o
    jE                     @   s  d dl Z d dlZd dlZd dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
Z
d dlZd dlZd dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZ d dlmZmZmZmZmZmZ d dlm Z  d d	l!m"Z" d d
l#m$Z$m%Z% d dl&m'Z' d dl(mZ d dl)m*Z* d dl+m,Z, d dl-m.Z. d dl/m0Z0 d dl1m2Z2 d dl3m4Z4m5Z5m6Z6m7Z7m8Z8m9Z9m:Z:m;Z; d dl<m=Z=m>Z>m?Z? d dl@mAZA G dd de0jBZCdd ZDdd ZEeFdkreE  dS dS )    N)loggerUniCredential)	UniTarget)tabulate)tqdm)ACCESS_ALLOWED_ACEACCESS_ALLOWED_OBJECT_ACEACE_OBJECT_PRESENCEADS_ACCESS_MASKAceFlagsACEType)ACL)GUID)SE_SACLSECURITY_DESCRIPTOR)SID)LDAPConnectionFactory)MSLDAPConsolePlugin)PathCompleter)aiocmd)LeftAligned)MSADGPO_ATTRSMSADOU_ATTRSMSADContainer_ATTRSMSADDomainTrust_ATTRSMSADGroup_ATTRSMSADInfo_ATTRSMSADMachine_ATTRSMSADUser_TSV_ATTRS)EX_RIGHT_CERTIFICATE_ENROLLMENTCertificateNameFlagMSADCertificateTemplate)SDFlagsRequestc                   @   s  e Zd ZdddZdddZdd Zdd	 Zd
d ZdddZdddZ	dd Z
dd Zdd Zdd Zdd Zdd Zdd Zdd d!Zdd"d#Zdd%d&Zdd)d*Zd+d, Zdd.d/Zdd1d2Zdd3d4Zd5d6 Zd7d8 Zd9d: Zd;d< Zd=d> Zd?d@ ZdAdB ZdCdD Z ddEdFZ!dGdH Z"ddIdJZ#ddKdLZ$dMdN Z%dOdP Z&ddRdSZ'dTdU Z(dVdW Z)dXdY Z*dZd[ Z+d\d] Z,d^d_ Z-d`da Z.ddbdcZ/ddde Z0dfdg Z1dhdi Z2djdk Z3dldm Z4dndo Z5dpdq Z6drds Z7ddtduZ8ddvdwZ9ddxdyZ:ddzd{Z;dd|d}Z<d~d Z=dddZ>dddZ?dddZ@dddZAdd ZBdd ZCdd ZDdd ZEdddZFdd ZGdd ZHdd ZIdd ZJdd ZK	 dddZLdddZMdd ZNdddZOdd ZPdeQdeQfddZRdeQdeSfddZTdeQdeQfddZUdeQdeQfddZVdeWfddZXdd ZYdS )MSLDAPClientConsoleNc                 C   s   t jj| dd || _|d urt|tdu rt|| _d | _d | _d | _	d | _
d | _d| _d| _d| _d| _d| _i | _i | _d | _d S )NF)ignore_sigint)r   PromptToolkitCmd__init__conn_url
isinstancer   from_url
connectionadinfoldapinfodomain_name
domain_sidnoisignocb_disable_channel_binding_disable_signing_null_channel_binding"_MSLDAPClientConsole__current_dirs$_MSLDAPClientConsole__loaded_plugins_current_dn)selfurl r:   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/msldap/examples/msldapclient.pyr'   3   s"   
zMSLDAPClientConsole.__init__c                    s2  z| j du r|du rtd |dur t|tdu r t|| _ t| j   t| j   | j 	 | _
d| j
_| j| j
_| j| j
_| j| j
_| j
 I dH \}}|durY|td | j
j| _| j
j| _d| j
jf | _| j
j| _| j
jjdu r| | jI dH  W dS td W dS    t  Y dS )zPerforms connection and loginNzNo URL was set, cant do logonFTzBIND OK![%s]> 9Anonymous connection. Most functionalities will not work!)r(   printr)   r   r*   r   debugget_credential
get_target
get_clientr+   	keepaliver2   r3   r4   connect	domainsidr/   
domainnamer.   _treepromptr7   _conis_anondo_cd	traceback	print_exc)r8   r9   _errr:   r:   r;   do_loginG   s:   






zMSLDAPClientConsole.do_loginc                       d| _ dS )zDisables signingT)r3   r8   r:   r:   r;   do_nosigi      zMSLDAPClientConsole.do_nosigc                    rQ   )zDisables channel bindingT)r2   rR   r:   r:   r;   do_nocbn   rT   zMSLDAPClientConsole.do_nocbc                    rQ   )z#Sets incorrect channel binding dataT)r4   rR   r:   r:   r;   	do_nullcbs   rT   zMSLDAPClientConsole.do_nullcbTc                    s   z<| j du r| j | _ |du r;| j D ]&}t| j | tr/| j | D ]
}td||f  q#qtd|| j | f  qW dS    t  Y dS )z*Prints detailed LDAP connection info (DSA)NT%s : %sF)r-   r+   get_server_infor)   listr>   rL   rM   )r8   showkitemr:   r:   r;   do_ldapinfox   s   

zMSLDAPClientConsole.do_ldapinfoc                    sp   z,| j du r"| jj| _ | j jdddddd| _| j j| _|du r+t| j  W dS    t	
  Y dS )	z%Prints detailed Active Driectory infoNDC =,.TF)r,   r+   	_ldapinfodistinguishedNamereplacer.   	objectSidr/   r>   rL   rM   )r8   rZ   r:   r:   r;   	do_adinfo   s   

"

