Merge branch 'master' of https://github.com/byt3bl33d3r/CrackMapExec
mpgn
commit
aea179d78a
|
|
@ -0,0 +1,172 @@
|
|||
from pathlib import Path
|
||||
from datetime import datetime
|
||||
from impacket.ldap import ldap, ldapasn1
|
||||
from impacket.ldap.ldap import LDAPSearchError
|
||||
|
||||
|
||||
class CMEModule:
|
||||
'''
|
||||
Get user descriptions stored in Active Directory.
|
||||
|
||||
Module by Tobias Neitzel (@qtc_de)
|
||||
'''
|
||||
name = 'user-desc'
|
||||
description = 'Get user descriptions stored in Active Directory'
|
||||
supported_protocols = ['ldap']
|
||||
opsec_safe = True
|
||||
multiple_hosts = True
|
||||
|
||||
def options(self, context, module_options):
|
||||
'''
|
||||
LDAP_FILTER Custom LDAP search filter (fully replaces the default search)
|
||||
DESC_FILTER An additional seach filter for descriptions (supports wildcard *)
|
||||
DESC_INVERT An additional seach filter for descriptions (shows non matching)
|
||||
USER_FILTER An additional seach filter for usernames (supports wildcard *)
|
||||
USER_INVERT An additional seach filter for usernames (shows non matching)
|
||||
KEYWORDS Use a custom set of keywords (comma separated)
|
||||
ADD_KEYWORDS Add additional keywords to the default set (comma separated)
|
||||
'''
|
||||
self.log_file = None
|
||||
self.desc_count = 0
|
||||
self.context = context
|
||||
self.account_names = set()
|
||||
self.keywords = {'pass', 'creds', 'creden', 'key', 'secret', 'default'}
|
||||
|
||||
if 'LDAP_FILTER' in module_options:
|
||||
self.search_filter = module_options['LDAP_FILTER']
|
||||
|
||||
else:
|
||||
self.search_filter = '(&(objectclass=user)'
|
||||
|
||||
if 'DESC_FILTER' in module_options:
|
||||
self.search_filter += '(description={})'.format(module_options['DESC_FILTER'])
|
||||
|
||||
if 'DESC_INVERT' in module_options:
|
||||
self.search_filter += '(!(description={}))'.format(module_options['DESC_INVERT'])
|
||||
|
||||
if 'USER_FILTER' in module_options:
|
||||
self.search_filter += '(sAMAccountName={})'.format(module_options['USER_FILTER'])
|
||||
|
||||
if 'USER_INVERT' in module_options:
|
||||
self.search_filter += '(!(sAMAccountName={}))'.format(module_options['USER_INVERT'])
|
||||
|
||||
self.search_filter += ')'
|
||||
|
||||
if 'KEYWORDS' in module_options:
|
||||
self.keywords = set(module_options['KEYWORDS'].split(','))
|
||||
|
||||
elif 'ADD_KEYWORDS' in module_options:
|
||||
add_keywords = set(module_options['ADD_KEYWORDS'].split(','))
|
||||
self.keywords = self.keywords.union(add_keywords)
|
||||
|
||||
def __del__(self):
|
||||
'''
|
||||
Destructor - closes the log file.
|
||||
'''
|
||||
try:
|
||||
self.log_file.close()
|
||||
|
||||
info = 'Saved {} user descriptions to {}'.format(self.desc_count, self.log_file.name)
|
||||
self.context.log.highlight(info)
|
||||
|
||||
except AttributeError:
|
||||
pass
|
||||
|
||||
def on_login(self, context, connection):
|
||||
'''
|
||||
On successful LDAP login we perform a search for all user objects that have a description.
|
||||
Users can specify additional LDAP filters that are applied to the query.
