././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/0000775000175000017500000000000014535076203012366 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/LICENSE0000664000175000017500000001056314531630505013375 0ustar00webdevwebdevThis projects contains two other project written by a 3rd party. All code is licensed under MIT. License for MSLDAP: MIT License Copyright (c) 2018 Tamas Jos (@skelsec) Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. License for "asciitree": Copyright (c) 2015 Marc Brinkmann Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. License for "aiocmd": MIT License Copyright (c) 2019 Dor Green Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. License for "Bloodhound.py": MIT License Copyright (c) 2018 Fox-IT Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/MANIFEST.in0000664000175000017500000000004214531630505014115 0ustar00webdevwebdevinclude LICENSE include README.md ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/PKG-INFO0000664000175000017500000000073514535076203013470 0ustar00webdevwebdevMetadata-Version: 2.1 Name: msldap Version: 0.5.9 Summary: Python library to play with MS LDAP Home-page: https://github.com/skelsec/msldap Author: Tamas Jos Author-email: info@skelsecprojects.com Classifier: Programming Language :: Python :: 3.7 Classifier: Programming Language :: Python :: 3.8 Classifier: License :: OSI Approved :: MIT License Classifier: Operating System :: OS Independent Requires-Python: >=3.7 License-File: LICENSE Python library to play with MS LDAP ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701388381.0 msldap-0.5.9/README.md0000664000175000017500000001136614532220135013644 0ustar00webdevwebdev![Supported Python versions](https://img.shields.io/badge/python-3.6+-blue.svg) [![Documentation Status](https://readthedocs.org/projects/msldap/badge/?version=latest)](https://msldap.readthedocs.io/en/latest/?badge=latest) [![Twitter](https://img.shields.io/twitter/follow/skelsec?label=skelsec&style=social)](https://twitter.com/intent/follow?screen_name=skelsec) ## :triangular_flag_on_post: Sponsors If you like this project, consider sponsoring it on GitHub! [Sponsors](https://github.com/sponsors/skelsec/) # msldap LDAP library for MS AD ![Documentation Status](https://user-images.githubusercontent.com/19204702/81515211-3761e880-9333-11ea-837f-bcbe2a67ee48.gif ) ## :triangular_flag_on_post: Sponsors If you want to sponsor this project, you can do it on GitHub now! # Documentation [Awesome documentation here!](https://msldap.readthedocs.io/en/latest/) # Features - Comes with a built-in console LDAP client - All parameters can be conrolled via a conveinent URL (see below) - Supports integrated windows authentication (SSPI) both with NTLM and with KERBEROS - Supports channel binding (for ntlm and kerberos not SSPI) - Supports encryption (for NTLM/KERBEROS/SSPI) - Supports LDAPS (TODO: actually verify certificate) - Supports SOCKS5 proxy withot the need of extra proxifyer - Minimal footprint - A lot of pre-built queries for convenient information polling - Easy to integrate to your project - No testing suite # Installation Via GIT `python3 setup.py install` OR `pip install msldap` # Prerequisites - `asn1crypto` module. Some LDAP queries incorporate ASN1 strucutres to be sent on top of the ASN1 transport XD - `asysocks` module. To support socks proxying. - `aiocmd` For the interactive client - `asciitree` For plotting nice trees in the interactive client # Usage Please note that this is a library, and was not intended to be used as a command line program. Whit this noted, the projects packs a fully functional LDAP interactive client. When installing the `msldap` module with `setup.py install` a new binary will appear called `msldap` (shocking naming conventions) # LDAP connection URL The major change was needed in version 0.2.0 to unify different connection options as one single string, without the need for additional command line switches. The new connection string is composed in the following manner: `+://\:@:/?=&=&...` Detailed explanation with examples: ``` +://:@://?= sets the ldap protocol following values supported: - ldap - ldaps - gc - gc_ssl can be omitted if plaintext authentication is to be performed (in that case it default to ntlm-password), otherwise: - ntlm-password - ntlm-nt - kerberos-password (dc option param must be used) - kerberos-rc4 / kerberos-nt (dc option param must be used) - kerberos-aes (dc option param must be used) - kerberos-keytab (dc option param must be used) - kerberos-ccache (dc option param must be used) - kerberos-pfx (dc option param must be used) - kerberos-pem (dc option param must be used) - kerberos-certstore (dc option param must be used, windows only) - sspi-ntlm (windows only!) - sspi-kerberos (windows only!) - anonymous - plain - simple - sicily (same format as ntlm-nt but using the SICILY authentication) : OPTIONAL. Specifies the root tree of all queries can be: - timeout : connction timeout in seconds - proxytype: currently only socks5 proxy is supported - proxyhost: Ip or hostname of the proxy server - proxyport: port of the proxy server - proxytimeout: timeout ins ecodns for the proxy connection - dc: the IP address of the domain controller, MUST be used for kerberos authentication Examples: ldap://10.10.10.2 (anonymous bind) ldaps://test.corp (anonymous bind) ldap+sspi-ntlm://test.corp ldap+sspi-kerberos://test.corp ldap://TEST\\victim:@10.10.10.2 (defaults to SASL GSSAPI NTLM) ldap+simple://TEST\\victim:@10.10.10.2 (SASL SIMPLE auth) ldap+plain://TEST\\victim:@10.10.10.2 (SASL SIMPLE auth) ldap+ntlm-password://TEST\\victim:@10.10.10.2 ldap+ntlm-nt://TEST\\victim:@10.10.10.2 ldap+kerberos-password://TEST\\victim:@10.10.10.2 ldap+kerberos-rc4://TEST\\victim:@10.10.10.2 ldap+kerberos-aes://TEST\\victim:@10.10.10.2 ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/ ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/?timeout=99&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080&proxytimeout=44 ``` # Kudos Certificate services functionality was based on [certi](https://github.com/zer1t0/certi) created by @zer1t0 AC-RN ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132866.9954085 msldap-0.5.9/msldap/0000775000175000017500000000000014535076203013646 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/__init__.py0000664000175000017500000000051414531630505015754 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import logging logger = logging.getLogger(__name__) handler = logging.StreamHandler() formatter = logging.Formatter( '%(asctime)s %(name)-12s %(levelname)-8s %(message)s') handler.setFormatter(formatter) logger.addHandler(handler) logger.setLevel(logging.INFO) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/__main__.py0000664000175000017500000000466014531630505015743 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import logging import csv from msldap.connection import MSLDAPClientConnection from msldap.commons.factory import LDAPConnectionFactory from msldap.ldap_objects import MSADUser, MSADMachine def run(): import argparse parser = argparse.ArgumentParser(description='MS LDAP library') parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') parser.add_argument('connection', help='Connection string in URL format.') parser.add_argument('--tree', help='LDAP tree to perform the searches on') subparsers = parser.add_subparsers(help = 'commands') subparsers.required = True subparsers.dest = 'command' dump_group = subparsers.add_parser('dump', help='Dump all user objects to TSV file') dump_group.add_argument('outfile', help='output file') spn_group = subparsers.add_parser('spn', help='Dump all users with servicePrincipalName attribute set to TSV file') spn_group.add_argument('outfile', help='output file') dsa_group = subparsers.add_parser('dsa', help='Grab basic info about the AD') args = parser.parse_args() ###### VERBOSITY if args.verbose == 0: logging.basicConfig(level=logging.INFO) else: logging.basicConfig(level=logging.DEBUG) url_dec = LDAPConnectionFactory.from_url(args.connection) creds = url_dec.get_credential() target = url_dec.get_target() print(str(creds)) print(str(target)) connection = MSLDAPClientConnection(creds, target) if args.command == 'dsa': print(connection.get_server_info()) elif args.command == 'dump': connection.connect() adinfo = connection.get_ad_info() with open(args.outfile, 'w', newline='', encoding = 'utf8') as f: writer = csv.writer(f, delimiter = '\t') writer.writerow(MSADUser.TSV_ATTRS) for user in connection.get_all_user_objects(): writer.writerow(user.get_row(MSADUser.TSV_ATTRS)) with open(args.outfile + '_comp', 'w', newline='', encoding = 'utf8') as f: writer = csv.writer(f, delimiter = '\t') writer.writerow(MSADMachine.TSV_ATTRS) for comp in connection.get_all_machine_objects(): writer.writerow(comp.get_row(MSADMachine.TSV_ATTRS)) elif args.command == 'spn': connection.connect() adinfo, err = connection.get_ad_info() with open(args.outfile, 'w', newline='', encoding = 'utf8') as f: for user in connection.get_all_service_user_objects(): f.write(user.sAMAccountName + '\r\n') if __name__ == '__main__': run() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/_version.py0000664000175000017500000000020014531630505016031 0ustar00webdevwebdev __version__ = "0.5.9" __banner__ = \ """ # msldap %s # Author: Tamas Jos @skelsec (info@skelsecprojects.com) """ % __version__././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702131765.0 msldap-0.5.9/msldap/bloodhound.py0000664000175000017500000006464614535074065016401 0ustar00webdevwebdevimport os import zipfile import json import base64 import datetime import asyncio from tqdm import tqdm from msldap.external.bloodhoundpy.acls import parse_binary_acl from msldap.external.bloodhoundpy.resolver import resolve_aces, WELLKNOWN_SIDS from msldap.external.bloodhoundpy.utils import parse_gplink_string, is_filtered_container, is_filtered_container_child, reverse_dn_components, explode_dn from msldap.commons.factory import LDAPConnectionFactory from msldap.connection import MSLDAPClientConnection from msldap.client import MSLDAPClient from msldap.commons.adexplorer import Snapshot from msldap import logger async def dummy_print(msg): print(msg) class MSLDAPDump2Bloodhound: def __init__(self, url: str or MSLDAPClient or LDAPConnectionFactory or MSLDAPClientConnection, progress = True, output_path = None, use_mp:bool=True, print_cb = None): self.debug = False self.ldap_url = url self.connection: MSLDAPClient = None self.ldapinfo = None self.domainname = None self.domainsid = None self.use_mp = use_mp self.mp_sdbatch_length = 5000 self.print_cb = print_cb self.with_progress = progress if self.print_cb is None: self.print_cb = dummy_print self.DNs = {} self.DNs_sorted = {} self.ocache = {} self.schema = {} self.aces = {} self.computer_sidcache = {} self.token_map = {} self.curdate = datetime.datetime.utcnow().strftime('%Y%m%dT%H%M%S') self.zipfilepath = '%s_Bloodhound.zip' % self.curdate if output_path is not None: self.zipfilepath = os.path.join(output_path, self.zipfilepath) self.zipfile = None self.MAX_ENTRIES_PER_FILE = 40000 self.totals = { 'user' : 0, 'computer' : 0, 'group' : 0, 'ou' : 0, 'gpo' : 0, 'container' : 0, 'domain' : 0, 'trust' : 0 } async def print(self, msg:str): await self.print_cb(msg) async def create_progress(self, label, total = None): if self.with_progress is True: return tqdm(desc = label, total=total) else: await self.print('[+] %s' % label) return None async def update_progress(self, pbar, value = 1): if pbar is None: return if self.with_progress is True: pbar.update(value) async def close_progress(self, pbar): if pbar is None: return if self.with_progress is True: pbar.close() def get_json_wrapper(self, enumtype): return { 'data' : [], 'meta': { 'methods' : 0, 'type': enumtype, 'version': 5, 'count': 0 } } def split_json(self, enumtype, data): if data['meta']['count'] <= self.MAX_ENTRIES_PER_FILE: yield data return #split the data for i in range(0, data['meta']['count'], self.MAX_ENTRIES_PER_FILE): jsonstruct = { 'data' : [], 'meta': { 'methods' : 0, 'type': enumtype, 'version': 5, 'count': 0 } } for entry in data['data'][i:i+self.MAX_ENTRIES_PER_FILE]: jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 yield jsonstruct async def write_json_to_zip(self, enumtype, data, filepart = 0): if filepart == 0: filename = '%s_%s.json' % (self.curdate, enumtype) else: filename = '%s_%s_%02d.json' % (self.curdate, enumtype, filepart) self.zipfile.writestr(filename, json.dumps(data)) async def lookup_dn_children(self, parent_dn): parent_dn = parent_dn.upper() parent_dn_reversed = reverse_dn_components(parent_dn) if parent_dn not in self.DNs: logger.debug('[BH] DN not found: %s' % parent_dn_reversed) return [] branch = self.DNs_sorted level = 0 for part in explode_dn(parent_dn_reversed): level += 1 if part not in branch: logger.debug('[BH] Part not found: %s Full: %s Branch: %s Level: %s Parts: %s' % (part, parent_dn_reversed, branch.keys(), level, explode_dn(parent_dn_reversed))) return [] branch = branch[part] res_dns = [] for dnpart in branch: res_dns.append(dnpart + ',' + parent_dn) results = [] for tdn in res_dns: if is_filtered_container_child(tdn): continue if tdn not in self.DNs: attrs, err = await self.connection.dnattrs(tdn, ['distinguishedName','objectGUID', 'objectClass','sAMAaccountType', 'sAMAccountName', 'objectSid', 'name']) if err is not None: raise err if attrs is None or len(attrs) == 0: logger.debug('[BH] Missing DN: %s' % tdn) continue res = self.resolve_entry(attrs) results.append({ 'ObjectIdentifier': res['objectid'].upper(), 'ObjectType': res['type'].capitalize(), }) continue entry = self.ocache[self.DNs[tdn]] results.append({ 'ObjectIdentifier': entry['ObjectIdentifier'].upper(), 'ObjectType': entry['ObjectType'].capitalize() if entry['ObjectType'].lower() != 'ou' else 'OU', }) return results async def dump_schema(self): pbar = await self.create_progress('Dumping schema') # manual stuff here... # https://learn.microsoft.com/en-us/windows/win32/adschema/c-foreignsecurityprincipal self.schema['foreignsecurityprincipal'] = '89e31c12-8530-11d0-afda-00c04fd930c9' async for entry, err in self.connection.get_all_schemaentry(['name', 'schemaIDGUID']): if err is not None: raise err await self.update_progress(pbar) self.schema[entry.name.lower()] = str(entry.schemaIDGUID) await self.close_progress(pbar) def add_ocache(self, dn, objectid, principal, otype, dns = '', spns = None): self.totals[otype] += 1 if objectid in WELLKNOWN_SIDS: objectid = '%s-%s' % (self.domainname.upper(), objectid.upper()) self.ocache[objectid] = { 'dn' : dn.upper(), 'ObjectIdentifier' : objectid, 'principal' : principal, 'ObjectType' : otype, } self.DNs[dn.upper()] = objectid if otype == 'computer': entry = { 'ObjectIdentifier' : objectid, 'ObjectType' : otype } if dns is None: dns = '' self.computer_sidcache[dns.lower()] = entry if spns is not None: for spn in spns: target = spn.split('/')[1] target = target.split(':')[0] self.computer_sidcache[target.lower()] = entry def resolve_entry(self, entry): # I really REALLY did not want to implement this resolved = {} account = entry.get('sAMAccountName', '') dn = entry.get('distinguishedName', '') resolved['objectid'] = entry.get('objectSid', '') resolved['principal'] = ('%s@%s' % (account, self.domainname)).upper() if 'sAMAaccountName' in entry: accountType = entry['sAMAccountType'] object_class = entry['objectClass'] if accountType in [268435456, 268435457, 536870912, 536870913]: resolved['type'] = 'Group' elif accountType in [805306368] or \ 'msDS-GroupManagedServiceAccount' in object_class or \ 'msDS-ManagedServiceAccount' in object_class: resolved['type'] = 'User' elif accountType in [805306369]: resolved['type'] = 'Computer' short_name = account.rstrip('$') resolved['principal'] = ('%s.