display(f"Total records returned: {len(users):d}") self.logger.display(f"Total records returned: {len(users):d}")
self.logger.highlight(f"{'Username':<30} {'Last PW Set':<20}\t{'Description':<60} " + " ".join(f"{a}" for a in self.args.ldap_attributes) if self.args.ldap_attributes else "") self.logger.highlight(f"{'-Username-':<30}{'-Last PW Set-':<20}{'-BadPW-':<8}{'-Description-':<60}")
for user in users: for user in users:
self.logger.debug(f"{user=}") # TODO: functionize this - we do this calculation in a bunch of places, different, including in the `pso` module
# we default attributes to blank strings if they don't exist in the dict
timestamp_seconds = int(user.get("pwdLastSet", "")) / 10**7 timestamp_seconds = int(user.get("pwdLastSet", "")) / 10**7
start_date = datetime(1601, 1, 1) start_date = datetime(1601, 1, 1)
parsed_pw_last_set = (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S") parsed_pw_last_set = (start_date + timedelta(seconds=timestamp_seconds)).replace(microsecond=0).strftime("%Y-%m-%d %H:%M:%S")
if parsed_pw_last_set == "1601-01-01 00:00:00": if parsed_pw_last_set == "1601-01-01 00:00:00":
parsed_pw_last_set = "<never>" parsed_pw_last_set = "<never>"
self.logger.highlight(f"{user.get('sAMAccountName', ''):<30} {parsed_pw_last_set:<20}\t{user.get('description', ''):<60} " + " ".join(f"{user.get(a, '')}" for a in self.args.ldap_attributes) if self.args.ldap_attributes else "") # we default attributes to blank strings if they don't exist in the dict
self.logger.highlight(f"{user.get('sAMAccountName', ''):<30}{parsed_pw_last_set:<20}{user.get('badPwdCount', ''):<8}{user.get('description', ''):<60}")
def groups(self): def groups(self):
# Building the search filter # Building the search filter
search_filter = "(objectCategory=group)" search_filter = "(objectCategory=group)"

1
nxc/protocols/ldap/proto_args.py
View File

@ -25,7 +25,6 @@ def proto_args(parser, std_parser, module_parser):
vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers") vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers")
vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid") vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid")
vgroup.add_argument("--active-users", action="store_true", help="Get Active Domain Users Accounts") vgroup.add_argument("--active-users", action="store_true", help="Get Active Domain Users Accounts")
vgroup.add_argument("--ldap-attributes", nargs="+", help="Additional attributes to search for (appends to default list)")
ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa") ggroup = ldap_parser.add_argument_group("Retrevie gmsa on the remote DC", "Options to play with gmsa")
ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords") ggroup.add_argument("--gmsa", action="store_true", help="Enumerate GMSA passwords")