|
||||
'''
|
||||
self.create_log_file(connection.conn.getRemoteHost(), datetime.now().strftime("%Y%m%d_%H%M%S"))
|
||||
context.log.debug("Starting LDAP search with search filter '{}'".format(self.search_filter))
|
||||
|
||||
try:
|
||||
sc = ldap.SimplePagedResultsControl()
|
||||
connection.ldapConnection.search(searchFilter=self.search_filter,
|
||||
attributes=['sAMAccountName', 'description'],
|
||||
sizeLimit=0, searchControls=[sc],
|
||||
perRecordCallback=self.process_record)
|
||||
|
||||
except LDAPSearchError as e:
|
||||
context.log.error('Obtained unexpected exception: {}'.format(str(e)))
|
||||
|
||||
def create_log_file(self, host, time):
|
||||
'''
|
||||
Create a log file for dumping user descriptions.
|
||||
'''
|
||||
logfile = 'UserDesc-{}-{}.log'.format(host, time)
|
||||
logfile = Path.home().joinpath('.cme').joinpath('logs').joinpath(logfile)
|
||||
|
||||
self.context.log.debug("Creating log file '{}'".format(logfile))
|
||||
|
||||
self.log_file = open(logfile, 'w')
|
||||
self.append_to_log("User:", "Description:")
|
||||
|
||||
def append_to_log(self, user, description):
|
||||
'''
|
||||
Append a new entry to the log file. Helper function that is only used to have an
|
||||
unified padding on the user field.
|
||||
'''
|
||||
print(user.ljust(25), description, file=self.log_file)
|
||||
|
||||
def process_record(self, item):
|
||||
'''
|
||||
Function that is called to process the items obtained by the LDAP search. All items are
|
||||
written to the log file per default. Items that contain one of the keywords configured
|
||||
within this module are also printed to stdout.
|
||||
|
||||
On large Active Directories there seems to be a problem with duplicate user entries. For
|
||||
some reason the process_record function is called multiple times with the same user entry.
|
||||
Not sure whether this is a fault by this module or by impacket. As a workaround, this
|
||||
function adds each new account name to a set and skips accounts that have already been added.
|
||||
'''
|
||||
if not isinstance(item, ldapasn1.SearchResultEntry):
|
||||
return
|
||||
|
||||
sAMAccountName = ''
|
||||
description = ''
|
||||
|
||||
try:
|
||||
|
||||
for attribute in item['attributes']:
|
||||
|
||||
if str(attribute['type']) == 'sAMAccountName':
|
||||
sAMAccountName = attribute['vals'][0].asOctets().decode('utf-8')
|
||||
|
||||
elif str(attribute['type']) == 'description':
|
||||
description = attribute['vals'][0].asOctets().decode('utf-8')
|
||||
|
||||
except Exception as e:
|
||||
|
||||
entry = sAMAccountName or 'item'
|
||||
self.context.error("Skipping {}, cannot process LDAP entry due to error: '{}'".format(entry, str(e)))
|
||||
|
||||
if description and sAMAccountName not in self.account_names:
|
||||
|
||||
self.desc_count += 1
|
||||
self.append_to_log(sAMAccountName, description)
|
||||
|
||||
if self.highlight(description):
|
||||
self.context.log.highlight('User: {} - Description: {}'.format(sAMAccountName, description))
|
||||
|
||||
self.account_names.add(sAMAccountName)
|
||||
|
||||
def highlight(self, description):
|
||||
'''
|
||||
Check for interesting entries. Just checks whether certain keywords are contained within the
|
||||
user description. Keywords are configured at the top of this class within the options function.
|
||||
|
||||
It is tempting to implement more logic here (e.g. catch all strings that are longer than seven
|
||||
characters and contain 3 different character classes). Such functionality is nice when playing
|
||||
CTF in small AD environments. When facing a real AD, such functionality gets annoying, because
|
||||
it generates to much output with 99% of it being false positives.
|
||||
|
||||
The recommended way when targeting user descriptions is to use the keyword filter to catch low
|
||||
hanging fruites. More dedicated searches for sensitive information should be done using the logfile.
|
||||
This allows you to refine your search query at any time without having to pull data from AD again.
|
||||
'''
|
||||
for keyword in self.keywords:
|
||||
if keyword.lower() in description.lower():
|
||||
return True
|
||||
|
||||
return False
|
||||
Loading…
Reference in New Issue