zMSLDAPClientConsole.do_adinfoc                    b   z%|  dI dH  | j 2 z3 dH W \}}|dur|t|j q6 W dS    t  Y dS )z$Fetches kerberoastable user accountsFNT)r]   r+   get_all_service_usersr>   sAMAccountNamerL   rM   r8   userrO   r:   r:   r;   do_spns   s   zMSLDAPClientConsole.do_spnsc                    rh   )z%Fetches ASREP-roastable user accountsFNT)r]   r+   get_all_knoreq_usersr>   rj   rL   rM   rk   r:   r:   r;   do_asrep   s   zMSLDAPClientConsole.do_asrepc                    s   z=|  dI dH  | jjddgd2 z'3 dH W \}}|dur!||j}|du r4d|jdd | jf }tt| q6 W dS    t	  Y dS )	zFetches all computer accountsFNrj   dNSHostName)attrsz%s.%sT)
rg   r+   get_all_machinesrp   rj   r.   r>   strrL   rM   )r8   machinerO   dnsr:   r:   r;   do_computeraddr   s   "	z#MSLDAPClientConsole.do_computeraddrc                    s4  dt j  d }z| dI dH  | dI dH  dt j  d }d| }zst|ddd	d
/}|dtd  | j	
 I dH \}}|durO||d|td  W d   n1 sfw   Y  td|  tj|dtjd}|j||d W d   n1 sw   Y  W zt| W n   Y nzt| W w    Y w dt j  d }d| }ztd| d}i }	t|ddd	d
_}| j	ddg2 z3 dH W \}
}|dur||  t|
j|	|
j < q6 t|	| td|  |  tj|dtjd}|j||d W d   n	1 sw   Y  W d   n	1 s/w   Y  W zt| W n   Y nzt| W w    Y w dt j  d }d| }ztd| d}t|ddd	d
:}|dtd  | j	 2 z!3 dH W \}
}|dur||  |d|
td  q}6 W d   n	1 sw   Y  td|  |  tj|dtjd}|j||d W d   n	1 sw   Y  W zt| W n   Y nzt| W w    Y w dt j  d }d| }ztd| d}t|ddd	d
:}|dtd  | j	 2 z!3 dH W \}
}|dur3||  |d|
td  q$6 W d   n	1 sRw   Y  td|  |  tj|dtjd}|j||d W d   n	1 s}w   Y  W zt| W n   Y nzt| W w    Y w dt j  d }d| }ztd| d}t|ddd	d
:}|dt d  | j	! 2 z!3 dH W \}
}|dur||  |d|
t d  q6 W d   n	1 sw   Y  td |  |  tj|dtjd}|j||d W d   n	1 s$w   Y  W zt| W n   Y nzt| W w    Y w d!t j  d }d| }ztd"| d}t|ddd	d
:}|dt"d  | j	# 2 z!3 dH W \}
}|dur||  |d|
t"d  qr6 W d   n	1 sw   Y  td#|  |  tj|dtjd}|j||d W d   n	1 sw   Y  W zt| W n   Y nzt| W w    Y w d$t j  d }d| }ztd%| d}t|ddd	d
:}|dt$d  | j	% 2 z!3 dH W \}
}|dur(||  |d|
t$d  q6 W d   n	1 sGw   Y  td&|  |  tj|dtjd}|j||d W d   n	1 srw   Y  W zt| W n   Y nzt| W w    Y w d't j  d }d| }ztd(| d}t|ddd	d
:}|dt&d  | j	' 2 z!3 dH W \}
}|dur||  |d|
t&d  q6 W d   n	1 sw   Y  td)|  |  tj|dtjd}|j||d W d   n	1 sw   Y  W zt| W n   Y nzt| W w    Y w d*t j  d }d| }ztd+| d}t|ddd	d
:}|dt$d  | j	( 2 z!3 dH W \}
}|durv||  |d|
t)d  qg6 W d   n	1 sw   Y  td,|  |  tj|dtjd}|j||d W d   n	1 sw   Y  W zt| W n   Y nzt| W w    Y w zd-t j  d }td.| d}t|ddd	d
>}| j	* 2 z/3 dH W \}}}}|dur||+ }d|||j,j|- g}||d  |d/ q 6 W d   n	1 s<w   Y  td0|  |  tj|dtjd}|j||d W d   n	1 sgw   Y  W zt| W n   Y nzt| W w    Y w td1|  W d2S    t./  Y dS )3zNFetches ALL user and machine accounts from the domain with a LOT of attributeszdump_%s.zip%Y%m%d-%H%M%SFNz	domain_%sz%s.tsvwr_   utf8newlineencoding	
zAdinfo was written to %sa)compression)arcnamez	schema_%sz%s.jsonzWriting schema to file %sdescnameschemaidguidzSchema dump was written to %sz	trusts_%szWriting trusts to file %szTrust dump was written to %szusers_%szWriting users to file %szUsers dump was written to %szcomputers_%szWriting computers to file %szComputer dump was written to %sz	groups_%szWriting groups to file %szGroup dump was written to %szous_%szWriting OUs to file %szOU dump was written to %szcontainers_%szWriting Containers to file %sz Container dump was written to %szgpos_%szWriting GPOs to file %szGPO dump was written to %s
dns_%s.tsvWriting DNS records to file %s   zDNS dump was written to %szAll dumps were written to %sT)0datetimenowstrftimerg   r]   openwritejoinr   r+   get_ad_infoget_rowr>   zipfileZipFile	ZIP_BZIP2osremover   get_all_schemaentryupdatert   schemaIDGUIDr   lowerjsondumpcloser   get_all_trustsr   get_all_usersr   rs   r   get_all_groupsr   get_all_ousr   get_all_containersget_all_gposr   
dnsentriesget_formattedTypeto_linerL   rM   )r8   zip_filenametnameusers_filenamefr,   rO   dzpbarschemarl   dns_filenamezonednr   dnsrecod
dnsdataobjliner:   r:   r;   do_dump   s,   







zMSLDAPClientConsole.do_dumpc                 C   sB   | j d u rg S g }| j D ]}|ddkrd| }|| q|S )N rr   z'%s')r5   findappend)r8   curdirsdirnamer:   r:   r;   get_current_dirs  s   

z$MSLDAPClientConsole.get_current_dirsc                 C   s   t | jdS )N)r   )r   r   rR   r:   r:   r;   _cd_completions  s   z#MSLDAPClientConsole._cd_completionsc              
      s  | j }zb|dkr|| _ n|dkr||dd d | _ n|| _ || jv r,| j| | _ | jj| j ddI dH }t| d }i | _||  D ]}|dt| j d   }|| j|< qId| j f | _W d	S  t	y } zt
d
|  || _ d| j f | _W Y d}~dS d}~ww )zChange current work directoryrb   z..ra   r   Nlevelr   r<   TzChange directory error! %sF)r7   r   r5   r+   get_tree_plotrY   keyslenrH   	Exceptionr>   )r8   pathoriginal_path	tree_datarootdn	lookup_dner:   r:   r;   rK     s2   
zMSLDAPClientConsole.do_cdNOc                    s>   d|| j f }| ||I dH }|du r| dI dH  |S )z$Remove an object from the current DNz%s,%sNTrb   )r7   	do_deleterK   )r8   subdnconfirmr   resr:   r:   r;   do_rm  s   zMSLDAPClientConsole.do_rmc                    s   zS|  dI dH  | dI dH  | jjjdu r td W dS td|  | dkr=td td|  td	 W dS | j|I dH \}}|durN|td
 W dS    t	  Y dS )z%Remove an object identified by its DNFNTr=   z)This will delete the following object: %sYESzkAs a safety measure, you have to confirm the deletion by typing YES in all caps after the DN to be deleted!zExample: "delete %s YES"zNot confirmed! Aborting!z
Delete OK!)
r]   rg   r+   rI   rJ   r>   upperdeleterL   rM   )r8   r   r   rN   rO   r:   r:   r;   r     s*   zMSLDAPClientConsole.do_deleteFc                    s0   | j D ]}|}|dur| j | }t| qdS )z'Print objects in current work directoryFT)r5   r>   )r8   fullpathr   entryr:   r:   r;   do_ls  s   