%s' % (short_name, self.domainname)).upper() elif accountType in [805306370]: resolved['type'] = 'trustaccount' else: resolved['type'] = 'Domain' return resolved if 'objectGUID' in entry: resolved['objectid'] = entry['objectGUID'] resolved['principal'] = ('%s@%s' % (entry.get('name', ''), self.domainname)).upper() object_class = entry.get('objectClass', []) if 'organizationalUnit' in object_class: resolved['type'] = 'OU' elif 'container' in object_class: resolved['type'] = 'Container' else: resolved['type'] = 'Base' return resolved async def dump_lookuptable(self): pbar = await self.create_progress('Generating lookuptable') # domains adinfo, err = await self.connection.get_ad_info() if err is not None: raise err self.domainsid = adinfo.objectSid self.add_ocache(adinfo.distinguishedName, adinfo.objectSid, '', 'domain') await self.update_progress(pbar) #trusts async for entry, err in self.connection.get_all_trusts(['distinguishedName', 'objectSid', 'objectGUID']): if err is not None: raise err self.add_ocache(entry.distinguishedName, entry.objectGUID, '', 'trust') await self.update_progress(pbar) #users async for entry, err in self.connection.get_all_users(['distinguishedName', 'objectSid', 'objectGUID', 'sAMAccountName']): if err is not None: raise err short_name = entry.sAMAccountName self.add_ocache(entry.distinguishedName, entry.objectSid, ('%s@%s' % (short_name, self.domainname)).upper(), 'user') await self.update_progress(pbar) #machines async for entry, err in self.connection.get_all_machines(['distinguishedName', 'objectSid', 'objectGUID', 'sAMAccountName', 'dNSHostName', 'servicePrincipalName']): if err is not None: raise err short_name = entry.sAMAccountName dns = entry.dNSHostName if dns is None: dns = '' self.add_ocache(entry.distinguishedName, entry.objectSid, ('%s@%s' % (short_name, self.domainname)).upper(), 'computer', dns, entry.servicePrincipalName) await self.update_progress(pbar) #groups async for entry, err in self.connection.get_all_groups(['distinguishedName', 'objectSid', 'objectGUID']): if err is not None: raise err self.add_ocache(entry.distinguishedName, entry.objectSid, '', 'group') await self.update_progress(pbar) #ous async for entry, err in self.connection.get_all_ous(['distinguishedName', 'objectSid', 'objectGUID']): if err is not None: raise err self.add_ocache(entry.distinguishedName, entry.objectGUID, '', 'ou') await self.update_progress(pbar) #containers async for entry, err in self.connection.get_all_containers(['distinguishedName', 'objectSid', 'objectGUID']): if err is not None: raise err if is_filtered_container(entry.distinguishedName): continue self.add_ocache(entry.distinguishedName, entry.objectGUID, '', 'container') await self.update_progress(pbar) #gpos async for entry, err in self.connection.get_all_gpos(['distinguishedName', 'objectSid', 'objectGUID']): if err is not None: raise err self.add_ocache(entry.distinguishedName, entry.objectGUID, '', 'gpo') await self.update_progress(pbar) #foreignsecurityprincipal async for entry, err in self.connection.get_all_foreignsecurityprincipals(['name','sAMAccountName', 'objectSid', 'objectGUID', 'distinguishedName', 'objectClass']): bhentry = {} entry = entry['attributes'] if 'container' in entry.get('objectClass', []) is True: continue if entry['objectSid'] in WELLKNOWN_SIDS: bhentry['objectid'] = '%s-%s' % (self.domainname.upper(), entry['objectSid'].upper()) bhentry['principal'] = self.domainname.upper() bhentry['type'] = 'foreignsecurityprincipal' if 'name' in entry: if entry['name'] in WELLKNOWN_SIDS: gname, sidtype = WELLKNOWN_SIDS[entry['name']] bhentry['type'] = sidtype.capitalize() bhentry['principal'] = '%s@%s' % (gname.upper(), self.domainname.upper()) bhentry['objectid'] = '%s-%s' % (self.domainname.upper(), entry['objectSid'].upper()) else: bhentry['objectid'] = entry['name'] self.ocache[bhentry['objectid']] = { 'dn' : entry['distinguishedName'].upper(), 'ObjectIdentifier' : bhentry['objectid'], 'principal' : bhentry['principal'], 'ObjectType' : bhentry['type'], } self.DNs[entry['distinguishedName'].upper()] = bhentry['objectid'] await self.close_progress(pbar) for dn in [reverse_dn_components(dn) for dn in self.DNs]: branch = self.DNs_sorted for part in explode_dn(dn): if part not in branch: branch[part.upper()] = {} branch = branch[part.upper()] if self.debug is True: with open('dn.json', 'w') as f: json.dump(self.DNs, f, indent=4) with open('dntree.json', 'w') as f: json.dump(self.DNs_sorted, f, indent=4) async def dump_acls(self): sdbatch = [] tasks = [] pbar = await self.create_progress('Dumping SDs', total=len(self.ocache)) for sid in self.ocache: dn = self.ocache[sid]['dn'] secdesc, err = await self.connection.get_objectacl_by_dn(dn) if err is not None: raise err dn = dn.upper() oentry = { 'IsACLProtected' : None, 'Properties' : { 'haslaps' : 'ms-mcs-admpwd' in self.schema } } otype = self.ocache[sid]['ObjectType'] if otype == 'trust': continue if otype == 'ou': otype = 'organizational-unit' if dn.upper() not in self.aces: if self.use_mp is True: from concurrent.futures import ProcessPoolExecutor sdbatch.append((dn, oentry, otype.lower(), secdesc, self.schema)) if len(sdbatch) > self.mp_sdbatch_length: loop = asyncio.get_running_loop() with ProcessPoolExecutor() as executor: for sde in sdbatch: tasks.append(loop.run_in_executor(executor, parse_binary_acl, *sde)) results = await asyncio.gather(*tasks) for dn, aces, relations in results: self.aces[dn.upper()] = (aces, relations) sdbatch = [] tasks = [] else: dn, aces, relations = parse_binary_acl(dn, oentry, otype.lower(), secdesc, self.schema) self.aces[dn.upper()] = (aces, relations) await self.update_progress(pbar) if len(sdbatch) != 0: loop = asyncio.get_running_loop() with ProcessPoolExecutor() as executor: for sde in sdbatch: tasks.append(loop.run_in_executor(executor, parse_binary_acl, *sde)) results = await asyncio.gather(*tasks) for dn, aces, relations in results: self.aces[dn.upper()] = (aces, relations) sdbatch = [] tasks = [] await self.close_progress(pbar) async def resolve_gplink(self, gplinks): if gplinks is None: return [] links = [] for gplink_dn, options in parse_gplink_string(gplinks): link = {} link['IsEnforced'] = options == 2 gplink_dn = gplink_dn.upper() if gplink_dn in self.DNs: lguid = self.ocache[self.DNs[gplink_dn]]['ObjectIdentifier'] else: attrs, err = await self.connection.dnattrs(gplink_dn.upper(), ['objectGUID', 'objectSid']) if err is not None: raise err if attrs is None or len(attrs) == 0: logger.debug('[BH] Missing DN: %s' % gplink_dn) continue try: lguid = attrs['objectGUID'] except: logger.debug('[BH] Missing GUID for %s' % gplink_dn) continue link['GUID'] = lguid.upper() links.append(link) return links def remove_hidden(self, entry): to_del = [] for k in entry: if k.startswith('_'): to_del.append(k) for k in to_del: del entry[k] return entry async def dump_domains(self): pbar = await self.create_progress('Dumping domains', self.totals['domain']) adinfo, err = await self.connection.get_ad_info() if err is not None: raise err domainentry = adinfo.to_bh(self.domainname) meta, relations = self.aces[domainentry['Properties']['distinguishedname'].upper()] domainentry['IsACLProtected'] = meta['IsACLProtected'] domainentry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) domainentry['ChildObjects'] = await self.lookup_dn_children(domainentry['Properties']['distinguishedname']) domainentry['Links'] = await self.resolve_gplink(domainentry['_gPLink']) jsonstruct = self.get_json_wrapper('domains') filectr = 0 async for entry, err in self.connection.get_all_trusts(): if err is not None: raise err domainentry['Trusts'].append(entry.to_bh()) domainentry = self.remove_hidden(domainentry) jsonstruct['data'].append(domainentry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('domains', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('domains') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('domains', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('domains.json', 'w') as f: json.dump(jsonstruct, f) async def dump_users(self): pbar = await self.create_progress('Dumping users', self.totals['user']) jsonstruct = self.get_json_wrapper('users') filectr = 0 async for ldapentry, err in self.connection.get_all_users(): if err is not None: raise err entry = ldapentry.to_bh(self.domainname) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) if entry['_allowerdtodelegateto'] is not None: seen = {} for host in entry['_allowerdtodelegateto']: try: target = host.split('/')[1] target = target.split(':')[0] except IndexError: logger.debug('[BH] Invalid delegation target: %s', host) continue try: sid = self.computer_sidcache[target.lower()] if sid['ObjectIdentifier'] in seen: continue seen[sid['ObjectIdentifier']] = 1 entry['AllowedToDelegate'].append(sid) except KeyError: if '.' in target: entry['AllowedToDelegate'].append(target.upper()) entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('users', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('users') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('users', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('users.json', 'w') as f: json.dump(jsonstruct, f) async def dump_computers(self): pbar = await self.create_progress('Dumping computers', self.totals['computer']) jsonstruct = self.get_json_wrapper('computers') filectr = 0 async for ldapentry, err in self.connection.get_all_machines(): entry = ldapentry.to_bh(self.domainname) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) if entry['_allowedtoactonbehalfofotheridentity'] is not None: allowedacl = base64.b64decode(entry['_allowedtoactonbehalfofotheridentity']) _, entryres, relations = parse_binary_acl(entry['Properties']['distinguishedname'].upper(), entry, 'computer', allowedacl, self.schema) for ace in resolve_aces(relations, self.domainname, self.domainsid, self.ocache): if ace['RightName'] == 'Owner': continue if ace['RightName'] == 'GenericAll': entryres['AllowedToAct'].append({ 'ObjectIdentifier': ace['PrincipalSID'], 'ObjectType': ace['PrincipalType'].capitalize() }) del entry['_allowedtoactonbehalfofotheridentity'] if entry['Properties']['allowedtodelegate'] is not None: seen = {} for host in entry['Properties']['allowedtodelegate']: try: target = host.split('/')[1] target = target.split(':')[0] except IndexError: logger.debug('[BH] Invalid delegation target: %s', host) continue try: sid = self.computer_sidcache[target.lower()] if sid['ObjectIdentifier'] in seen: continue seen[sid['ObjectIdentifier']] = 1 entry['AllowedToDelegate'].append(sid) except KeyError: if '.' in target: entry['AllowedToDelegate'].append({ "ObjectIdentifier": target.upper(), "ObjectType": "Computer" }) entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('computers', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('computers') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('computers', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('computers.json', 'w') as f: json.dump(jsonstruct, f) async def dump_groups(self): pbar = await self.create_progress('Dumping groups', self.totals['group']) jsonstruct = self.get_json_wrapper('groups') filectr = 0 async for ldapentry, err in self.connection.get_all_groups(): entry = ldapentry.to_bh(self.domainname) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) if ldapentry.member is not None: for member in ldapentry.member: if member.upper() in self.DNs: oid = self.DNs[member.upper()] entry['Members'].append({ 'ObjectIdentifier' : self.ocache[oid]['ObjectIdentifier'], 'ObjectType' : self.ocache[oid]['ObjectType'].capitalize() }) else: if member.find('ForeignSecurityPrincipals') != -1: continue entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('groups', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('groups') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('groups', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('groups.json', 'w') as f: json.dump(jsonstruct, f) async def dump_gpos(self): pbar = await self.create_progress('Dumping GPOs', self.totals['gpo']) jsonstruct = self.get_json_wrapper('gpos') filectr = 0 async for ldapentry, err in self.connection.get_all_gpos(): entry = ldapentry.to_bh(self.domainname, self.domainsid) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('gpos', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('gpos') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('gpos', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('gpos.json', 'w') as f: json.dump(jsonstruct, f) async def dump_ous(self): pbar = await self.create_progress('Dumping OUs', self.totals['ou']) jsonstruct = self.get_json_wrapper('ous') filectr = 0 async for ldapentry, err in self.connection.get_all_ous(): if err is not None: raise err entry = ldapentry.to_bh(self.domainname, self.domainsid) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) entry['ChildObjects'] = await self.lookup_dn_children(entry['Properties']['distinguishedname']) entry['Links'] = await self.resolve_gplink(entry['_gPLink']) entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('ous', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('ous') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('ous', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('ous.json', 'w') as f: json.dump(jsonstruct, f) async def dump_containers(self): pbar = await self.create_progress('Dumping Containers', self.totals['container']) jsonstruct = self.get_json_wrapper('containers') filectr = 0 async for ldapentry, err in self.connection.get_all_containers(): if err is not None: raise err if is_filtered_container(ldapentry.distinguishedName): continue entry = ldapentry.to_bh(self.domainname, self.domainsid) meta, relations = self.aces[entry['Properties']['distinguishedname'].upper()] entry['IsACLProtected'] = meta['IsACLProtected'] entry['Aces'] = resolve_aces(relations, self.domainname, self.domainsid, self.ocache) entry['ChildObjects'] = await self.lookup_dn_children(entry['Properties']['distinguishedname']) entry = self.remove_hidden(entry) jsonstruct['data'].append(entry) jsonstruct['meta']['count'] += 1 if jsonstruct['meta']['count'] == self.MAX_ENTRIES_PER_FILE: await self.write_json_to_zip('containers', jsonstruct, filectr) jsonstruct = self.get_json_wrapper('containers') filectr += 1 await self.update_progress(pbar) if jsonstruct['meta']['count'] > 0: await self.write_json_to_zip('containers', jsonstruct, filectr) await self.close_progress(pbar) if self.debug is True: with open('containers.json', 'w') as f: json.dump(jsonstruct, f) async def dump_ldap(self): if isinstance(self.ldap_url, str): if self.ldap_url.startswith('adexplorer://'): self.ldap_url = self.ldap_url[13:] await self.print('[+] Parsing ADEXPLORER Snapshot...') self.connection = await Snapshot.from_file(self.ldap_url) self.ldap_url = self.connection await self.print('[+] Parsing done!') if isinstance(self.ldap_url, Snapshot) is False: if isinstance(self.ldap_url, str): factory = LDAPConnectionFactory.from_url(self.ldap_url) self.connection = factory.get_client() self.connection.keepalive = True if isinstance(self.ldap_url, LDAPConnectionFactory): self.connection = self.ldap_url.get_client() self.connection.keepalive = True if isinstance(self.ldap_url, MSLDAPClient): self.connection = self.ldap_url if isinstance(self.ldap_url, MSLDAPClientConnection): self.connection = MSLDAPClient(None, None, connection = self.ldap_url) await self.print('[+] Connecting to LDAP server') self.connection.keepalive = True _, err = await self.connection.connect() if err is not None: raise err await self.print('[+] Connected to LDAP serrver') self.ldapinfo = self.connection.get_server_info() self.domainname = self.ldapinfo['defaultNamingContext'].upper().replace('DC=','').replace(',','.') else: self.domainname = self.connection.rootdomain.upper().replace('DC=','').replace(',','.') await self.dump_schema() await self.dump_lookuptable() await self.dump_acls() with zipfile.ZipFile(self.zipfilepath, 'w', zipfile.ZIP_DEFLATED) as self.zipfile: await self.dump_domains() await self.dump_users() await self.dump_computers() await self.dump_groups() await self.dump_gpos() await self.dump_ous() await self.dump_containers() async def run(self): await self.dump_ldap()././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701811480.0 msldap-0.5.9/msldap/client.py0000664000175000017500000017242214533712430015503 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import copy import asyncio import string import random from typing import List, Dict, Tuple from msldap import logger from msldap.commons.common import MSLDAPClientStatus from msldap.wintypes.asn1.sdflagsrequest import SDFlagsRequest, SDFlagsRequestValue from msldap.protocol.constants import BASE, ALL_ATTRIBUTES, LEVEL from msldap.protocol.query import escape_filter_chars from msldap.connection import MSLDAPClientConnection from msldap.protocol.messages import Control from msldap.ldap_objects import * from msldap.commons.utils import KNOWN_SIDS from msldap.commons.target import MSLDAPTarget from msldap.wintypes.dnsp.strcutures import DNS_RECORD from msldap.commons.exceptions import LDAPSearchException from asyauth.common.credentials import UniCredential from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR from winacl.dtyp.ace import ACCESS_ALLOWED_OBJECT_ACE, ADS_ACCESS_MASK from winacl.dtyp.sid import SID from winacl.dtyp.guid import GUID class MSLDAPClient: """ High level API for LDAP operations. target, creds, ldap_query_page_size :param target: The target object describing the connection info :type target: :class:`MSLDAPTarget` :param creds: The credential object describing the authentication to be used :type creds: :class:`MSLDAPCredential` :param ldap_query_page_size: :type ldap_query_page_size: int :return: A dictionary representing the LDAP tree :rtype: dict """ def __init__(self, target:MSLDAPTarget, creds:UniCredential, connection = None, keepalive = False): self.creds = creds self.target = target self.keepalive = keepalive self.ldap_query_page_size = 1000 if self.target is not None: self.ldap_query_page_size = self.target.ldap_query_page_size self.ldap_query_ratelimit = 0 if self.target is not None: self.ldap_query_ratelimit = self.target.ldap_query_ratelimit self._tree = None self._ldapinfo = None self._con = connection self.__keepalive_task = None self.keepalive_period = 10 self.disconnected_evt = None self._sid_cache = {} #SID -> (domain, user) self._domainsid_cache = {} # SID -> domain async def __aenter__(self): return self async def __aexit__(self, exc_type, exc, traceback): await asyncio.wait_for(self.disconnect(), timeout = 1) async def __keepalive(self, temptree): try: while not self.disconnected_evt.is_set(): if self._con is not None: ldap_filter = r'(distinguishedName=%s)' % temptree async for entry, err in self.pagedsearch(ldap_filter, MSADInfo_ATTRS): if err is not None: return None, err await asyncio.sleep(self.keepalive_period) except asyncio.CancelledError: return except Exception as e: print('Keepalive exception: %s' % e) await self.disconnect() async def disconnect(self): try: if self.__keepalive_task is not None: self.__keepalive_task.cancel() if self._con is not None: await self._con.disconnect() self.disconnected_evt.set() except Exception as e: return False, e async def connect(self): try: self.disconnected_evt = asyncio.Event() if self._con is None: self._con = MSLDAPClientConnection(self.target, self.creds) _, err = await self._con.connect() if err is not None: raise err if self._con.is_anon is False: res, err = await self._con.bind() if err is not None: return False, err else: logger.debug('Skipping bind for no auth!') res, err = await self._con.get_serverinfo() if err is not None: raise err self._serverinfo = res self._tree = res['defaultNamingContext'] self._ldapinfo, err = await self.get_ad_info() if self._con.is_anon is False: if err is not None: raise err self._domainsid_cache[self._ldapinfo.objectSid] = self._ldapinfo.name if self.keepalive is True: self.__keepalive_task = asyncio.create_task(self.__keepalive(res['defaultNamingContext'])) return True, None except Exception as e: return False, e def get_server_info(self): return self._serverinfo async def pagedsearch(self, query:str, attributes:List[str], controls:List[Tuple[str, str, str]] = None, tree:str = None, search_scope:int=2): """ Performs a paged search on the AD, using the filter and attributes as a normal query does. !The LDAP connection MUST be active before invoking this function! :param query: LDAP query filter :type query: str :param attributes: List of requested attributes :type attributes: List[str] :param controls: additional controls to be passed in the query :type controls: dict :param tree: Base tree to perform the search on :type tree: str :param search_scope: LDAP search scope :type search_scope: int :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ logger.debug('Paged search, filter: %s attributes: %s' % (query, ','.join(attributes))) if self._con.status != MSLDAPClientStatus.RUNNING: if self._con.status == MSLDAPClientStatus.ERROR: print('There was an error in the connection!') return if tree is None: tree = self._tree if tree is None: raise Exception('BIND first!') t = [] for x in attributes: t.append(x.encode()) attributes = t t = [] if controls is not None: for control in controls: t.append(Control({ 'controlType': control[0].encode(), 'criticality': control[1], 'controlValue': control[2] })) controls = t async for entry, err in self._con.pagedsearch( tree, query, attributes = attributes, size_limit = self.ldap_query_page_size, controls = controls, rate_limit=self.ldap_query_ratelimit, search_scope=search_scope ): if err is not None: yield None, err return if entry['objectName'] == '' and entry['attributes'] == '': #searchresref... continue #print('et %s ' % entry) yield entry, None async def get_tree_plot(self, root_dn:str, level:int = 2): """ Returns a dictionary representing a tree starting from 'dn' containing all subtrees. :param root_dn: The start DN of the tree :type root_dn: str :param level: Recursion level :type level: int :return: A dictionary representing the LDAP tree :rtype: dict """ logger.debug('Tree, dn: %s level: %s' % (root_dn, level)) tree = {} async for entry, err in self._con.pagedsearch( root_dn, '(distinguishedName=*)', attributes = [b'distinguishedName'], size_limit = self.ldap_query_page_size, search_scope=LEVEL, controls = None, rate_limit=self.ldap_query_ratelimit ): if err is not None: raise err if level == 0: return {} #print(entry) #print(entry['attributes']['distinguishedName']) if 'distinguishedName' not in entry['attributes'] or entry['attributes']['distinguishedName'] is None or entry['attributes']['distinguishedName'] == []: continue subtree = await self.get_tree_plot(entry['attributes']['distinguishedName'], level = level -1) tree[entry['attributes']['distinguishedName']] = subtree return {root_dn : tree} async def get_all_users(self, attrs:List[str] = MSADUser_ATTRS): """ Fetches all user objects available in the LDAP tree and yields them as MSADUser object. :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] """ logger.debug('Polling AD for all user objects') ldap_filter = r'(sAMAccountType=805306368)' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADUser.from_ldap(entry, self._ldapinfo), None logger.debug('Finished polling for entries!') async def get_all_machines(self, attrs:List[str] = MSADMachine_ATTRS): """ Fetches all machine objects available in the LDAP tree and yields them as MSADMachine object. :param attrs: Lists of attributes to request (eg. `['sAMAccountName', 'dNSHostName']`) Default: all attrs. :type attrs: list :return: Async generator which yields (`MSADMachine`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADMachine`, :class:`Exception`)] """ logger.debug('Polling AD for all user objects') ldap_filter = r'(sAMAccountType=805306369)' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADMachine.from_ldap(entry, self._ldapinfo), None logger.debug('Finished polling for entries!') async def get_all_gpos(self, attrs:List[str] = MSADGPO_ATTRS): """ Fetches all GPOs available in the LDAP tree and yields them as MSADGPO object. :return: Async generator which yields (`MSADGPO`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADGPO`, :class:`Exception`)] """ ldap_filter = r'(objectCategory=groupPolicyContainer)' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADGPO.from_ldap(entry), None async def get_all_containers(self, attrs:List[str] = MSADContainer_ATTRS): """ Fetches all container objects available in the LDAP tree and yields them as MSADContainer object. :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] """ logger.debug('Polling AD for all container objects') ldap_filter = r'(&(objectCategory=container)(objectClass=container))' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADContainer.from_ldap(entry), None #self._ldapinfo logger.debug('Finished polling for entries!') async def get_all_foreignsecurityprincipals(self, attrs:List[str]): ldap_filter = r'(&(objectClass=foreignSecurityPrincipal)(objectCategory=foreignSecurityPrincipal))' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield entry, None async def get_all_laps(self): """ Fetches all LAPS passwords for all machines. This functionality is only available to specific high-privileged users. :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ ldap_filter = r'(sAMAccountType=805306369)' attributes = ['cn','ms-mcs-AdmPwd'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err async def get_all_laps_windows(self): """ Fetches all LAPS passwords for all machines. This functionality is only available to specific high-privileged users. :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ ldap_filter = r'(sAMAccountType=805306369)' # first try to get the plaintext password (the new windows laps doesn't necessary encrypt the PWs) attributes = ['cn','msLAPS-Password'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err # now try to get the encrypted password attributes = ['cn','msLAPS-EncryptedPassword'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err # now try to get the encrypted password history attributes = ['cn','msLAPS-EncryptedPasswordHistory'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err # now try to get the encrypted DSRM password attributes = ['cn','msLAPS-EncryptedDSRMPassword'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err # now try to get the encrypted DSRM password history attributes = ['cn','msLAPS-EncryptedDSRMPasswordHistory'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err async def get_schemaentry(self, dn:str): """ Fetches one Schema entriy identified by dn :return: (`MSADSchemaEntry`, None) tuple on success or (None, `Exception`) on error :rtype: (:class:`MSADSchemaEntry`, :class:`Exception`) """ logger.debug('Polling Schema entry for %s'% dn) async for entry, err in self._con.pagedsearch( dn, r'(distinguishedName=%s)' % escape_filter_chars(dn), attributes = [x.encode() for x in MSADSCHEMAENTRY_ATTRS], size_limit = self.ldap_query_page_size, search_scope=BASE, controls = None, ): if err is not None: raise err return MSADSchemaEntry.from_ldap(entry), None else: return None, None logger.debug('Finished polling for entries!') async def get_all_schemaentry(self, attrs:List[str] = MSADSCHEMAENTRY_ATTRS): """ Fetches all Schema entries under CN=Schema,CN=Configuration,... :return: Async generator which yields (`MSADSchemaEntry`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADSchemaEntry`, :class:`Exception`)] """ res = await self.get_tree_plot(self._serverinfo['schemaNamingContext'], level = 1) for x in res: for dn in res[x]: async for entry, err in self._con.pagedsearch( dn, r'(distinguishedName=%s)' % escape_filter_chars(dn), attributes = [x.encode() for x in attrs], size_limit = self.ldap_query_page_size, search_scope=BASE, controls = None, rate_limit=self.ldap_query_ratelimit ): if err is not None: yield None, err return yield MSADSchemaEntry.from_ldap(entry), None break else: yield None, None logger.debug('Finished polling for entries!') async def get_laps(self, sAMAccountName:str): """ Fetches the LAPS password for a machine. This functionality is only available to specific high-privileged users. :param sAMAccountName: The username of the machine (eg. `COMP123$`). :type sAMAccountName: str :return: Laps attributes as a `dict` :rtype: (:class:`dict`, :class:`Exception`) """ ldap_filter = r'(&(sAMAccountType=805306369)(sAMAccountName=%s))' % sAMAccountName attributes = ['cn','ms-mcs-AdmPwd'] async for entry, err in self.pagedsearch(ldap_filter, attributes): return entry, err async def get_user(self, sAMAccountName:str): """ Fetches one user object from the AD, based on the sAMAccountName attribute (read: username) :param sAMAccountName: The username of the user. :type sAMAccountName: str :return: A tuple with the user as `MSADUser` and an `Exception` is there was any :rtype: (:class:`MSADUser`, :class:`Exception`) """ logger.debug('Polling AD for user %s'% sAMAccountName) ldap_filter = r'(&(objectClass=user)(sAMAccountName=%s))' % sAMAccountName async for entry, err in self.pagedsearch(ldap_filter, MSADUser_ATTRS): if err is not None: return None, err return MSADUser.from_ldap(entry, self._ldapinfo), None else: return None, None logger.debug('Finished polling for entries!') async def get_machine(self, sAMAccountName:str): """ Fetches one machine object from the AD, based on the sAMAccountName attribute (read: username) :param sAMAccountName: The username of the machine. :type sAMAccountName: str :return: A tuple with the user as `MSADMachine` and an `Exception` is there was any :rtype: (:class:`MSADMachine`, :class:`Exception`) """ logger.debug('Polling AD for user %s'% sAMAccountName) ldap_filter = r'(&(sAMAccountType=805306369)(sAMAccountName=%s))' % sAMAccountName async for entry, err in self.pagedsearch(ldap_filter, MSADMachine_ATTRS): if err is not None: return None, err return MSADMachine.from_ldap(entry, self._ldapinfo), None else: return None, None logger.debug('Finished polling for entries!') async def get_ad_info(self): """ Polls for basic AD information (needed for determine password usage characteristics!) :return: A tuple with the domain information as `MSADInfo` and an `Exception` is there was any :rtype: (:class:`MSADInfo`, :class:`Exception`) """ logger.debug('Polling AD for basic info') ldap_filter = r'(distinguishedName=%s)' % self._tree async for entry, err in self.pagedsearch(ldap_filter, MSADInfo_ATTRS): if err is not None: return None, err self._ldapinfo = MSADInfo.from_ldap(entry) return self._ldapinfo, None logger.debug('Poll finished!') async def get_all_spn_entries(self): """ Fetches all service user objects from the AD, and returns MSADUser object. Service user refers to an user with SPN (servicePrincipalName) attribute set :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields tuples with a string in SPN format and an Exception if there was any :rtype: Iterator[(:class:`str`, :class:`Exception`)] """ logger.debug('Polling AD for all SPN entries') ldap_filter = r'(&(sAMAccountType=805306369))' attributes = ['objectSid','sAMAccountName', 'servicePrincipalName'] async for entry, err in self.pagedsearch(ldap_filter, attributes): yield entry, err async def get_all_service_users(self, include_machine:bool = False): """ Fetches all service user objects from the AD, and returns MSADUser object. Service user refers to an user with SPN (servicePrincipalName) attribute set :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] """ logger.debug('Polling AD for all user objects, machine accounts included: %s'% include_machine) if include_machine == True: ldap_filter = r'(servicePrincipalName=*)' else: ldap_filter = r'(&(servicePrincipalName=*)(!