zMSLDAPClientConsole.do_ls*r_   c                    s   | d}|dkr| j}| jjd| ||d2 zD3 dH W \}}|dur&||d D ]1}t|d | tkrMt|d | D ]\}}td|||f  q>q*|d | }td||f  q*q6 d	S )
zHPrint attributes of object. Without arguments it will cat the current DNra   r_   (distinguishedName=%s))query
attributestreeNr   z%s [%s]: %s%s: %sT)splitr7   r+   pagedsearchtyperY   	enumerater>   )r8   r   r   r   rO   attrivalr:   r:   r;   do_cat  s"   
&
zMSLDAPClientConsole.do_catc                    s@   |d|fgi}| j ||I dH \}}|dur|td dS )zAModify an attribute of object. Only works with string data types!re   N
Modify OK!T)r+   modifyr>   )r8   r   	attributevaluechangesrN   rO   r:   r:   r;   	do_modify  s   
zMSLDAPClientConsole.do_modify-c                    s  z|  dI dH  |du rd}|dr|d}td|  td|  | j||2 z3 dH W \}}|dur=|td|d   td	 |d
  D ]k\}}t	|t
rtd|  |D ]$}t	|trptd|   q`t	|tr~td|   q`td|  q`qOt	|trtd|| f  td||  f  qOt	|trtd|| f  qOtd||f  qOtd q/6 W dS    t  Y dS )zvPerforms a raw LDAP query against the server. Secondary parameter is the requested attributes SEPARATED WITH COMMA (,)FNr   ra   z	Query: %szAttributes: %szDN: %s
objectNamezAttributes:r   z  %s:z    - %sz  %s: %sz---T)r]   r   r   loggingr?   r+   r   r>   itemsr)   rY   r   to_sddlbyteshexto_bytesrL   rM   )r8   r   r   r   rO   	attr_name
attr_valuer   r:   r:   r;   do_query#  sH   







zMSLDAPClientConsole.do_queryr   c                    s   zU|  dI dH  |du rd}t|}|dur*zt| W n   Y nt|}d}|du r:|  dI dH  | jj}td|  | j||I dH }t }t|| W dS    t	
  Y dS )zYPrints a tree from the given DN (if not set, the top) and with a given depth (default: 1)FNr   z
Tree on %sT)r]   intr+   rG   r   r?   r   r   r>   rL   rM   )r8   r   r   r   trr:   r:   r;   do_treeJ  s0   zMSLDAPClientConsole.do_treec                    s   z7|  dI dH  | dI dH  | j|I dH \}}|dur#||du r6|du r2td |W S t| |W S    t  Y dS )z>Feteches a user object based on the sAMAccountName of the userFNTzUser not found!)r]   rg   r+   get_userr>   rL   rM   )r8   samaccountnameto_printrl   rO   r:   r:   r;   do_userg  s    zMSLDAPClientConsole.do_userc                    s   z=|  dI dH  | dI dH  | j|I dH \}}|dur#||du r.td W dS t| t|j}t| W dS    t	  Y dS )zDFeteches a machine object based on the sAMAccountName of the machineFNzmachine not found!T)
r]   rg   r+   get_machiner>   r   
from_bytes#allowedtoactonbehalfofotheridentityrL   rM   )r8   r   ru   rO   xr:   r:   r;   
do_machine{  s"   zMSLDAPClientConsole.do_machinec                    sl   z*|  dI dH  | dI dH  | j|I dH \}}|dur#|tt| W dS    t  Y dS )zYFeteches a schema object entry object based on the DN of the object (must start with CN=)FNT)r]   rg   r+   get_schemaentryr>   rt   rL   rM   )r8   cnschemaentryrO   r:   r:   r;   do_schemaentry  s   z"MSLDAPClientConsole.do_schemaentryc                    st   z.|  dI dH  | dI dH  | j 2 z3 dH W \}}|dur%|tt| q6 W dS    t  Y dS )z(Feteches all schema object entry objectsFNT)r]   rg   r+   r   r>   rt   rL   rM   )r8   r  rO   r:   r:   r;   do_allschemaentry  s   z%MSLDAPClientConsole.do_allschemaentryc                    0   | j |I dH \}}|dur|t| dS )z7Fetches the DN of an object based on the sAMAccountNameNT)r+   sam2dnr>   )r8   rj   r   rO   r:   r:   r;   	do_sam2dn     zMSLDAPClientConsole.do_sam2dnc                    r  )z2Fetches the DN of an object based on the objectSidNT)r+   sid2dnr>   )r8   sidr   rO   r:   r:   r;   	do_sid2dn  r  zMSLDAPClientConsole.do_sid2dnc                    r  )z2Fetches the objectSid of an object based on the DNNT)r+   dn2sidr>   )r8   r   r
  rO   r:   r:   r;   	do_dn2sid  r  zMSLDAPClientConsole.do_dn2sidc                    r  )z7Fetches the sAMAccountName of an object based on the DNNT)r+   dn2samr>   )r8   r   samrO   r:   r:   r;   	do_dn2sam  r  zMSLDAPClientConsole.do_dn2samc                    s   zE|  dI dH  | dI dH  | j| jjd I dH \}}|dur'|| jj|dd2 z3 dH W \}}|dur=|t|j q/6 W dS    t	
  Y dS )z4Lists all members of the domain administrators groupFN-512T	recursive)r]   rg   r+   r	  r,   rf   get_group_membersr>   rd   rL   rM   )r8   r   rO   objr:   r:   r;   do_dadms  s     zMSLDAPClientConsole.do_dadmsc              
      s   z*|dus
|dkrd}| j j||d2 z3 dH W \}}|dur"|t|j q6 W dS  tyB } zt  W Y d}~dS d}~ww )z3Returns all member users in a group specified by DNF0Tr  N)r+   r  r>   rd   r   rL   rM   )r8   r   r  r  rO   r   r:   r:   r;   do_groupmembers  s    z#MSLDAPClientConsole.do_groupmembersc                    s  z|  dI dH  | dI dH  zt|}W n   td dtdf Y W S d| }| j|ddg2 zI3 dH W \}}|durE|d|d vrvtd	 t }t	j
t	jB |_td
|_d|_d|_t |_d|j_d|j_d|j_n	t|d d } n6 td dtdfW S |jjD ]}|j|krtd dtdf  W S qtd t }d|_d|_||_t|}	|	jj| dd|	 fgi}
| j||
I dH \}}|dur|td W dS    t !  Y dS )zQAdds a SID to the msDS-AllowedToActOnBehalfOfOtherIdentity protperty of target_dnFNzIncorrect SID!zIncorrect SIDr   z(msDS-AllowedToActOnBehalfOfOtherIdentityrf   r   z>Attribute does not exist on the current object, crafing new SDS-1-5-32-544   r   zTarget DN not found!zAccount is already there!zConstructing new ACEi re   
Change OK!)"r]   rg   r   from_stringr>   r   r+   r   r   r   SE_DACL_PRESENTSE_SELF_RELATIVEControlOwnerGroupSaclr   DaclAclRevisionSbz1Sbz2r   acesSidr   r   Maskcopydeepcopyr   r   r   rL   rM   )r8   	target_dnother_identity_sidcomputer_sidr   r   rO   	target_sdacenew_sdr   rN   r:   r:   r;   )do_addallowedtoactonbehalfofotheridentity  sb   "


z=MSLDAPClientConsole.do_addallowedtoactonbehalfofotheridentityc                    sf   z'|  dI dH  | dI dH  | jj|||dI dH \}}|dur&|W dS    t  Y dS )zChanges the owner in a Security Descriptor to the new_owner_sid on an LDAP object or on an LDAP object's attribute identified by target_dn and target_attribute. target_attribute can be omitted to change the target_dn's SD's ownerFN)target_attribute)r]   rg   r+   change_priv_ownerrL   rM   )r8   new_owner_sidr,  r3  rN   rO   r:   r:   r;   do_changeowner0  s   z"MSLDAPClientConsole.do_changeownerc                    sn   z+|  dI dH  | dI dH  | j|| jjI dH \}}|dur&|td W dS    t  Y dS )zzAdds DCSync rights to the given user by modifying the forest's Security Descriptor to add GetChanges and GetChangesAll ACEFNr  T)	r]   rg   r+   add_priv_dcsyncr,   rd   r>   rL   rM   )r8   user_dnforestrN   rO   r:   r:   r;   do_addprivdcsync=  s   z$MSLDAPClientConsole.do_addprivdcsyncc                    sj   z)|  dI dH  | dI dH  | j||I dH \}}|dur$|td W dS    t  Y dS )zDAdds AddMember rights to the user on the group specified by group_dnFNr  T)r]   rg   r+   add_priv_addmemberr>   rL   rM   r8   r8  group_dnrN   rO   r:   r:   r;   do_addprivaddmemberM  s   z'MSLDAPClientConsole.do_addprivaddmemberc                    s   zC|  dI dH  | dI dH  zt|}W n   td dtdf Y W S | j|| I dH \}}|dur>|td W dS    td t	
  Y dS )z,Updates the security descriptor of an objectFNzIncorrect SDDL input!r  Tz(Erro while updating security descriptor!)r]   rg   r   	from_sddlr>   r   r+   set_objectacl_by_dnr   rL   rM   )r8   r,  sddlr1  rN   rO   r:   r:   r;   do_setsd]  s$   zMSLDAPClientConsole.do_setsdr   c                    s  z|  dI dH  | dI dH  | j|I dH \}}|dur#|t|}| j|j I dH \}}}t	d||f  | j|j
 I dH \}}}t	d||f  g }|jjD ]n}	t|	j rot|	j }
n| j|	j I dH \}}}|dkrd||f }
n|	j }
|d dkrg }t|	d	D ]}||d
d  q||
g|  q\|d dkrt|	d	D ]	}||
|g qq\|d dkrt	t|g dd W dS |d dkrt	t|ddgd W dS t	|  W dS    t  Y dS )%Feteches security info for a given DNFNzOWNER: %s\%szGROUP: %s\%sz???%s\%sr   g
:rr   p)
Whor   Flagsr   r)  
ObjectTypeInheritedObjectTypeObjectFlagsACTyper_   )headersrI  ACET)r]   rg   r+   get_objectacl_by_dnr   r   
resolv_sidr   r   r>   r!  r#  r'  r   wellknown_sid_lookupr(  rt   r   r   r   rL   rM   )r8   r   optssec_inforO   sddomainusernameoutr0  	canonicalrowr   r:   r:   r;   do_getsds  sP   