(sAMAccountName=*$)))' async for entry, err in self.pagedsearch(ldap_filter, MSADUser_ATTRS): if err is not None: yield None, err return yield MSADUser.from_ldap(entry, self._ldapinfo), None logger.debug('Finished polling for entries!') async def get_all_knoreq_users(self, include_machine:bool = False): """ Fetches all user objects with useraccountcontrol DONT_REQ_PREAUTH flag set from the AD, and returns MSADUser object. :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] """ logger.debug('Polling AD for all user objects, machine accounts included: %s'% include_machine) if include_machine == True: ldap_filter = r'(userAccountControl:1.2.840.113556.1.4.803:=4194304)' else: ldap_filter = r'(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(sAMAccountName=*$)))' async for entry, err in self.pagedsearch(ldap_filter, MSADUser_ATTRS): if err is not None: yield None, err return yield MSADUser.from_ldap(entry, self._ldapinfo), None logger.debug('Finished polling for entries!') async def get_objectacl_by_dn_p(self, dn:str, flags:SDFlagsRequest = SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION): """ Returns the full or partial Security Descriptor of the object specified by it's DN. The flags indicate which part of the security Descriptor to be returned. By default the full SD info is returned. :param object_dn: The object's DN :type object_dn: str :param flags: Flags indicate the data type to be returned. :type flags: :class:`SDFlagsRequest` :return: :rtype: :class:`MSADSecurityInfo` """ req_flags = SDFlagsRequestValue({'Flags' : flags}) ldap_filter = r'(distinguishedName=%s)' % escape_filter_chars(dn) attributes = MSADSecurityInfo.ATTRS controls = [('1.2.840.113556.1.4.801', True, req_flags.dump())] async for entry, err in self.pagedsearch(ldap_filter, attributes, controls = controls): if err is not None: yield None, err return yield MSADSecurityInfo.from_ldap(entry), None async def get_objectacl_by_dn(self, dn:str, flags:SDFlagsRequest = SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION): """ Returns the full or partial Security Descriptor of the object specified by it's DN. The flags indicate which part of the security Descriptor to be returned. By default the full SD info is returned. :param object_dn: The object's DN :type object_dn: str :param flags: Flags indicate the data type to be returned. :type flags: :class:`SDFlagsRequest` :return: nTSecurityDescriptor attribute of the object as `bytes` and an `Exception` is there was any :rtype: (:class:`bytes`, :class:`Exception`) """ req_flags = SDFlagsRequestValue({'Flags' : flags}) ldap_filter = r'(distinguishedName=%s)' % escape_filter_chars(dn) attributes = ['nTSecurityDescriptor'] controls = [('1.2.840.113556.1.4.801', True, req_flags.dump())] async for entry, err in self.pagedsearch(ldap_filter, attributes, controls = controls): if err is not None: return None, err return entry['attributes'].get('nTSecurityDescriptor'), None return None, None async def set_objectacl_by_dn(self, object_dn:str, data:bytes, flags:SDFlagsRequest = SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION): """ Updates the security descriptor of the LDAP object :param object_dn: The object's DN :type object_dn: str :param data: The actual data as bytearray to be updated in the Security Descriptor of the specified object :type data: bytes :param flags: Flags indicate the data type to be updated. :type flags: :class:`SDFlagsRequest` :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: tuple """ req_flags = SDFlagsRequestValue({'Flags' : flags}) controls = [ Control({ 'controlType' : b'1.2.840.113556.1.4.801', 'controlValue': req_flags.dump(), 'criticality' : True, }) ] changes = { 'nTSecurityDescriptor': [('replace', data)] } return await self._con.modify(object_dn, changes, controls = controls) async def get_all_groups(self, attrs:List[str] = MSADGroup_ATTRS): """ Yields all Groups present in the LDAP tree. :return: Async generator which yields (`MSADGroup`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADGroup`, :class:`Exception`)] """ ldap_filter = r'(objectClass=group)' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADGroup.from_ldap(entry), None async def get_all_ous(self, attrs:List[str] = MSADOU_ATTRS): """ Yields all OUs present in the LDAP tree. :return: Async generator which yields (`MSADOU`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADOU`, :class:`Exception`)] """ ldap_filter = r'(objectClass=organizationalUnit)' async for entry, err in self.pagedsearch(ldap_filter, attrs): if err is not None: yield None, err return yield MSADOU.from_ldap(entry), None async def get_group_by_dn(self, group_dn:str): """ Returns an `MSADGroup` object for the group specified by group_dn :param group_dn: The user's DN :type group_dn: str :return: tuple of `MSADGroup` and an `Exception` is there was any :rtype: (:class:`MSADGroup`, :class:`Exception`) """ ldap_filter = r'(&(objectClass=group)(distinguishedName=%s))' % escape_filter_chars(group_dn) async for entry, err in self.pagedsearch(ldap_filter, MSADGroup_ATTRS): if err is not None: return None, err return MSADGroup.from_ldap(entry), None return None, Exception('Search returned no results!') async def get_user_by_dn(self, user_dn:str): """ Fetches the DN for an object specified by `user_dn` :param user_dn: The user's DN :type user_dn: str :return: The user object :rtype: (:class:`MSADUser`, :class:`Exception`) """ ldap_filter = r'(&(objectClass=user)(distinguishedName=%s))' % user_dn async for entry, err in self.pagedsearch(ldap_filter, MSADUser_ATTRS): if err is not None: return None, err return MSADUser.from_ldap(entry), None async def get_group_members(self, dn:str, recursive:bool = False): """ Fetches the DN for an object specified by `objectsid` :param dn: The object's DN :type dn: str :param recursive: Indicates wether the lookup should recursively affect all groups :type recursive: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] """ group, err = await self.get_group_by_dn(dn) if err is not None: yield None, err return for member in group.member: async for result, err in self.get_object_by_dn(member): if isinstance(result, MSADGroup) and recursive: async for user, err in self.get_group_members(result.distinguishedName, recursive = True): yield user, err else: yield result, err async def get_dn_for_objectsid(self, objectsid:str): """ Fetches the DN for an object specified by `objectsid` :param objectsid: The object's SID :type objectsid: str :return: The distinguishedName :rtype: (:class:`str`, :class:`Exception`) """ ldap_filter = r'(objectSid=%s)' % str(objectsid) async for entry, err in self.pagedsearch(ldap_filter, ['distinguishedName']): if err is not None: return None, err return entry['attributes']['distinguishedName'], None return None, Exception('Search returned no results!') async def get_objectsid_for_dn(self, dn:str): """ Fetches the objectsid for an object specified by `dn` :param dn: The object's distinguishedName :type dn: str :return: The SID of the pobject :rtype: (:class:`str`, :class:`Exception`) """ ldap_filter = r'(distinguishedName=%s)' % escape_filter_chars(dn) async for entry, err in self.pagedsearch(ldap_filter, ['objectSid']): if err is not None: return None, err return entry['attributes']['objectSid'], None return None, Exception('Search returned no results!') async def get_tokengroups_user(self, samaccountname:str): ldap_filter = r'(sAMAccountName=%s)' % escape_filter_chars(samaccountname) user_dn = None async for entry, err in self.pagedsearch(ldap_filter, ['distinguishedName']): if err is not None: return None, err user_dn = entry['attributes']['distinguishedName'] if user_dn is None: return None, Exception('User not found! %s' % samaccountname) tokengroup = [] async for sids, err in self.get_tokengroups(user_dn): if err is not None: return None, err tokengroup.append(sids) return tokengroup, None async def get_tokengroups(self, dn:str): """ Yields SIDs of groups that the given DN is a member of. :return: Async generator which yields (`str`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`str`, :class:`Exception`)] """ ldap_filter = r'(distinguishedName=%s)' % escape_filter_chars(dn) attributes=[b'tokenGroups'] async for entry, err in self._con.pagedsearch( dn, ldap_filter, attributes = attributes, size_limit = self.ldap_query_page_size, search_scope=BASE, rate_limit=self.ldap_query_ratelimit ): if err is not None: yield None, err return #print(entry['attributes']) if 'tokenGroups' in entry['attributes']: for sid_data in entry['attributes']['tokenGroups']: yield sid_data, None async def get_all_tokengroups(self): """ Yields all effective group membership information for all objects of the following type: Users, Groups, Computers :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ ldap_filter = r'(|(sAMAccountType=805306369)(objectClass=group)(sAMAccountType=805306368))' async for entry, err in self.pagedsearch( ldap_filter, attributes = ['dn', 'cn', 'objectSid','objectClass', 'objectGUID'] ): if err is not None: yield None, err return if 'objectName' in entry: #print(entry['objectName']) async for entry2, err in self._con.pagedsearch( entry['objectName'], r'(distinguishedName=%s)' % escape_filter_chars(entry['objectName']), attributes = [b'tokenGroups'], size_limit = self.ldap_query_page_size, search_scope=BASE, rate_limit=self.ldap_query_ratelimit ): #print(entry2) if err is not None: yield None, err break if 'tokenGroups' in entry2['attributes']: for token in entry2['attributes']['tokenGroups']: yield { 'cn' : entry['attributes']['cn'], 'dn' : entry['objectName'], 'guid' : entry['attributes']['objectGUID'], 'sid' : entry['attributes']['objectSid'], 'type' : entry['attributes']['objectClass'][-1], 'token' : token }, None async def get_all_objectacl(self): """ Yields the security descriptor of all objects in the LDAP tree of the following types: Users, Computers, GPOs, OUs, Groups :return: Async generator which yields (`MSADSecurityInfo`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADSecurityInfo`, :class:`Exception`)] """ flags_value = SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION req_flags = SDFlagsRequestValue({'Flags' : flags_value}) ldap_filter = r'(|(objectClass=organizationalUnit)(objectCategory=groupPolicyContainer)(sAMAccountType=805306369)(objectClass=group)(sAMAccountType=805306368))' async for entry, err in self.pagedsearch(ldap_filter, attributes = ['dn']): if err is not None: yield None, err return ldap_filter = r'(distinguishedName=%s)' % escape_filter_chars(entry['objectName']) attributes = MSADSecurityInfo.ATTRS controls = [('1.2.840.113556.1.4.801', True, req_flags.dump())] async for entry2, err in self.pagedsearch(ldap_filter, attributes, controls = controls): if err is not None: yield None, err return yield MSADSecurityInfo.from_ldap(entry2), None async def get_all_trusts(self, attrs:List[str] = MSADDomainTrust_ATTRS): """ Yields all trusted domains. :return: Async generator which yields (`MSADDomainTrust`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADDomainTrust`, :class:`Exception`)] """ ldap_filter = r'(objectClass=trustedDomain)' async for entry, err in self.pagedsearch(ldap_filter, attributes = attrs): if err is not None: yield None, err return yield MSADDomainTrust.from_ldap(entry), None async def create_user_dn(self, user_dn:str, password:str): """ Creates a new user object with a password and enables the user so it can be used immediately. :param user_dn: The user's DN :type user_dn: str :param password: The password of the user :type password: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: sn = user_dn.split(',')[0][3:] domain = self._tree[3:].replace(',DC=','.') attributes = { 'objectClass': ['organizationalPerson', 'person', 'top', 'user'], 'sn': sn, 'sAMAccountName': sn, 'displayName': sn, 'userPrincipalName' : "{}@{}".format(sn, domain), } _, err = await self._con.add(user_dn, attributes) if err is not None: return False, err _, err = await self.change_password(user_dn, password) if err is not None: return False, err _, err = await self.enable_user(user_dn) if err is not None: return False, err return True, None except Exception as e: return False, e async def unlock_user(self, user_dn:str): """ Unlocks the user by clearing the lockoutTime attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'lockoutTime': [('replace', 0)] } return await self._con.modify(user_dn, changes) async def enable_user(self, user_dn:str): """ Sets the user object to enabled by modifying the UserAccountControl attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'userAccountControl': [('replace', 512)] } return await self._con.modify(user_dn, changes) async def disable_user(self, user_dn:str): """ Sets the user object to disabled by modifying the UserAccountControl attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'userAccountControl': [('replace', 2)] } return await self._con.modify(user_dn, changes) async def add_user_spn(self, user_dn:str, spn:str): """ Adds an SPN record to the user object. :param user_dn: The user's DN :type user_dn: str :param spn: The SPN to be added. It must follow the SPN string format specifications. :type spn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'servicePrincipalName': [('add', spn)] } return await self._con.modify(user_dn, changes) async def del_user_spn(self, user_dn:str, spn:str): """ Adds an SPN record to the user object. :param user_dn: The user's DN :type user_dn: str :param spn: The SPN to be added. It must follow the SPN string format specifications. :type spn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'servicePrincipalName': [('delete', spn)] } return await self._con.modify(user_dn, changes) async def add_additional_hostname(self, user_dn:str, hostname:str): """ Adds additional hostname to the user object. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'msds-additionaldnshostname': [('add', hostname)] } return await self._con.modify(user_dn, changes) async def delete_user(self, user_dn:str): """ Deletes the user. This action is destructive! :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ return await self._con.delete(user_dn) async def change_password(self, user_dn: str, newpass: str, oldpass:str = None): """ Changes the password of a user. If used with a high-privileged account (eg. Domain admin, Account operator...), the old password can be `None` :param user_dn: The user's DN :type user_dn: str :param newpass: The new password :type newpass: str :param oldpass: The current password :type oldpass: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'unicodePwd': [] } if oldpass is not None: changes['unicodePwd'].append(('delete', '"%s"' % oldpass)) changes['unicodePwd'].append(('add', '"%s"' % newpass)) else: #if you are admin... changes['unicodePwd'].append(('replace', '"%s"' % newpass)) return await self._con.modify(user_dn, changes) async def add_user_to_group(self, user_dn: str, group_dn: str): """ Adds a user to a group :param user_dn: The user's DN :type user_dn: str :param group_dn: The groups's DN :type group_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'member': [('add', user_dn)] } return await self._con.modify(group_dn, changes) async def del_user_from_group(self, user_dn: str, group_dn: str): """ Removes user from group :param user_dn: The user's DN :type user_dn: str :param group_dn: The groups's DN :type group_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ changes = { 'member': [('delete', user_dn)] } return await self._con.modify(group_dn, changes) async def get_object_by_dn(self, dn:str, expected_class = None): ldap_filter = r'(distinguishedName=%s)' % dn async for entry, err in self.pagedsearch(ldap_filter, ALL_ATTRIBUTES): if err is not None: yield None, err return temp = entry['attributes'].get('objectClass') if expected_class: yield expected_class.from_ldap(entry), None if not temp: yield entry, None elif 'user' in temp: yield MSADUser.from_ldap(entry), None elif 'group' in temp: yield MSADGroup.from_ldap(entry), None async def modify(self, dn:str, changes:Dict[str, object], controls:Dict[str, object] = None): """ Performs the modify operation. :param dn: The DN of the object whose attributes are to be modified :type dn: str :param changes: Describes the changes to be made on the object. Must be a dictionary of the following format: {'attribute': [('change_type', [value])]} :type changes: dict :param controls: additional controls to be passed in the query :type controls: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ if controls is None: controls = [] controls_conv = [] for control in controls: controls_conv.append(Control(control)) return await self._con.modify(dn, changes, controls=controls_conv) async def add(self, dn:str, attributes:Dict[str, object]): """ Performs the add operation. :param dn: The DN of the object to be added :type dn: str :param attributes: Attributes to be used in the operation :type attributes: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ return await self._con.add(dn, attributes) async def delete(self, dn:str): """ Performs the delete operation. :param dn: The DN of the object to be deleted :type dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ return await self._con.delete(dn) async def add_priv_addmember(self, user_dn:str, group_dn:str): """Adds AddMember rights to the user on the group specified by group_dn""" try: #getting SID of target dn user_sid, err = await self.get_objectsid_for_dn(user_dn) if err is not None: raise err res, err = await self.get_objectacl_by_dn(group_dn) if err is not None: raise err if res is None: raise Exception('Failed to get forest\'s SD') group_sd = SECURITY_DESCRIPTOR.from_bytes(res) new_sd = copy.deepcopy(group_sd) ace_1 = ACCESS_ALLOWED_OBJECT_ACE() ace_1.Sid = SID.from_string(user_sid) ace_1.ObjectType = GUID.from_string('bf9679c0-0de6-11d0-a285-00aa003049e2') ace_1.Mask = ADS_ACCESS_MASK.WRITE_PROP ace_1.AceFlags = 0 new_sd.Dacl.aces.append(ace_1) changes = { 'nTSecurityDescriptor' : [('replace', new_sd.to_bytes())] } req_flags = SDFlagsRequestValue({ 'Flags': SDFlagsRequest.DACL_SECURITY_INFORMATION }) controls = [{ 'controlType': b'1.2.840.113556.1.4.801', 'controlValue': req_flags.dump(), 'criticality': False }] _, err = await self.modify(group_dn, changes, controls) if err is not None: raise err return True, None except Exception as e: return False, e async def add_priv_dcsync(self, user_dn:str, forest_dn:str = None): """Adds DCSync rights to the given user by modifying the forest's Security Descriptor to add GetChanges and GetChangesAll ACE""" try: #getting SID of target dn user_sid, err = await self.get_objectsid_for_dn(user_dn) if err is not None: raise err if forest_dn is None: forest_dn = self._ldapinfo.distinguishedName res, err = await self.get_objectacl_by_dn(forest_dn) if err is not None: raise err if res is None: raise Exception('Failed to get forest\'s SD') forest_sd = SECURITY_DESCRIPTOR.from_bytes(res) new_sd = copy.deepcopy(forest_sd) ace_1 = ACCESS_ALLOWED_OBJECT_ACE() ace_1.Sid = SID.from_string(user_sid) ace_1.ObjectType = GUID.from_string('1131f6aa-9c07-11d1-f79f-00c04fc2dcd2') ace_1.Mask = ADS_ACCESS_MASK.CONTROL_ACCESS ace_1.AceFlags = 0 new_sd.Dacl.aces.append(ace_1) ace_2 = ACCESS_ALLOWED_OBJECT_ACE() ace_2.Sid = SID.from_string(user_sid) ace_2.ObjectType = GUID.from_string('1131f6ad-9c07-11d1-f79f-00c04fc2dcd2') ace_2.Mask = ADS_ACCESS_MASK.CONTROL_ACCESS ace_2.AceFlags = 0 new_sd.Dacl.aces.append(ace_2) changes = { 'nTSecurityDescriptor' : [('replace', new_sd.to_bytes())] } req_flags = SDFlagsRequestValue({ 'Flags': SDFlagsRequest.DACL_SECURITY_INFORMATION }) controls = [{ 'controlType': b'1.2.840.113556.1.4.801', 'controlValue': req_flags.dump(), 'criticality': False }] _, err = await self.modify(forest_dn, changes, controls) if err is not None: raise err return True, None except Exception as e: return False, e async def change_priv_owner(self, new_owner_sid:str, target_dn:str, target_attribute = None): """Changes the owner in a Security Descriptor to the new_owner_sid on an LDAP object or on an LDAP object's attribute identified by target_dn and target_attribute. target_attribute can be omitted to change the target_dn's SD's owner""" try: try: new_owner_sid = SID.from_string(new_owner_sid) except: return False, Exception('Incorrect SID') target_sd = None if target_attribute is None or target_attribute == '': target_attribute = 'nTSecurityDescriptor' res, err = await self.get_objectacl_by_dn(target_dn) if err is not None: raise err target_sd = SECURITY_DESCRIPTOR.from_bytes(res) else: query = '(distinguishedName=%s)' % target_dn async for entry, err in self.pagedsearch(query, [target_attribute]): if err is not None: raise err target_sd = SECURITY_DESCRIPTOR.from_bytes(entry['attributes'][target_attribute]) break else: raise Exception('Target DN not found!') new_sd = copy.deepcopy(target_sd) new_sd.Owner = new_owner_sid changes = { target_attribute : [('replace', new_sd.to_bytes())] } _, err = await self.modify(target_dn, changes) if err is not None: raise err return True, None except Exception as e: return False, e async def list_root_cas(self): try: ldap_filter = "(objectClass=certificationAuthority)" tree = "CN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,%s" % self._ldapinfo.distinguishedName async for entry, err in self.pagedsearch(ldap_filter, attributes = MSADCA_ATTRS, tree = tree): if err is not None: yield None, err return yield MSADCA.from_ldap(entry, 'ROOTCA'), None except Exception as e: yield None, e return async def list_ntcas(self): try: ldap_filter = "(objectClass=certificationAuthority)" tree = "CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,%s" % self._ldapinfo.distinguishedName async for entry, err in self.pagedsearch(ldap_filter, attributes = MSADCA_ATTRS, tree = tree): if err is not None: yield None, err return yield MSADCA.from_ldap(entry, 'NTCA'), None except Exception as e: yield None, e return async def list_aiacas(self): try: ldap_filter = "(objectClass=certificationAuthority)" tree = "CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,%s" % self._ldapinfo.distinguishedName async for entry, err in self.pagedsearch(ldap_filter, attributes = MSADCA_ATTRS, tree = tree): if err is not None: yield None, err return yield MSADCA.from_ldap(entry, 'AIACA'), None except Exception as e: yield None, e return async def list_enrollment_services(self): try: ldap_filter = "(objectCategory=pKIEnrollmentService)" tree = "CN=Configuration,%s" % self._ldapinfo.distinguishedName async for entry, err in self.pagedsearch(ldap_filter, attributes = MSADEnrollmentService_ATTRS, tree = tree): if err is not None: yield None, err return yield MSADEnrollmentService.from_ldap(entry), None except Exception as e: yield None, e return async def list_certificate_templates(self, name:str = None): try: req_flags = SDFlagsRequestValue({'Flags' : SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION}) controls = [('1.2.840.113556.1.4.801', True, req_flags.dump())] ldap_filter = "(objectCategory=pKICertificateTemplate)" if name is not None: ldap_filter = "(&(objectCategory=pKICertificateTemplate)(name=%s))" % name tree = "CN=Configuration,%s" % self._ldapinfo.distinguishedName async for entry, err in self.pagedsearch(ldap_filter, attributes = MSADCertificateTemplate_ATTRS, controls=controls, tree = tree): if err is not None: yield None, err return yield MSADCertificateTemplate.from_ldap(entry), None except Exception as e: yield None, e return async def list_gmsa(self): try: ldap_filter = r'(objectClass=msDS-GroupManagedServiceAccount)' async for entry, err in self.pagedsearch(ldap_filter, attributes = ['sAMAccountName','msDS-GroupMSAMembership', 'msDS-ManagedPassword']): if err is not None: yield None, None, None, err return yield entry['attributes'].get('sAMAccountName'), entry['attributes'].get('msDS-GroupMSAMembership'), entry['attributes'].get('msDS-ManagedPassword'), None except Exception as e: yield None, None, None, e return async def get_all_gmsa(self, attributes:list = MSADGMSAUser_ATTRS): try: ldap_filter = r'(objectClass=msDS-GroupManagedServiceAccount)' async for entry, err in self.pagedsearch(ldap_filter, attributes = ALL_ATTRIBUTES): if err is not None: yield None, err return gmsauser = MSADGMSAUser.from_ldap(entry) yield gmsauser, None except Exception as e: yield None, e return async def add_computer(self, computername:str = None, password:str = None): try: if computername is None: computername = 'COMP%s$' % ''.join(random.choice(string.ascii_uppercase + string.digits) for _ in range(4)) if computername.endswith('$') is False: computername += '$' if password is None: password = ''.join(random.choice(string.ascii_uppercase + string.digits + '!@#$%+') for _ in range(16)) # Create computer object domain = self._ldapinfo.distinguishedName.replace('DC','').replace('=','').replace(',','.') attributes = { 'objectClass': ['top', 'person', 'organizationalPerson', 'user', 'computer'], #'cn': computername[:-1], 'sAMAccountName': computername, 'name': computername[:-1], 'servicePrincipalName' : "HOST/{}.{}".format(computername[:-1], domain), } dn = 'CN=%s,CN=Computers,%s' % (computername[:-1], self._ldapinfo.distinguishedName) _, err = await self.add(dn, attributes) if err is not None: raise err # enabling computer account changes = { 'userAccountControl': [('replace', 4096)] } _, err = await self._con.modify(dn, changes) if err is not None: raise err # Change password _, err = await self.change_password(dn, password) if err is not None: raise err # Get computer object computer, err = await self.get_machine(computername) if err is not None: raise err return computer, password, None except Exception as e: return None, None, e async def change_samaccountname(self, dn:str, samaccountname:str): try: changes = { 'sAMAccountName': [('replace', samaccountname)] } _, err = await self._con.modify(dn, changes) if err is not None: raise err return None except Exception as e: return e async def resolv_sd(self, sd:SECURITY_DESCRIPTOR or bytes): "Resolves all SIDs found in security descriptor, returns lookup table" try: if isinstance(sd, bytes): sd = SECURITY_DESCRIPTOR.from_bytes(sd) lookup_table = {} sids = {} sids[str(sd.Owner)] = 1 sids[str(sd.Group)] = 1 if sd.Dacl is not None: for ace in sd.Dacl.aces: sids[str(ace.Sid)] = 1 if sd.Sacl is not None: for ace in sd.Sacl.aces: sids[str(ace.Sid)] = 1 for sid in sids: domain, username, err = await self.resolv_sid(sid) if err is not None: raise err lookup_table[sid] = (domain, username) return lookup_table, None except Exception as e: return None, e async def resolv_sid(self, sid:SID or str, use_cache:bool = True): """Performs a SID lookup for object and returns the domain name and the samaccountname""" try: sid = str(sid).upper() if sid in KNOWN_SIDS: return "BUILTIN", KNOWN_SIDS[sid], None domain = None username = None domainsid = sid.rsplit('-',1)[0] if domainsid not in self._domainsid_cache: logger.debug('Domain SID "%s" was not found! ' % domainsid) return '???', '???', None domain = self._domainsid_cache[domainsid] if sid in self._sid_cache: username = self._sid_cache[sid] else: ldap_filter = r'(objectSid=%s)' % sid async for entry, err in self.pagedsearch(ldap_filter, attributes = ['sAMAccountName']): if err is not None: return None, None, err username = entry['attributes'].get('sAMAccountName') if username is None: return domain, '???', None #raise Exception('User not found! %s' % sid) if use_cache is True: self._sid_cache[sid] = username return domain, username, None except Exception as e: return None, None, e async def whoami(self): return await self._con.whoami() async def whoamifull(self): """Full whoami""" #TODO: it can be the case that the server returns the SID of the user # implement that path! result = {} try: res, err = await self.whoami() if err is not None: raise err result['raw'] = res if res.startswith('u:') is True: domain, samaccountname = res[2:].split('\\', 1) result['domain'] = domain result['samaccountname'] = samaccountname user, err = await self.get_user(samaccountname) if err is not None: raise err result['sid'] = str(user.objectSid) result['groups'] = {} async for group_sid, err in self.get_tokengroups(user.distinguishedName): if err is not None: raise err result['groups'][group_sid] = ('NA','NA') domain, username, err = await self.resolv_sid(group_sid) if err is not None: raise err result['groups'][group_sid] = (domain, username) return result, None except: return result, None async def get_unconstrained_machines(self): ldap_filter = r'(&(sAMAccountType=805306369)(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(userAccountControl:1.2.840.113556.1.4.803:=524288))' async for entry, err in self.pagedsearch(ldap_filter, ['sAMAccountName']): if err is not None: yield None, err return yield entry.get('attributes', {}).get('sAMAccountName'), None logger.debug('Finished polling for entries!') async def get_unconstrained_users(self): ldap_filter = r'(&(sAMAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=524288))' async for entry, err in self.pagedsearch(ldap_filter, ['sAMAccountName']): if err is not None: yield None, err return yield entry.get('attributes', {}).get('sAMAccountName'), None logger.debug('Finished polling for entries!') async def get_all_constrained(self): ldap_filter = r'(&(|(sAMAccountType=805306369)(sAMAccountType=805306368))(msDS-AllowedToDelegateTo=*))' async for entry, err in self.pagedsearch(ldap_filter, ['sAMAccountName', 'msDS-AllowedToDelegateTo']): if err is not None: yield None, err return yield entry.get('attributes', {}), None logger.debug('Finished polling for entries!') async def get_all_s4u2proxy(self): ldap_filter = r'(&(|(sAMAccountType=805306369)(sAMAccountType=805306368))(userAccountControl:1.2.840.113556.1.4.803:=16777216))' async for entry, err in