zMSLDAPClientConsole.do_getsdc                    sp   z,|  dI dH  | dI dH  | j 2 z3 dH W \}}|dur%|t| q6 W dS    t  Y dS )rC  FNT)r]   rg   r+   r   r>   rL   rM   )r8   gporO   r:   r:   r;   do_gpos  s   
zMSLDAPClientConsole.do_gposc                    s  z| j  2 z&3 dH W \}}|dur|d|d v r-|d d }td|d d |f  q6 | j  2 z3 dH W \}}|durB|d|d v rZ|d d }td|d d |f  d|d v rt|d d }td|d d | f  d|d v r|d d }td|d d |f  d	|d v r|d d	 }td|d d |f  d
|d v r|d d
 }td|d d |f  q46 W dS    t  Y dS )zFeteches all laps passwordsNzms-Mcs-AdmPwdr   rW   r  zmsLAPS-PasswordzmsLAPS-EncryptedPasswordzmsLAPS-EncryptedPasswordHistoryzmsLAPS-EncryptedDSRMPasswordz#msLAPS-EncryptedDSRMPasswordHistoryTF)r+   get_all_lapsr>   get_all_laps_windowsr   rL   rM   )r8   r   rO   pwdr:   r:   r;   do_laps  sD   zMSLDAPClientConsole.do_lapsc              
      s   zS|  dI dH  | dI dH  g }| j|2 z,3 dH W \}}|dur(||| | j|I dH \}}|dur>|td||f  q6 t|dkrRtd W dS  tyk } zt	
  W Y d}~dS d}~ww )zDFeteches names all groupnames the user is a member of for a given DNFNz%s - %sr   zNo memberships foundT)r]   rg   r+   get_tokengroupsr   get_dn_for_objectsidr>   r   r   rL   rM   )r8   r   
group_sids	group_sidrO   r=  r   r:   r:   r;   do_groupmembership  s,   
	z&MSLDAPClientConsole.do_groupmembershipc                    s   || j _dS )zQChanges the LDAP TREE for future queries. MUST be DN format eg. 'DC=test,DC=corp'N)r+   rG   )r8   newtreer:   r:   r;   do_bindtree  s   zMSLDAPClientConsole.do_bindtreec                    sT   z| j  2 z3 dH W \}}|dur|t|  q6 W dS    t  Y dS )z!Feteches gives back domain trustsNTF)r+   r   r>   get_linerL   rM   r8   r   rO   r:   r:   r;   	do_trusts  s   zMSLDAPClientConsole.do_trustsc                    J   z| j ||I dH \}}|dur|td W dS    t  Y dS )z'Creates a new domain user with passwordNz
User addedTF)r+   create_user_dnr>   rL   rM   )r8   r8  passwordrN   rO   r:   r:   r;   
do_adduser     zMSLDAPClientConsole.do_adduserc                    H   z| j |I dH \}}|dur|td W dS    t  Y dS )ztDeletes the user! This action is irrecoverable (actually domain admins can do that but probably will shout with you)NzGoodbye, Caroline.TF)r+   delete_userr>   rL   rM   r8   r8  rN   rO   r:   r:   r;   
do_deluser     zMSLDAPClientConsole.do_deluserc                    sL   z| j |||I dH \}}|dur|td W dS    t  Y dS )zNChanges user password, if you are admin then old pw doesnt need to be suppliedNzUser password changedTF)r+   change_passwordr>   rL   rM   )r8   r8  newpassoldpassrN   rO   r:   r:   r;   do_changeuserpw  s   z#MSLDAPClientConsole.do_changeuserpwc                    rr  )z'Unlock user by setting lockoutTime to 0NzUser unlockedTF)r+   unlock_userr>   rL   rM   rt  r:   r:   r;   do_unlockuser#  rv  z!MSLDAPClientConsole.do_unlockuserc                    rr  )/Unlock user by flipping useraccountcontrol bitsNzUser enabledTF)r+   enable_userr>   rL   rM   rt  r:   r:   r;   do_enableuser/  rv  z!MSLDAPClientConsole.do_enableuserc                    rr  )r}  NzUser disabledTF)r+   disable_userr>   rL   rM   rt  r:   r:   r;   do_disableuser;  rv  z"MSLDAPClientConsole.do_disableuserc                    rm  )z&Adds an SPN entry to the users accountNz
SPN added!TF)r+   add_user_spnr>   rL   rM   r8   r8  spnrN   rO   r:   r:   r;   	do_addspnG  rq  zMSLDAPClientConsole.do_addspnc                    rm  )z)Removes an SPN entry to the users accountNzSPN removed!TF)r+   del_user_spnr>   rL   rM   r  r:   r:   r;   	do_delspnS  rq  zMSLDAPClientConsole.do_delspnc                    rm  )z,Adds additional hostname to computer accountNzHostname added!TF)r+   add_additional_hostnamer>   rL   rM   )r8   r8  hostnamerN   rO   r:   r:   r;   do_addhostname_  rq  z"MSLDAPClientConsole.do_addhostnamec                    rm  )zGAdds user to specified group. Both user and group must be in DN format!NzUser added to group!TF)r+   add_user_to_groupr>   rL   rM   r<  r:   r:   r;   do_addusertogroupk  rq  z%MSLDAPClientConsole.do_addusertogroupc                    rm  )zLRemoves user from specified group. Both user and group must be in DN format!NzUser removed from group!TF)r+   del_user_from_groupr>   rL   rM   r<  r:   r:   r;   do_deluserfromgroupw  rq  z'MSLDAPClientConsole.do_deluserfromgroupc                    f   z'g }| j  2 z3 dH W \}}|dur||| |du r$t| q	6 |W S    t  Y dS )zLists Root CA certificatesNTF)r+   list_root_casr   r>   rL   rM   r8   r   cascarO   r:   r:   r;   
do_rootcas     
zMSLDAPClientConsole.do_rootcasc                    r  )zLists NT CA certificatesNTF)r+   
list_ntcasr   r>   rL   rM   r  r:   r:   r;   do_ntcas  r  zMSLDAPClientConsole.do_ntcasc                    r  zLists AIA CA certificatesNTF)r+   list_aiacasr   r>   rL   rM   r  r:   r:   r;   	do_aiacas  r  zMSLDAPClientConsole.do_aiacasc                    r  r  )r+   list_enrollment_servicesr   r>   rL   rM   )r8   r   servicessrvrO   r:   r:   r;   do_enrollmentservices  r  z)MSLDAPClientConsole.do_enrollmentservicesc                    s   z[d}| j |2 z3 dH W \}}|dur| n6 |du r#tdtt|}|dur2t|}n
tt|jtj	B }dd|fgi}| j 
|j|I dH \}}|durV|td W dS    t  Y dS )zModifyies the msPKI-Certificate-Name-Flag value of the specified certificate template and enables ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME bit. If 'flags' is present then it will assign that value.NTemplate could not be found!zmsPKI-Certificate-Name-Flagre   r   TF)r+   list_certificate_templatesr   typingcastr"   r   r!   Certificate_Name_Flag"ENROLLEE_SUPPLIES_SUBJECT_ALT_NAMEr   rd   r>   rL   rM   )r8   certtemplatenameflagstemplaterO   r   rN   r:   r:   r;   !do_addcerttemplatenameflagaltname  s0   

z5MSLDAPClientConsole.do_addcerttemplatenameflagaltnamec           	         s$  z| j |I dH \}}|dur|d}| j |2 z3 dH W \}}|dur)| n6 |du r4tdtt|}t|j	}t
 }t||_tt|_td|_tjtjB tjB |_tj|_|jj| | j j|j| t j!dI dH \}}|dur|t"d W dS    t#$  Y dS )zRGrants enrollment rights to a user (by DN) for the specified certificate template.Nr  r   r  SD set sucessfullyTF)%r+   get_objectsid_for_dnr  r   r  r  r"   r*  r+  nTSecurityDescriptorr	   r   r  r(  r   r    rK  r   r   	READ_PROP
WRITE_PROPCONTROL_ACCESSr)  r
   ACE_OBJECT_TYPE_PRESENTrJ  r#  r'  r   r@  rd   r   r#   DACL_SECURITY_INFORMATIONr>   rL   rM   )	r8   r  r8  user_sidrO   r  r1  r0  rN   r:   r:   r;   do_addenrollmentright  s<   
$z)MSLDAPClientConsole.do_addenrollmentrightc           	         s   zf| j ddI dH }g }| j|2 zP3 dH W \}}|dur!|d}|jdur:| j|jI dH \}}|dur:|||_|D ]}|j|jv rS|j	d|j
|jf  q?|	| |du rct|  q6 |W S    t  Y dS )zLists certificate templatesFr   NrD  T)r  r+   r  r  	resolv_sdsid_lookup_tabler   certificateTemplatesenroll_servicesr   rp   r>   prettyprintrL   rM   )	r8   r   r   r  	templatesr  rO   ltr  r:   r:   r;   do_certtemplates  s4   

z$MSLDAPClientConsole.do_certtemplatesc                    s^   z#| j |I dH \}}}|dur|d||f }|du r"t| |W S    t  Y dS )z'Returns the domain and username for SIDNrD  TF)r+   rR  r>   rL   rM   )r8   r
  r   rW  rX  rO   r   r:   r:   r;   do_sidresolv  s   z MSLDAPClientConsole.do_sidresolvc              
      s  z| j ddI dH }|du rtd| |du rtd| jddI dH }|du r0td| |du r8tdg }d}|durR| j|I dH \}}|durQ|n| j I dH \}}|durb||d }|D ]e}||}t|d	krvqh|j}d
}	t|d	krdg}d}	|D ]D\}
}d|j	 }|d| 7 }|d|
 7 }|d|	 7 }|d7 }|D ]}|d||| 
ddf 7 }qt| |	|j	||
|d}|| qqh|W S    t  Y dS )z ADCA security test - new versionFr  N%Listing enrollment Services error! %s)No Enrollment Services present, stopping!Listing templates error! %sNo templates exists!tokengroupsr   TNNzTemplate Name: %s
zEnrollment Service Name: %s
zEnrollment Service Host: %s
zEnabled: %s
zVulnerabilities:
z		%s - %s
Reasonr_   )enabledr  servicer  vulns)r  r   r  r+   get_tokengroups_user
whoamifullis_vulnerable2r   enrollment_servicesr   getr>   r   rL   rM   )r8   rX  esr  resultsr  rO   r   r  
is_enabledr  r  trr   r:   r:   r;   do_certify2,  sj   

zMSLDAPClientConsole.do_certify2c                    s,  z| j ddI dH }|du rtd| |du rtd| jddI dH }|du r0td| |du r8td|D ]}t| q:|dur| dd	u r}d}|dure| j|I dH \}}|dure||D ]}||\}	}
|	d	u r|t|
 t| qgW d	S |D ]}t| qW d	S    t	
  Y dS )
zADCA security testFr  Nr  r  r  r  vulnT)r  r   r  r>   r   
startswithr+   r  is_vulnerablerL   rM   )r8   cmdrX  r  r  
enrollmentr  rO   r  isvulnreasonr:   r:   r;   
do_certifyk  sD   

zMSLDAPClientConsole.do_certifyc                    sF   z| j  I dH \}}|dur|t| W dS    t  Y dS )zSimple whoamiNF)r+   whoamir>   rL   rM   )r8   r   rO   r:   r:   r;   do_whoamiraw     z MSLDAPClientConsole.do_whoamirawc              	      s   zK| j  I dH \}}|dur||D ]5}t|| tdu r*td||| f  qt|| tdu rI|| D ]}td|d|| | f  q7qW dS    t  Y dS )zFull whoamiNTr   zGroup: %s (%s)\)FN)	r+   r  r)   rt   r>   dictr   rL   rM   )r8   r   rO   r   r[   r:   r:   r;   	do_whoami  s     zMSLDAPClientConsole.do_whoamic           	         s  zt d | j 2 zs3 dH W \}}}}|dur|t d|  g }|dur]|jjD ]&}|jtjkrQz| j|j	ddI dH }|
| W q+   |
|j	 Y q+q+|D ]}t d|  qT|durvt d|jdd    t d	|j  nt d
 t d q6 W dS    t  Y dS )zcLists all managed service accounts (MSA). If user has permissions it retrieves the password as wellz----------------------------------------------NzUsername: %sFr  zAllowed machine: %sPassword: %szPassword -NT-: %szPassword: <EMPTY>)r>   r+   	list_gmsar#  r'  AceTyper   ACCESS_ALLOWED_ACE_TYPEr  r(  r   CurrentPasswordr   nt_hashrL   rM   )	r8   r   membershipspwblobrO   allowed_machinesr   rl   mnamer:   r:   r;   do_gmsa  s8   
zMSLDAPClientConsole.do_gmsac           	         sD  zddl }i }i }| j 2 z03 dH W \}}|dur|| ||j< z|jdur1| ||j< W q   tt|  Y q6 tdd}|	|| W d   n1 sWw   Y  tdddd*}|
d d}|D ]}|d	||| f 7 }qm|
| |
d
 W d   W dS 1 sw   Y  W dS    t  Y dS )z2Generates schema data. This will take a long time.r   Nzadschema.jsonry   zadschema.pyr_   )r|   zLDAP_WELL_KNOWN_ATTRS = {
z	"%s" : %s,
}F)r   r+   r   to_dictlDAPDisplayNameisSingleValuedget_typer>   r   r   r   rL   rM   )	r8   r   r   testattrr   rO   r   r   attrnamer:   r:   r;   do_genschema  s<   
	

&z MSLDAPClientConsole.do_genschemac                    sf   z'| j ||I dH \}}}|dur|t| td|j  td|  W dS    t  Y dS )zAdds a new computer accountNzsAMAccountName: %sr  F)r+   add_computerr>   rj   rL   rM   )r8   computernamero  computerrO   r:   r:   r;   do_addcomputer  s   z"MSLDAPClientConsole.do_addcomputerc                    sF   z| j ||I dH }|dur|td W dS    t  Y dS )z(Changes the sAMAccountName of a given DNNOKF)r+   change_samaccountnamer>   rL   rM   )r8   r   newnamerO   r:   r:   r;   do_changesamaccountname  r  z+MSLDAPClientConsole.do_changesamaccountnamec                    s   z9t d | j 2 z3 dH W \}}|dur|t | q6 | j 2 z3 dH W \}}|dur2|t | q$6 W dS    t  Y dS )z*Lists all unconstrained delegation objectsz*Objects with Unconstrained Delegation set:NF)r>   r+   get_unconstrained_machinesget_unconstrained_usersrL   rM   rk  r:   r:   r;   do_unconstrained  s    

z$MSLDAPClientConsole.do_unconstrainedc                    s~   z3t d | j 2 z%3 dH W \}}|dur||dd}|dg D ]
}t d||f  q%q6 W dS    t  Y dS )z(Lists all constrained delegation objectsz(Objects with Constrained Delegation set:Nrj   r_   zmsDS-AllowedToDelegateToz%s -> %sF)r>   r+   get_all_constrainedr  rL   rM   )r8   r   rO   snamer   r:   r:   r;   do_constrained  s   z"MSLDAPClientConsole.do_constrainedc                    sX   z t d | j 2 z3 dH W \}}|dur|t | q6 W dS    t  Y dS )zLists all S4U2Proxy objectszS4U2Proxy set:NF)r>   r+   get_all_s4u2proxyrL   rM   rk  r:   r:   r;   do_s4u2proxy%  s   
z MSLDAPClientConsole.do_s4u2proxyc                    s`   z$| j  2 z3 dH W \}}|dur||jd dkr!t|j q6 W dS    t  Y dS )ztesting, dontuseNrr   rl   TF)r+   get_all_objectaclobjectClassr>   rL   rM   rk  r:   r:   r;   do_test2  s   
zMSLDAPClientConsole.do_testc                    sv   z/| j  2 z%3 dH W \}}}|dur|t| |du rq|D ]}td| q!t  q6 W dS    t  Y dS )zLists all DNS zonesNFr   T)r+   dnslistzonesr>   rL   rM   )r8   to_print_propsr   propsrO   propr:   r:   r;   do_dnszonesI  s    zMSLDAPClientConsole.do_dnszonesc              
      s  zi|dkrd }dt j  d }td| d}t|dddd?}| j|2 z-3 d H W \}}}}|d ur8|| }	d	|||j	j
|	 g}
||
d
  |d q(6 W d    W dS 1 scw   Y  W dS  ty } zt  W Y d }~dS d }~ww )Nr_   r   rx   r   r   ry   rz   r{   r~   r   r   TF)r   r   r   r   r   r+   r   r   r   r   r   r   r   r   r   rL   rM   )r8   zoner   r   r   r   r   r   rO   r   r   r   r:   r:   r;   
do_dnsdump_  s0    
zMSLDAPClientConsole.do_dnsdumpc                    s\   z"d}| j j|dgd2 z3 dH W \}}|dur|t| q6 W dS    t  Y dS )zNLists potentially abusable machine accounts created with pre windows-2000 flagz*(&(userAccountControl=4128)(logonCount=0))rj   )r   NTF)r+   r   r>   rL   rM   )r8   r   r   rO   r:   r:   r;   
do_pre2000v  s   "
zMSLDAPClientConsole.do_pre2000c                    s   zd|| j vr/tjdt| j  |}tj|}|tjdt| j  < |j	| || j |< n| j | }t
|D ]&}t||}t|tr^t|tr^|tur^|| | j}||I dH   W S q8td W dS    t  Y dS )zLoads a plugin and runs itzplugin_module_%sNzoNo plugin class found in that module! Please make sure you have a class that inherits from MSLDAPConsolePlugin!F)r6   	importlibutilspec_from_file_locationr   module_from_specsysmodulesloaderexec_moduledirgetattrr)   r   
issubclassr   r+   runr>   rL   rM   )r8   
pluginpathrunargsspecplugin_moduler\   r  plugin_instancer:   r:   r;   	do_plugin  s(   