self.pagedsearch(ldap_filter, ['sAMAccountName']): if err is not None: yield None, err return yield entry.get('attributes', {}).get('sAMAccountName'), None logger.debug('Finished polling for entries!') async def sam2dn(self, sAMAccountName): """Fetches the DN of an object based on the sAMAccountName""" try: query = '(sAMAccountName=%s)' % sAMAccountName async for entry, err in self.pagedsearch(query, ['distinguishedName', 'objectSid']): if err is not None: raise err entry['attributes']['distinguishedName'], None except Exception as e: return None, e async def sid2dn(self, sid): """Fetches the DN of an object based on the objectSid""" try: query = '(objectSid=%s)' % sid async for entry, err in self.pagedsearch(query, ['distinguishedName']): if err is not None: raise err return entry['attributes']['distinguishedName'], None except Exception as e: return None, e async def dn2sid(self, dn): """Fetches the objectSid of an object based on the DN""" try: query = '(distinguishedName=%s)' % dn async for entry, err in self.pagedsearch(query, ['objectSid']): if err is not None: raise err return entry['attributes']['objectSid'], None except Exception as e: return None, e async def dn2sam(self, dn): """Fetches the sAMAccountName of an object based on the DN""" try: query = '(distinguishedName=%s)' % dn async for entry, err in self.pagedsearch(query, ['sAMAccountName']): if err is not None: raise err return entry['attributes']['sAMAccountName'], None except Exception as e: return None, e async def dnattrs(self, dn, attrs:List[str]): """Fetches attributes of an object specified by DN""" try: query = '(distinguishedName=%s)' % dn async for entry, err in self.pagedsearch(query, attrs): if err is not None: raise err return entry['attributes'], None except Exception as e: return None, e async def get_childobjects(self, dn): try: query = '(|(objectClass=container)(objectClass=organizationalUnit)(sAMAccountType=805306369)(objectClass=group)(&(objectCategory=person)(objectClass=user)))' attrs =['objectSid', 'objectClass', 'objectGUID', 'distinguishedName', 'sAMAccountName', 'sAMAccountType'] async for entry, err in self.pagedsearch(query, attrs, tree=dn, search_scope=1): if err is not None: raise err yield entry['attributes'], None except Exception as e: yield None, e async def dnslistzones(self): """Lists all DNS zones in the forest""" try: query = '(objectClass=dnsZone)' async for entry, err in self.pagedsearch(query, ['dc']): if err is not None: raise err yield(entry['attributes']['dc']), None except Exception as e: yield None, e async def dnsentries(self, zone = None, with_tombstones = False): """Lists all DNS entries in the forest""" dnsroots = [ 'CN=MicrosoftDNS,CN=System,%s' % self._tree, 'CN=MicrosoftDNS,DC=DomainDnsZones,%s' % self._tree ] async for entry, err in self.dnslistzones(): if err is not None: raise err dnsroots.append('CN=MicrosoftDNS,DC=ForestDnsZones,DC=%s' % entry) try: for dnsroot in dnsroots: query = '(objectClass=dnsNode)' try: async for entry, err in self.pagedsearch(query, attributes=['dnsRecord','dNSTombstoned','name'], tree=dnsroot): if err is not None: raise err if 'name' not in entry['attributes'] or entry['attributes']['name'] is None: continue if 'dNSTombstoned' in entry['attributes'] and entry['attributes']['dNSTombstoned'] is True: if with_tombstones is False: continue if 'dnsRecord' not in entry['attributes']: continue for recorddata in entry['attributes']['dnsRecord']: yield dnsroot, entry['attributes']['name'], DNS_RECORD.from_bytes(recorddata), None except LDAPSearchException: if zone is None: pass else: raise Exception('Zone %s not found!' % zone) except Exception as e: yield None, None, None, e #async def get_permissions_for_dn(self, dn): # """ # Lists all users who can modify the specified dn # """ # async for secinfo in self.get_objectacl_by_dn(dn): # for sdec in secinfo.nTSecurityDescriptor: # sids_to_lookup = {} # if not sdec.Dacl: # continue # # for ace in sdec.Dacl.aces: # sids_to_lookup[str(ace.Sid)] = 1 # # for sid in sids_to_lookup: # sids_to_lookup[sid] = self.get_dn_for_objectsid(sid) # # print(sids_to_lookup) # # for ace in sdec.Dacl.aces: # if not sids_to_lookup[str(ace.Sid)]: # print(str(ace.Sid)) # #print('===== %s =====' % sids_to_lookup[str(ace.Sid)]) # #if # #print(str(ace)) #async def get_all_tokengroups(self): # """ # returns the tokengroups attribute for all user and machine on the server # """ # dns = [] # # ldap_filters = [r'(objectClass=user)', r'(sAMAccountType=805306369)'] # attributes = ['distinguishedName'] # # for ldap_filter in ldap_filters: # print(ldap_filter) # for entry in self.pagedsearch(ldap_filter, attributes): # print(entry['attributes']['distinguishedName']) # dns.append(entry['attributes']['distinguishedName']) # # attributes=['tokenGroups', 'sn', 'cn', 'distinguishedName','objectGUID', 'objectSid'] # for dn in dns: # ldap_filter = r'(distinguishedName=%s)' % dn # self._con.search(dn, ldap_filter, attributes=attributes, search_scope=BASE) # async for entry, err in self._con.response: # #yield MSADTokenGroup.from_ldap(entry) # print(str(MSADTokenGroup.from_ldap(entry))) #async def get_all_objectacl(self): # """ # Returns all ACL info for all AD objects # """ # # flags_value = SDFlagsRequest.DACL_SECURITY_INFORMATION|SDFlagsRequest.GROUP_SECURITY_INFORMATION|SDFlagsRequest.OWNER_SECURITY_INFORMATION # req_flags = SDFlagsRequestValue({'Flags' : flags_value}) # # ldap_filter = r'(objectClass=*)' # attributes = MSADSecurityInfo.ATTRS # controls = [('1.2.840.113556.1.4.801', True, req_flags.dump())] # # async for entry in self.pagedsearch(ldap_filter, attributes, controls = controls): # yield MSADSecurityInfo.from_ldap(entry) #async def get_netdomain(self): # def nameconvert(x): # return x.split(',CN=')[1] # """ # gets the name of the current user's domain # """ # if not self._ldapinfo: # self.get_ad_info() # print(self._ldapinfo) # dname = self._ldapinfo.distinguishedName.replace('DC','').replace('=','').replace(',','.') # domain_controllers = ','.join(nameconvert(x) + '.' +dname for x in self._ldapinfo.masteredBy) # # ridroleowner = nameconvert(self.get_ridroleowner()) + '.' +dname # infraowner = nameconvert(self.get_infrastructureowner()) + '.' +dname # pdcroleowner = nameconvert(self.get_pdcroleowner()) + '.' +dname # # print('name : %s' % dname) # print('Domain Controllers : %s' % domain_controllers) # print('DomainModeLevel : %s' % self._ldapinfo.domainmodelevel) # print('PdcRoleOwner : %s' % pdcroleowner) # print('RidRoleOwner : %s' % ridroleowner) # print('InfrastructureRoleOwner : %s' % infraowner) # #async def get_domaincontroller(self): # ldap_filter = r'(userAccountControl:1.2.840.113556.1.4.803:=8192)' # async for entry in self.pagedsearch(ldap_filter, ALL_ATTRIBUTES): # print('Forest: %s' % '') # print('Name: %s' % entry['attributes'].get('dNSHostName')) # print('OSVersion: %s' % entry['attributes'].get('operatingSystem')) # print(entry['attributes']) #async def get_pdcroleowner(self): # #http://adcoding.com/how-to-determine-the-fsmo-role-holder-fsmoroleowner-attribute/ # #get adinfo -> get ridmanagerreference attr -> look up the dn of ridmanagerreference -> get fsmoroleowner attr (which is a DN) # if not self._ldapinfo: # self.get_ad_info() # # ldap_filter = r'(distinguishedName=%s)' % self._ldapinfo.rIDManagerReference # async for entry in self.pagedsearch(ldap_filter, ['fSMORoleOwner']): # return entry['attributes']['fSMORoleOwner'] # #async def get_infrastructureowner(self): # #http://adcoding.com/how-to-determine-the-fsmo-role-holder-fsmoroleowner-attribute/ # #"CN=Infrastructure,DC=concorp,DC=contoso,DC=com" -l fSMORoleOwner # if not self._ldapinfo: # self.get_ad_info() # # ldap_filter = r'(distinguishedName=%s)' % ('CN=Infrastructure,' + self._ldapinfo.distinguishedName) # async for entry in self.pagedsearch(ldap_filter, ['fSMORoleOwner']): # return entry['attributes']['fSMORoleOwner'] # #async def get_ridroleowner(self): # #http://adcoding.com/how-to-determine-the-fsmo-role-holder-fsmoroleowner-attribute/ # if not self._ldapinfo: # self.get_ad_info() # # ldap_filter = r'(distinguishedName=%s)' % ('CN=RID Manager$,CN=System,' + self._ldapinfo.distinguishedName) # async for entry in self.pagedsearch(ldap_filter, ['fSMORoleOwner']): # return entry['attributes']['fSMORoleOwner'] #async def get_all_user_raw(self): # """ # Fetches all user objects from the AD, and returns MSADUser object # """ # logger.debug('Polling AD for all user objects') # ldap_filter = r'(sAMAccountType=805306368)' # # return self.pagedsearch(ldap_filter, MSADUser_ATTRS) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/commons/0000775000175000017500000000000014535076203015321 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/commons/__init__.py0000664000175000017500000000000014531630505017415 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701937323.0 msldap-0.5.9/msldap/commons/adexplorer.py0000664000175000017500000007171514534300253020045 0ustar00webdevwebdev # The following code was heavily inspired by the # ADExplorerSnapshot.py project created by c3c # # The project was licensed under MIT at the time # of creating this script, but did not include a # LICENSE.md file # https://github.com/c3c/ADExplorerSnapshot.py import io import struct import enum import calendar from datetime import datetime from typing import Dict, List from msldap import logger from msldap.ldap_objects import MSADSchemaEntry, MSADInfo_ATTRS, MSADInfo, MSADContainer, MSADContainer_ATTRS, \ MSADDomainTrust_ATTRS, MSADDomainTrust, MSADOU, MSADOU_ATTRS, MSADUser, MSADUser_ATTRS, MSADGroup, MSADGroup_ATTRS,\ MSADMachine_ATTRS, MSADMachine, MSADGPO_ATTRS, MSADGPO from msldap.protocol.typeconversion import MSLDAP_BUILTIN_ATTRIBUTE_TYPES, LDAP_WELL_KNOWN_ATTRS ENCODER_SPEFIFIC_FULCTIONS = [ 'single_bool', 'single_str', 'multi_str' ] class ADSTYPE(enum.Enum): INVALID = 0 DN_STRING = 1 CASE_EXACT_STRING = 2 CASE_IGNORE_STRING = 3 PRINTABLE_STRING = 4 NUMERIC_STRING = 5 BOOLEAN = 6 INTEGER = 7 OCTET_STRING = 8 UTC_TIME = 9 LARGE_INTEGER = 10 PROV_SPECIFIC = 11 OBJECT_CLASS = 12 CASEIGNORE_LIST = 13 OCTET_LIST = 14 PATH = 15 POSTALADDRESS = 16 TIMESTAMP = 17 BACKLINK = 18 TYPEDNAME = 19 HOLD = 20 NETADDRESS = 21 REPLICAPOINTER = 22 FAXNUMBER = 23 EMAIL = 24 NT_SECURITY_DESCRIPTOR = 25 UNKNOWN = 26 DN_WITH_BINARY = 27 DN_WITH_STRING = 28 class SystemTime: def __init__(self): self.year = None self.month = None self.dayOfWeek = None self.day = None self.hour = None self.minute = None self.second = None self.milliseconds = None @staticmethod def from_bytes(data:bytes): return SystemTime.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff): st = SystemTime() st.year = struct.unpack("+://:@://?= sets the ldap protocol following values supported: - ldap - ldaps can be omitted if plaintext authentication is to be performed (in that case it default to ntlm-password), otherwise: - ntlm-password - ntlm-nt - kerberos-password (dc option param must be used) - kerberos-rc4 / kerberos-nt (dc option param must be used) - kerberos-aes (dc option param must be used) - kerberos-keytab (dc option param must be used) - kerberos-ccache (dc option param must be used) - sspi-ntlm (windows only!) - sspi-kerberos (windows only!) - anonymous - plain - simple - sicily (same format as ntlm-nt but using the SICILY authentication) : OPTIONAL. Specifies the root tree of all queries can be: - timeout : connction timeout in seconds - proxytype: currently only socks5 proxy is supported - proxyhost: Ip or hostname of the proxy server - proxyport: port of the proxy server - proxytimeout: timeout in secodns for the proxy connection - dc: the IP address of the domain controller, MUST be used for kerberos authentication - encrypt: enable encryption. Only for NTLM. DOESNT WORK WITH LDAPS - etype: Supported encryption types for Kerberos authentication. Multiple can be specified. - rate: LDAP paged search query rate limit. Will sleep for seconds between each new page. Default: 0 (no limit) - pagesize: LDAP paged search query size per page. Max: 1000. Default: 1000 Examples: ldap://10.10.10.2 (anonymous bind) ldaps://test.corp (anonymous bind) ldap+sspi-ntlm://test.corp ldap+sspi-kerberos://test.corp ldap://TEST\\victim:@10.10.10.2 (defaults to SASL GSSAPI NTLM) ldap+simple://TEST\\victim:@10.10.10.2 (SASL SIMPLE auth) ldap+plain://TEST\\victim:@10.10.10.2 (SASL SIMPLE auth) ldap+ntlm-password://TEST\\victim:@10.10.10.2 ldap+ntlm-nt://TEST\\victim:@10.10.10.2 ldap+kerberos-password://TEST\\victim:@10.10.10.2 ldap+kerberos-rc4://TEST\\victim:@10.10.10.2 ldap+kerberos-aes://TEST\\victim:@10.10.10.2 ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/ ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/?timeout=99&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080&proxytimeout=44 """ def __init__(self, credential:UniCredential = None, target:MSLDAPTarget = None ): self.credential = credential self.target = target @staticmethod def from_url(connection_url): target = MSLDAPTarget.from_url(connection_url) credential = UniCredential.from_url(connection_url) return LDAPConnectionFactory(credential, target) def get_credential(self) -> UniCredential: """ Creates a credential object :return: Credential object :rtype: :class:`UniCredential` """ return copy.deepcopy(self.credential) def get_target(self) -> MSLDAPTarget: """ Creates a target object :return: Target object :rtype: :class:`MSLDAPTarget` """ return copy.deepcopy(self.target) def get_client(self) -> MSLDAPClient: """ Creates a client that can be used to interface with the server :return: LDAP client :rtype: :class:`MSLDAPClient` """ cred = self.get_credential() target = self.get_target() return MSLDAPClient(target, cred) def get_connection(self) -> MSLDAPClientConnection: """ Creates a connection that can be used to interface with the server :return: LDAP connection :rtype: :class:`MSLDAPClientConnection` """ cred = self.get_credential() target = self.get_target() return MSLDAPClientConnection(target, cred) def __str__(self): t = '==== LDAPConnectionFactory ====\r\n' for k in self.__dict__: val = self.