zMSLDAPClientConsole.do_pluginc                    sP   z| j  2 z3 dH W \}}|dur|t| q6 W dS    t  Y dS )z3Lists all delegated managed service accounts (DMSA)NTF)r+   get_all_dmsasr>   rL   rM   rk  r:   r:   r;   do_dmsas  s   
zMSLDAPClientConsole.do_dmsasr   managedaccountprecededbylinkc                    X   z dd|fgi}| j ||I dH \}}|dur|td W dS    t  Y dS )z1Adds a managed account preceded by link to a DMSAz!msDS-ManagedAccountPrecededByLinkre   Nr  Fr+   r   r>   rL   rM   )r8   r   r$  r   rN   rO   r:   r:   r;   &do_dmsaaddmanagedaccountprecededbylink  s   
z:MSLDAPClientConsole.do_dmsaaddmanagedaccountprecededbylinkdelegatedmsastatec                    r%  )z&Sets the delegated MSA state of a DMSAzmsDS-DelegatedMSAStatere   Nr  Fr&  )r8   r   r(  r   rN   rO   r:   r:   r;   do_dmsasetdelegatedmsastate  s   
z/MSLDAPClientConsole.do_dmsasetdelegatedmsastater8  computersidc                    sJ   z| j ||I dH \}}|dur|td W dS    t  Y dS )zsThis will create a dmsa service user that can be used for neferious reasons, but DO NOT USE THIS FOR ANYTHING ELSE!Nr  F)r+   create_broken_dmsa_userr>   rL   rM   )r8   r8  r*  rN   rO   r:   r:   r;   do_create_broken_dmsa_user  s   z.MSLDAPClientConsole.do_create_broken_dmsa_usertargetdnuserdnc           
         s   zl| j |dI dH \}}|dur|| j |I dH \}}|dur%|t|}t|d d }t|}t }t	
||_td|_tj|_|jj| | j j|| tjdI dH \}	}|durg|td W dS    t  Y dS )z+Adds a generic write ACE to a target objectNr   rf   r   r  r  F)r+   get_obj_by_dnrQ  r   r   rt   r*  r+  r   r   r  r(  r   r   GENERIC_WRITEr)  r#  r'  r   r@  r   r#   r  r>   rL   rM   )
r8   r-  r.  	userentryrO   targetsdr  r1  r0  rN   r:   r:   r;   do_add_genericwrite  s.   


"z'MSLDAPClientConsole.do_add_genericwriterV  c                    s  dt f fdd}|jdu rdS g }||jdu r: j|jI dH \}}|du r:|g dg |j|jdgd |jjD ]}g }g }g }	|jt	j
t	jfv rntjtjtjtjtjtjtjfD ]}
|
t|jv rm||
 q_t|d	kruq>|jt	jkrt |jd
v r|t |j t|d	krq>|t |jdu rq>|	t |j t|	d	krq>g }|	D ]"} j|I dH \}}|durq|du rq|j}|||d q||ddd |D ||d q>|S )z.Checks if the SD has the badsuccessor flag setr
  c                    sJ   t | } | dv r
dS |  jdu rdS dD ]}| |du r" dS qdS )N)r  zS-1-5-18TF)r  z-519)rt   r  r/   endswith)r
  suffixrR   r:   r;   is_excluded_sid  s   zBMSLDAPClientConsole.check_badsuccessor_sd.<locals>.is_excluded_sidNFOWNER)r   r
  )rights
rights_strotypesusersr   )z$00000000-0000-0000-0000-000000000000z$0feb936f-47b3-49f2-9386-1dedc2c23765T|c                 S   s   g | ]}|j qS r:   )r   ).0rightr:   r:   r;   
<listcomp>7  s    z=MSLDAPClientConsole.check_badsuccessor_sd.<locals>.<listcomp>)rt   r#  r   r+   get_user_by_sidr   rj   r'  r  r   r  ACCESS_ALLOWED_OBJECT_ACE_TYPEr   GENERIC_ALLr0  WRITE_OWNER
WRITE_DACLCREATE_CHILDr  r  r)  r   rK  r(  r   )r8   rV  r6  r  rl   rO   r0  r8  r:  sidsmaskr;  r
  	user_namer:   rR   r;   check_badsuccessor_sd  sr   
$


z)MSLDAPClientConsole.check_badsuccessor_sdc           	         s^  zg }| j  2 z$3 dH W \}}|dur||du rq	|jdu r"q	d|jv r-||j q	6 t|dkr=td td | j  2 z^3 dH W \}}|durP||du rUqB| j |j	I dH \}}|durfqBt
|}|du rpqB|jdu rvqB| |I dH }|D ]}|d D ]}t|j	 d|d  d	|d
  d|d   qqqB6 W dS    t  Y dS )z=Checks if Badsuccessor vulnerability is present on the domainN2025r   z2[-] No domain controllers with Windows 2025 found!z[*] Checking OUs regardless...r;  z, r   z (r
  z) r9  F)r+   get_all_domain_controllersoperatingSystemr   rj   r   r>   r   rQ  rd   r   r   r#  rI  rL   rM   )	r8   dc_listr  rO   r   rV  r  resultrl   r:   r:   r;   do_badsuccessor_check=  sP   




.z)MSLDAPClientConsole.do_badsuccessor_check)N)T)r   )F)r   r_   )r   )Nr   )r   )NTr  )Z__name__
__module____qualname__r'   rP   rS   rU   rV   r]   rg   rm   ro   rw   r   r   r   rK   r   r   r   r   r   r   r   r   r   r  r  r  r  r  r  r  r  r2  r6  r:  r>  rB  r\  r^  rb  rg  ri  rl  rp  ru  rz  r|  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r  r!  r#  rt   r'  r   r)  r,  r3  r   rI  rO  r:   r:   r:   r;   r$   2   s    

"

 n




	

'


A

**





"
!


?)



Rr$   c                    s  dd l }| jd urt| j}n| dkrtdddlm} ddlm} ddl	m
}m} || j}| }| jd urV| j}	| jdd urO| jd\}	}
||	|
d}n;|d	 d urt|d	 dkr||d	 |d	 |d	 |d
 d}| jdu r||d	 |d	 |jd|d	 |d
 d}ntdt||}t|}t| jdkr| jdu rtd d S |dg I d H }|du rd S | I d H  d S | jD ]+}|dkr| I d H   d S t|}||d |dd  I d H }|du r d S qd S )Nr   Windowsz,This function only works on Windows systems!r   )get_logon_info)MSLDAPTargetUniProtorG  )ipportlogonserverdnsdomainname)rW  r  dc_iprW  Ti|  )rW  r  protocolrX  r[  rW  z8Couldnt find logonserver! Are you connected to a domain?zNot starting interactive!loginFr   r   )platformr9   r$   systemr   asyauth.common.credentialsr   winacl.functions.highlevelrT  msldap.commons.targetrU  rV  get_sspiauthtypetargetr   r   r   ldapsCLIENT_SSL_TCPr   commandsno_interactiver>   _run_single_commandr  shlex)argsr^  clientr   rT  rU  rV  creduserinforW  rX  re  factoryr   commandr  r:   r:   r;   amaind  sl   







rr  c            	      C   sR  dd l } dd l}d}d}t||d}|t 7 }|d7 }| jd|d}|jdd	d
ddd |jdddd | dkrg|jdd}|jddd |jdd}|jdddd |jddd |jdddd n|jd dd |jd!d"d#d$ |	 }|j
dkrtjtjd% nttj ttj ttj tjtjd% tt| d S )&Nr   zgLDAP : basic LDAP protocol
	LDAPS: LDAP over SSL
	GC   : Global Catalog
	GCS  : Global Catalog over SSLa  ntlm     : SASL NTLM authentication
	kerberos : SASL Kerberos authentication
	sspi-ntlm: SSPI authentication using NTLM (Windows only, uses SASL)
	sspi-kerberos: SSPI authentication using Kerberos (Windows only, uses SASL)
	simple   : LDAP SIMPLE authentication
	plain    : PLAIN authentication
	sicily   : SICILY authentication
	ssl      : Authenticate with SSL certificate
	none     : No authentication, anonymous bind
	r_   a  
Examples:
All of the following examples show LDAP auth to the DC of TEST.corp domain at Win2019AD.test.corp(10.10.10.2)
Kerberos authentication needs the FQDN of the DC, so we use the 'dc' parameter to specify the DC.

Anonymous BIND:
	ldap://10.10.10.2
Username and password authentication using NTLM over plaintext LDAP:
	ldap+ntlm-password://TEST\victim:password@10.10.10.2
Username and password authentication using NTLM over SSL/TLS:
	ldaps+ntlm-password://TEST\victim:password@10.10.10.2
Username and password authentication using Kerberos over plaintext LDAP:
	ldap+kerberos-password://TEST\victim:password@<hostname>/?dc=10.10.10.2
Username and password authentication using Kerberos over SSL/TLS:
	ldaps+kerberos-password://TEST\victim:password@<hostname>/?dc=10.10.10.2
NTLM authentication using the NT hash over plaintext LDAP:
	ldap+ntlm-nt://TEST\victim:<NThash>@10.10.10.2
Kerberos authentication using the RC4 key over plaintext LDAP:
	ldap+kerberos-rc4://TEST\victim:<RC4key>@<hostname>/?dc=10.10.10.2
SICILY authentication using the NT hash over plaintext LDAP:
	ldap+sicily-nt://TEST\victim:<NThash>@10.10.10.2
Kerberos authentication using AES key over plaintext LDAP:
	ldap+kerberos-aes://TEST\victim:<AESkey>@<hostname>/?dc=10.10.10.2
Kerberos authentication using CCACHE file over plaintext LDAP:
	ldap+kerberos-ccache://TEST\victim:<CCACHEfile>@<hostname>/?dc=10.10.10.2
Kerberos authentication using keytab file over plaintext LDAP:
	ldap+kerberos-keytab://TEST\victim:<KEYTABfile>@<hostname>/?dc=10.10.10.2
Kerberos authentication using P12 or PFX file over plaintext LDAP (notice that keyfile password is at the 'password' filed):
	ldap+kerberos-pfx://TEST\victim:admin@<hostname>/?dc=10.10.10.2&keydata=<P12file>
SSL authentication using P12 or PFX file over plaintext LDAP, automatically performs STARTTLS:
	ldap+ssl://10.10.10.2/?sslcert=<P12file>&sslpassword=<P12password>'
SSL authentication using P12 or PFX file over SSL/TLS LDAP:
	ldaps+ssl://10.10.10.2/?sslcert=<P12file>&sslpassword=<P12password>'
zMS LDAP library)descriptionusagez-vz	--verbosecountzVerbosity, can be stacked)actiondefaulthelpz-nz--no-interactive
store_true)rv  rS  URL)titlez--urlz Connection string in URL format.)rx  zWithout URLz
--authtypentlm)rw  rx  z--targetzAddress of LDAP server.z--ldapsz	Use LDAPS)rv  rx  r9   rh  r   zTakes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.)nargsrx  r   )argparser^  r   get_helpr   ArgumentParseradd_argumentr_  add_argument_group
parse_argsverboser   basicConfigINFOsocksloggersetLevelDEBUGr   
authloggerasyncior  rr  )	r~  r^  	protocols
authprotosrt  parsergroupgroup2rl  r:   r:   r;   main  s6   
"
r  __main__)Gr  r*  r   importlib.utilr  r   r   r   rk  r  rL   r  r   asyauthr   r  r`  r   asysocksr  asysocks.unicomm.common.targetr   r   r   winacl.dtyp.acer   r	   r
   r   r   r   winacl.dtyp.aclr   winacl.dtyp.guidr   winacl.dtyp.security_descriptorr   r   winacl.dtyp.sidr   msldapmsldap.commons.factoryr   msldap.commons.pluginr    msldap.examples.utils.completersr   msldap.external.aiocmd.aiocmdr   #msldap.external.asciitree.asciitreer   msldap.ldap_objectsr   r   r   r   r   r   r   r   )msldap.ldap_objects.adcertificatetemplater    r!   r"   #msldap.wintypes.asn1.sdflagsrequestr#   r&   r$   rr  r  rP  r:   r:   r:   r;   <module>   sh    (              @<U