__dict__[k] if isinstance(val, enum.IntFlag): val = val elif isinstance(val, enum.Enum): val = val.name t += '%s: %s\r\n' % (k, str(val)) return t if __name__ == '__main__': url_tests = [ 'ldap://10.10.10.2', 'ldap://10.10.10.2:9999', 'ldap://test:password@10.10.10.2', 'ldap://domain\\test@10.10.10.2', 'ldap://domain\\test:password@10.10.10.2:9999', 'ldap://domain\\test:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA@10.10.10.2:9999', 'ldaps+sspi-ntlm://10.10.10.2', 'ldaps+sspi-kerberos://10.10.10.2', 'ldaps+ntlm-password://domain\\test:password@10.10.10.2:9999', 'ldaps+ntlm-nt://domain\\test:password@10.10.10.2:9999', 'ldaps+kerberos-password://domain\\test:password@10.10.10.2:9999', 'ldaps://10.10.10.2:9999', 'ldaps://test:password@10.10.10.2', 'ldaps://domain\\test@10.10.10.2', 'ldaps://domain\\test:password@10.10.10.2:9999', 'ldaps://DOMAIN\\test:password@10.10.10.2:9999/?proxytype=socks5&proxyserver=127.0.0.1', 'ldaps://DOMAIN\\test:password@10.10.10.2:9999/?proxytype=socks5&proxyserver=127.0.0.1&proxyuser=admin&proxypass=alma', 'ldaps://DOMAIN\\test:password@10.10.10.2:9999/?proxytype=multiplexor&proxyserver=127.0.0.1&proxyport=9999&proxyuser=admin&proxypass=alma', 'ldaps://10.10.10.2', 'ldaps://10.10.10.2:6666', ] for url in url_tests: print('===========================================================================') print(url) try: dec = LDAPConnectionFactory.from_url(url) creds = dec.get_credential() target = dec.get_target() except Exception as e: import traceback traceback.print_exc() print('ERROR! Reason: %s' % e) input() else: print(str(creds)) print(str(target)) input() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701771388.0 msldap-0.5.9/msldap/commons/ldif.py0000664000175000017500000001043414533574174016623 0ustar00webdevwebdevimport io import base64 from typing import Dict, List class LDIFIdx: def __init__(self, start, end): self.start = start self.end = end self.length = end - start class MSLDAPLdiff: def __init__(self, max_cache_size:int = 10000): self.filename:str = None self.filehandle:io.BytesIO = None self.dn_index:Dict[str, LDIFIdx] = {} self.objectclass_index = {} self.samaccounttype_index = {} self.objecttype_index = {} self.max_cache_size = max_cache_size self.dncache:Dict[str, List[Dict[str, str]]] = {} @staticmethod async def from_file(filename:str): ldiff = MSLDAPLdiff() ldiff.filename = filename await ldiff.parse() async def open_or_handle(self): if self.filehandle is None: self.filehandle = open(self.filename, 'r', encoding='utf-8') return self.filehandle async def build_index(self): print('[+] Building index...') with open(self.filename, 'r', encoding='utf-8') as f: while True: pos = f.tell() # Current position in the file line = f.readline() if not line: # End of file if current_dn is not None: # Store the end position for the last entry self.dn_index[current_dn] = LDIFIdx(start_pos, pos) break if line.startswith('dn: '): if current_dn is not None: # Store the end position for the previous entry self.dn_index[current_dn] = LDIFIdx(start_pos, pos) current_dn = line.strip().upper() start_pos = pos if line.startswith('objectClass: '): objectclass = line.strip().upper() if objectclass not in self.objectclass_index: self.objectclass_index[objectclass] = [] self.objectclass_index[objectclass].append(current_dn) if line.startswith('sAMAccountType: '): objectclass = line.strip().upper() if objectclass not in self.objectclass_index: self.objectclass_index[objectclass] = [] self.samaccounttype_index[objectclass].append(current_dn) if line.startswith('objectType: '): objectclass = line.strip().upper() if objectclass not in self.objectclass_index: self.objectclass_index[objectclass] = [] self.objecttype_index[objectclass].append(current_dn) elif not line.strip() and current_dn is not None: # Optional: Handle blank lines between entries if needed self.dn_index[current_dn] = LDIFIdx(start_pos, pos) current_dn = None async def fetch(self, dn:str): dn = dn.upper() if dn in self.dncache: return self.dncache[dn] if dn not in self.dn_index: return None raw_entry = [] f = await self.open_or_handle() idx = self.dn_index[dn] f.seek(idx.start) data = f.read(idx.length) for line in data.split('\n'): line = line.strip() if line == '': continue if line.startswith('#'): continue raw_entry.append(line) entry = self.parse_entry(raw_entry) if len(self.dncache) > self.max_cache_size: self.dncache.popitem() def parse_entry(self, raw_entry:List[str]): ed = {} for line in raw_entry: line = line.strip() if line == '': continue if line.startswith('#'): continue key, value = line.split(':', 1) key = key.strip() value = value.strip() if line.split(':', 1)[0].endswith('::'): value = base64.b64decode(value) if key not in ed: ed[key] = [] ed[key].append(value) return ed async def parse(self): await self.build_index() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/commons/target.py0000664000175000017500000001001514531630505017153 0ustar00webdevwebdev #!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from os import stat from sqlite3 import connect from asysocks.unicomm.common.target import UniTarget, UniProto from urllib.parse import urlparse, parse_qs from asysocks.unicomm.utils.paramprocessor import str_one, int_one, bool_one msldaptarget_url_params = { 'pagesize' : int_one, 'rate' : int_one, } class MSLDAPTarget(UniTarget): """ Describes the connection to the server. :param host: IP address or hostname of the server :type host: str :param port: port of the LDAP service running on the server :type port: int :param proto: Connection protocol to be used :type proto: :class:`UniProto` :param tree: The tree to connect to :type tree: str :param proxies: specifies what kind of proxy to be used :type proxies: :class:`List[UniProxyTarget]` :param timeout: connection timeout in seconds :type timeout: int :param ldap_query_page_size: Maximum number of elements to fetch in each paged_query call. :type ldap_query_page_size: int :param ldap_query_ratelimit: rate limit of paged queries. This will cause a sleep (in seconds) between fetching of each page of the query :type ldap_query_ratelimit: float :param dc_ip: Ip address of the kerberos server (if kerberos is used) :type dc_ip: str """ def __init__(self, ip, port = 389, protocol = UniProto.CLIENT_TCP, tree = None, proxies = None, timeout = 10, ldap_query_page_size = 1000, ldap_query_ratelimit = 0, dns:str=None, dc_ip:str = None, domain:str = None, hostname:str = None, ssl_ctx = None): UniTarget.__init__(self, ip, port, protocol, timeout, hostname = hostname, ssl_ctx= ssl_ctx, proxies = proxies, domain = domain, dc_ip = dc_ip, dns=dns) self.tree = tree self.ldap_query_page_size = ldap_query_page_size self.ldap_query_ratelimit = ldap_query_ratelimit def to_target_string(self): return 'ldap/%s@%s' % (self.get_hostname_or_ip(), self.domain) #ldap/WIN2019AD.test.corp @ TEST.CORP def get_host(self): if self.protocol == UniProto.CLIENT_SSL_TCP: proto = 'ldaps' elif self.protocol == UniProto.CLIENT_TCP: proto = 'ldap' return '%s://%s:%s' % (proto, self.get_hostname_or_ip(), self.port) def is_ssl(self): return self.protocol == UniProto.CLIENT_SSL_TCP @staticmethod def from_url(connection_url): url_e = urlparse(connection_url) schemes = [] for item in url_e.scheme.upper().split('+'): schemes.append(item.replace('-','_')) if schemes[0] == 'LDAP': protocol = UniProto.CLIENT_TCP port = 389 elif schemes[0] == 'LDAPS': protocol = UniProto.CLIENT_SSL_TCP port = 636 elif schemes[0] == 'LDAP_SSL': protocol = UniProto.CLIENT_SSL_TCP port = 636 elif schemes[0] == 'LDAP_TCP': protocol = UniProto.CLIENT_TCP port= 389 elif schemes[0] == 'LDAP_UDP': raise NotImplementedError() protocol = UniProto.CLIENT_UDP port = 389 elif schemes[0] == 'GC': protocol = UniProto.CLIENT_TCP port = 3268 elif schemes[0] == 'GC_SSL': protocol = UniProto.CLIENT_SSL_TCP port = 3269 else: raise Exception('Unknown protocol! %s' % schemes[0]) if url_e.port: port = url_e.port if port is None: raise Exception('Port must be provided!') path = None if url_e.path not in ['/', '', None]: path = url_e.path unitarget, extraparams = UniTarget.from_url(connection_url, protocol, port, msldaptarget_url_params) pagesize = extraparams['pagesize'] if extraparams['pagesize'] is not None else 1000 rate = extraparams['rate'] if extraparams['rate'] is not None else 0 target = MSLDAPTarget( unitarget.ip, port = unitarget.port, protocol = unitarget.protocol, tree = path, proxies = unitarget.proxies, timeout = unitarget.timeout, ldap_query_page_size = pagesize, ldap_query_ratelimit = rate, dns = unitarget.dns, dc_ip = unitarget.dc_ip, domain = unitarget.domain, hostname = unitarget.hostname, ssl_ctx = unitarget.ssl_ctx, ) return target def __str__(self): t = '==== MSLDAPTarget ====\r\n' for k in self.__dict__: t += '%s: %s\r\n' % (k, self.__dict__[k]) return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701469863.0 msldap-0.5.9/msldap/commons/utils.py0000664000175000017500000000567514532457247017060 0ustar00webdevwebdev import datetime import time import calendar def timestamp2datetime(dt) -> datetime.datetime: """ Converting Windows timestamps to datetime.datetime format :param dt: Windows timestamp as array of bytes :type dt: bytearray :return: datetime.datetime """ us = int.from_bytes(dt, byteorder='little')/ 10. return datetime.datetime(1601, 1, 1) + datetime.timedelta(microseconds=us) def datetime2timestamp(dt) -> int: delta = dt - datetime.datetime(1601, 1, 1) ns = int((delta / datetime.timedelta(microseconds=1)) * 10) return ns.to_bytes(8, 'little', signed = False) def wrap(s, w) -> str: return [s[i:i + w] for i in range(0, len(s), w)] def print_cert(cert, offset=0) -> str: cert = cert['tbs_certificate'] blanks = " " * offset msg = [ "Cert Subject: %s" % cert['subject']['common_name'], "Cert Serial: %s" % cert['serial_number'], "Cert Start: %s" % cert['validity']['not_before'], "Cert End: %s" % cert['validity']['not_after'], "Cert Issuer: %s" % cert['issuer']['common_name'], ] return "{}{}".format(blanks, "\n{}".format(blanks).join(msg)) def win_timestamp_to_unix(seconds): """ Convert Windows timestamp (100 ns since 1 Jan 1601) to unix timestamp. """ seconds = int(seconds) if seconds == 0: return 0 return int((seconds - 116444736000000000) / 10000000) def bh_dt_convert(dt:datetime.datetime): if dt is None or dt == 0 or dt == '0' or dt == '': return -1 ts = max(0,int(dt.timestamp())) return ts FUNCTIONAL_LEVELS = { 0: "2000 Mixed/Native", 1: "2003 Interim", 2: "2003", 3: "2008", 4: "2008 R2", 5: "2012", 6: "2012 R2", 7: "2016" } KNOWN_SIDS = { "S-1-0": "Null Authority", "S-1-0-0": "Nobody", "S-1-1": "World Authority", "S-1-1-0": "Everyone", "S-1-2": "Local Authority", "S-1-2-0": "Local", "S-1-3": "Creator Authority", "S-1-3-0": "Creator Owner", "S-1-3-1": "Creator Group", "S-1-3-4": "Owner Rights", "S-1-4": "Non-unique Authority", "S-1-5": "NT Authority", "S-1-5-1": "Dialup", "S-1-5-2": "Network", "S-1-5-3": "Batch", "S-1-5-4": "Interactive", "S-1-5-5-X-Y": "Logon Session", "S-1-5-6": "Service", "S-1-5-7": "Anonymous", "S-1-5-9": "Enterprise Domain Controllers", "S-1-5-10": "Principal Self", "S-1-5-11": "Authenticated Users", "S-1-5-12": "Restricted Code", "S-1-5-13": "Terminal Server Users", "S-1-5-14": "Remote Interactive Logon", "S-1-5-17": "IUSR", "S-1-5-18": "Local System", "S-1-5-19": "NT Authority Local Service", "S-1-5-20": "NT Authority Network Service", "S-1-5-32-544": "Administrators", "S-1-5-32-545": "Users", "S-1-5-32-546": "Guests", "S-1-5-32-547": "Power Users", "S-1-5-32-548": "Account Operators", "S-1-5-32-549": "Server Operators", "S-1-5-32-550": "Print Operators", "S-1-5-32-551": "Backup Operators", "S-1-5-32-552": "Replicators", "S-1-5-32-582": "Storage Replica Administrators", "S-1-5-64-10": "NTLM Authentication", "S-1-5-64-14": "SChannel Authentication", "S-1-5-64-21": "Digest Authentication", "S-1-5-80": "NT Service", } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/connection.py0000664000175000017500000006622614531630505016370 0ustar00webdevwebdevimport asyncio from typing import List, Dict from msldap import logger from msldap.commons.common import MSLDAPClientStatus from .commons.target import MSLDAPTarget from msldap.protocol.messages import LDAPMessage, BindRequest, \ protocolOp, AuthenticationChoice, SaslCredentials, \ SearchRequest, AttributeDescription, Filter, Filters, \ Controls, Control, SearchControlValue, AddRequest, \ ModifyRequest, DelRequest, ExtendedRequest, ExtendedResponse from msldap.protocol.utils import calcualte_length from msldap.protocol.typeconversion import convert_result, convert_attributes, encode_attributes, encode_changes from msldap.protocol.query import escape_filter_chars, query_syntax_converter from msldap.commons.authbuilder import get_auth_context from msldap.network.packetizer import LDAPPacketizer from asysocks.unicomm.common.target import UniProto from msldap.commons.exceptions import LDAPBindException, LDAPAddException, LDAPModifyException, LDAPDeleteException, LDAPSearchException from hashlib import sha256 from asysocks.unicomm.client import UniClient from asyauth.common.constants import asyauthProtocol from asyauth.common.credentials import UniCredential from asyauth.common.winapi.constants import ISC_REQ class MSLDAPClientConnection: def __init__(self, target:MSLDAPTarget, credential:UniCredential, auth=None): self.target = target self.credential = credential if auth is not None: self.auth = auth else: self.auth = get_auth_context(self.credential) self.connected = False self.bind_ok = False self.is_anon = False self.__sign_messages = False self.__encrypt_messages = False self.network = None self.connection_closed_evt = None self.handle_incoming_task = None self.status = MSLDAPClientStatus.RUNNING self.lasterror = None self.message_id = 0 self.message_table = {} self.message_table_notify = {} self.encryption_sequence_counter = 0 # this will be set by the inderlying auth algo self.cb_data = None #for channel binding if self.credential.protocol == asyauthProtocol.NONE: self.is_anon = True async def __aenter__(self): return self async def __aexit__(self, exc_type, exc, traceback): await asyncio.wait_for(self.disconnect(), timeout = 1) async def __handle_incoming(self): try: async for message_data in self.network.read(): #print('Incoming message data: %s' % message_data) if self.bind_ok is True: if self.__encrypt_messages is True: #removing size message_data = message_data[4:] try: # seq number doesnt matter here, a it's in the header message_data, err = await self.auth.decrypt(message_data, 0 ) if err is not None: raise err #print('Decrypted %s' % message_data.hex()) #print('Decrypted %s' % message_data) except: import traceback traceback.print_exc() raise elif self.__sign_messages is True: #print('Signed %s' % message_data) message_data = message_data[4:] try: message_data = await self.auth.unsign(message_data) # print('Unsinged %s' % message_data) except: import traceback traceback.print_exc() raise msg_len = calcualte_length(message_data) msg_total_len = len(message_data) messages = [] if msg_len == msg_total_len: message = LDAPMessage.load(message_data) messages.append(message) else: #print('multi-message!') while len(message_data) > 0: msg_len = calcualte_length(message_data) message = LDAPMessage.load(message_data[:msg_len]) messages.append(message) message_data = message_data[msg_len:] message_id = messages[0]['messageID'].native if message_id not in self.message_table: self.message_table[message_id] = [] self.message_table[message_id].extend(messages) if message_id not in self.message_table_notify: self.message_table_notify[message_id] = asyncio.Event() self.message_table_notify[message_id].set() except asyncio.CancelledError: self.status = MSLDAPClientStatus.STOPPED return except Exception as e: self.status = MSLDAPClientStatus.ERROR self.lasterror = e for msgid in self.message_table_notify: self.message_table[msgid] = [e] self.message_table_notify[msgid].set() finally: if self.connection_closed_evt is not None: self.connection_closed_evt.set() self.status = MSLDAPClientStatus.STOPPED async def send_message(self, message:Dict[str, object]): curr_msg_id = self.message_id self.message_id += 1 message['messageID'] = curr_msg_id message_data = LDAPMessage(message).dump() if self.bind_ok is True: if self.__encrypt_messages is True: message_data, signature = await self.auth.encrypt(message_data, self.encryption_sequence_counter) message_data = signature + message_data message_data = len(message_data).to_bytes(4, byteorder = 'big', signed = False) + message_data self.encryption_sequence_counter += 1 elif self.__sign_messages is True: signature = await self.auth.sign(message_data, self.encryption_sequence_counter) message_data = signature + message_data message_data = len(message_data).to_bytes(4, byteorder = 'big', signed = False) + message_data self.encryption_sequence_counter += 1 self.message_table_notify[curr_msg_id] = asyncio.Event() await self.network.write(message_data) return curr_msg_id async def recv_message(self, message_id:int): if message_id not in self.message_table_notify: logger.debug('Requested message id %s which is not in the message notify table!' % message_id) return None #print('Waiting for %s' % message_id) await self.message_table_notify[message_id].wait() #print(self.message_table) messages = self.message_table[message_id] #print('%s arrived!' % message_id) self.message_table[message_id] = [] self.message_table_notify[message_id].clear() return messages async def connect(self): """ Connects to the remote server. Establishes the session, but doesn't perform binding. This function MUST be called first before the `bind` operation. :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: logger.debug('Connecting!') self.connection_closed_evt = asyncio.Event() packetizer = LDAPPacketizer() client = UniClient(self.target, packetizer) self.network = await client.connect() # now processing channel binding options if self.target.protocol == UniProto.CLIENT_SSL_TCP: certdata = self.network.get_peer_certificate() self.cb_data = b'tls-server-end-point:' + sha256(certdata).digest() self.handle_incoming_task = asyncio.create_task(self.__handle_incoming()) self.status = MSLDAPClientStatus.CONNECTED logger.debug('Connection succsessful!') return True, None except Exception as e: return False, e async def disconnect(self): """ Tears down the connection. :return: Nothing :rtype: None """ logger.debug('Disconnecting!') self.bind_ok = False if self.connection_closed_evt is not None: self.connection_closed_evt.set() if self.network is not None: await self.network.close() await asyncio.sleep(0) if self.handle_incoming_task is not None: self.handle_incoming_task.cancel() def __bind_success(self): """ Internal function invoked after bind finished. Instructs the network layer that upcoming messages might be wrapped """ logger.debug('BIND Success!') self.bind_ok = True self.status = MSLDAPClientStatus.RUNNING if self.credential.protocol in [asyauthProtocol.NTLM, asyauthProtocol.KERBEROS, asyauthProtocol.SICILY]: self.__sign_messages = self.auth.signing_needed() self.__encrypt_messages = self.auth.encryption_needed() if self.__encrypt_messages or self.__sign_messages: self.network.packetizer.is_plain_msg = False async def bind(self): """ Performs the bind operation. This is where the authentication happens. Remember to call `connect` before this function! :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ logger.debug('BIND in progress...') try: if self.credential.protocol == asyauthProtocol.SICILY: flags = ISC_REQ.CONNECTION|ISC_REQ.CONFIDENTIALITY|ISC_REQ.INTEGRITY if self.target.protocol == UniProto.CLIENT_SSL_TCP: flags = ISC_REQ.CONNECTION data, to_continue, err = await self.auth.authenticate(None, spn=self.target.to_target_string(), flags=flags, cb_data = self.cb_data) if err is not None: return None, err auth = { 'sicily_disco' : b'' } bindreq = { 'version' : 3, 'name' : 'NTLM'.encode(), 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return False, res res = res.native if res['protocolOp']['resultCode'] != 'success': return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) auth = { 'sicily_nego' : data } bindreq = { 'version' : 3, 'name' : 'NTLM'.encode(), 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return False, res res = res.native if res['protocolOp']['resultCode'] != 'success': return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) data, to_continue, err = await self.auth.authenticate(res['protocolOp']['matchedDN'], spn=self.target.to_target_string(), cb_data = self.cb_data) if err is not None: return None, err auth = { 'sicily_resp' : data } bindreq = { 'version' : 3, 'name' : 'NTLM'.encode(), 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return False, res res = res.native if res['protocolOp']['resultCode'] != 'success': return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) self.__bind_success() return True, None elif self.credential.protocol == asyauthProtocol.SIMPLE: pw = b'' if self.auth.secret != None: pw = self.auth.secret.encode() user = b'' if self.auth.username != None: user = self.auth.username.encode() if user == b'': self.is_anon = True auth = { 'simple' : pw } bindreq = { 'version' : 3, 'name': user, 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return False, res res = res.native if res['protocolOp']['resultCode'] == 'success': self.__bind_success() return True, None else: return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) elif self.credential.protocol in [asyauthProtocol.NTLM, asyauthProtocol.KERBEROS]: challenge = None while True: try: flags = ISC_REQ.CONNECTION|ISC_REQ.CONFIDENTIALITY|ISC_REQ.INTEGRITY if self.target.protocol == UniProto.CLIENT_SSL_TCP: flags = ISC_REQ.CONNECTION data, to_continue, err = await self.auth.authenticate(challenge, cb_data = self.cb_data, spn=self.target.to_target_string(), flags=flags) if err is not None: raise err except Exception as e: return False, e sasl = { 'mechanism' : 'GSS-SPNEGO'.encode(), 'credentials' : data, } auth = { 'sasl' : SaslCredentials(sasl) } bindreq = { 'version' : 3, 'name': b'', 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return False, res res = res.native if res['protocolOp']['resultCode'] == 'success': if 'serverSaslCreds' in res['protocolOp']: data, _, err = await self.auth.authenticate(res['protocolOp']['serverSaslCreds'], cb_data = self.cb_data, spn=self.target.to_target_string(), flags=flags) if err is not None: return False, err if self.auth.encryption_needed() is True or self.auth.signing_needed() is True: self.encryption_sequence_counter = self.auth.get_seq_number() self.__bind_success() return True, None elif res['protocolOp']['resultCode'] == 'saslBindInProgress': challenge = res['protocolOp']['serverSaslCreds'] continue else: return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) elif self.credential.protocol == asyauthProtocol.SSL: if self.target.protocol == UniProto.CLIENT_SSL_TCP: self.__bind_success() return True, None elif self.target.protocol == UniProto.CLIENT_TCP: _, err = await self.starttls() if err is not None: return False, err sasl = { 'mechanism' : 'EXTERNAL'.encode(), } auth = { 'sasl' : SaslCredentials(sasl) } bindreq = { 'version' : 3, 'name': b'', 'authentication': AuthenticationChoice(auth), } br = { 'bindRequest' : BindRequest( bindreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) if isinstance(res[0], Exception): return False, res[0] resp = res[0].native['protocolOp'] if resp['resultCode'] != 'success': #startls refused :( return False, LDAPBindException( resp['resultCode'], resp['diagnosticMessage'] ) self.__bind_success() return True, None return False, Exception('Not implemented: %s' % self.credential.protocol.name) else: raise Exception('Not implemented authentication method: %s' % self.credential.protocol.name) except Exception as e: await self.disconnect() return False, e async def starttls(self): try: # https://www.ietf.org/rfc/rfc2830.txt ext = { 'requestName': b'1.3.6.1.4.1.1466.20037', } br = { 'extendedReq' : ExtendedRequest(ext)} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) if isinstance(res[0], Exception): return False, res[0] resp = res[0].native['protocolOp'] if resp['resultCode'] != 'success': #startls refused :( return False, LDAPBindException( resp['resultCode'], resp['diagnosticMessage'] ) self.handle_incoming_task.cancel() await asyncio.sleep(0) await self.network.wrap_ssl(self.target.get_ssl_context()) self.handle_incoming_task = asyncio.create_task(self.__handle_incoming()) self.status = MSLDAPClientStatus.CONNECTED await asyncio.sleep(0) return True, None except Exception as e: print(e) return False, e async def add(self, entry:str, attributes:Dict[str, object]): """ Performs the add operation. :param entry: The DN of the object to be added :type entry: str :param attributes: Attributes to be used in the operation :type attributes: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: req = { 'entry' : entry.encode(), 'attributes' : encode_attributes(attributes) } logger.debug(req) br = { 'addRequest' : AddRequest(req)} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) results = await self.recv_message(msg_id) if isinstance(results[0], Exception): return False, results[0] for message in results: msg_type = message['protocolOp'].name message = message.native if msg_type == 'addResponse': if message['protocolOp']['resultCode'] != 'success': return False, LDAPAddException( entry, message['protocolOp']['resultCode'], message['protocolOp']['diagnosticMessage'] ) return True, None except Exception as e: return False, e async def modify(self, entry:str, changes:Dict[str, object], controls:List[Control] = None): """ Performs the modify operation. :param entry: The DN of the object whose attributes are to be modified :type entry: str :param changes: Describes the changes to be made on the object. Must be a dictionary of the following format: {'attribute': [('change_type', [value])]} :type changes: dict :param controls: additional controls to be passed in the query :type controls: List[class:`Control`] :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: req = { 'object' : entry.encode(), 'changes' : encode_changes(changes) } br = { 'modifyRequest' : ModifyRequest(req)} msg = { 'protocolOp' : protocolOp(br)} if controls is not None: msg['controls'] = controls msg_id = await self.send_message(msg) results = await self.recv_message(msg_id) if isinstance(results[0], Exception): return False, results[0] for message in results: msg_type = message['protocolOp'].name message = message.native if msg_type == 'modifyResponse': if message['protocolOp']['resultCode'] != 'success': return False, LDAPModifyException( entry, message['protocolOp']['resultCode'], message['protocolOp']['diagnosticMessage'] ) return True, None except Exception as e: return False, e async def delete(self, entry:str): """ Performs the delete operation. :param entry: The DN of the object to be deleted :type entry: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) """ try: br = { 'delRequest' : DelRequest(entry.encode())} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) results = await self.recv_message(msg_id) if isinstance(results[0], Exception): return False, results[0] for message in results: msg_type = message['protocolOp'].name message = message.native if msg_type == 'delResponse': if message['protocolOp']['resultCode'] != 'success': return False, LDAPDeleteException( entry, message['protocolOp']['resultCode'], message['protocolOp']['diagnosticMessage'] ) return True, None except Exception as e: return False, e async def search(self, base:str, query:str, attributes:List[str], search_scope:int = 2, size_limit:int = 1000, types_only:bool = False, derefAliases:int = 0, timeLimit:int = None, controls:List[Control] = None, return_done:bool = False): """ Performs the search operation. :param base: base tree on which the search should be performed :type base: str :param query: filter query that defines what should be searched for :type query: str :param attributes: a list of attributes to be included in the response :type attributes: List[str] :param search_scope: Specifies the search operation's scope. Default: 2 (Subtree) :type search_scope: int :param types_only: indicates whether the entries returned should include attribute types only or both types and values. Default: False (both) :type types_only: bool :param size_limit: Size limit of result elements per query. Default: 1000 :type size_limit: int :param derefAliases: Specifies the behavior on how aliases are dereferenced. Default: 0 (never) :type derefAliases: int :param timeLimit: Maximum time the search should take. If time limit reached the server SHOULD return an error :type timeLimit: int :param controls: additional controls to be passed in the query :type controls: List[class:`Control`] :param return_done: Controls wether the final 'done' LDAP message should be returned, or just the actual results :type return_done: bool :return: Async generator which yields (`LDAPMessage`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`LDAPMessage`, :class:`Exception`)] """ if self.status not in [MSLDAPClientStatus.CONNECTED, MSLDAPClientStatus.RUNNING]: yield None, Exception('Connection not running! Probably encountered an error') return try: if timeLimit is None: timeLimit = 600 #not sure flt = query_syntax_converter(query) searchreq = { 'baseObject' : base.encode(), 'scope': search_scope, 'derefAliases': derefAliases, 'sizeLimit': size_limit, 'timeLimit': timeLimit, 'typesOnly': types_only, 'filter': flt, 'attributes': attributes, } br = { 'searchRequest' : SearchRequest( searchreq )} msg = { 'protocolOp' : protocolOp(br)} if controls is not None: msg['controls'] = controls msg_id = await self.send_message(msg) while True: results = await self.recv_message(msg_id) for message in results: msg_type = message['protocolOp'].name message = message.native if msg_type == 'searchResDone': if return_done is True: yield (message, None) break elif msg_type == 'searchResRef': #TODO: Check if we need to deal with this further continue if return_done is True: yield (message, None) else: yield (convert_result(message['protocolOp']), None) else: continue break except Exception as e: yield (None, e) async def pagedsearch(self, base:str, query:str, attributes:List[str], search_scope:int = 2, size_limit:int = 1000, typesOnly:bool = False, derefAliases:bool = 0, timeLimit:int = None, controls:List[Control] = None, rate_limit:int = 0): """ Paged search is the same as the search operation and uses it under the hood. Adds automatic control to read all results in a paged manner. :param base: base tree on which the search should be performed :type base: str :param query: filter query that defines what should be searched for :type query: str :param attributes: a list of attributes to be included in the response :type attributes: List[str] :param search_scope: Specifies the search operation's scope. Default: 2 (Subtree) :type search_scope: int :param types_only: indicates whether the entries returned should include attribute types only or both types and values. Default: False (both) :type types_only: bool :param size_limit: Size limit of result elements per query. Default: 1000 :type size_limit: int :param derefAliases: Specifies the behavior on how aliases are dereferenced. Default: 0 (never) :type derefAliases: int :param timeLimit: Maximum time the search should take. If time limit reached the server SHOULD return an error :type timeLimit: int :param controls: additional controls to be passed in the query :type controls: dict :param rate_limit: time to sleep bwetween each query :type rate_limit: float :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] """ if self.status != MSLDAPClientStatus.RUNNING: yield None, Exception('Connection not running! Probably encountered an error') return try: cookie = b'' while True: await asyncio.sleep(rate_limit) ctrl_list_temp = [ Control({ 'controlType' : b'1.2.840.113556.1.4.319', 'controlValue': SearchControlValue({ 'size' : size_limit, 'cookie': cookie }).dump() }) ] if controls is not None: ctrl_list_temp.extend(controls) ctrs = Controls( ctrl_list_temp ) async for res, err in self.search( base, query, attributes, search_scope = search_scope, size_limit=size_limit, types_only=typesOnly, derefAliases=derefAliases, timeLimit=timeLimit, controls = ctrs, return_done = True ): if err is not None: yield (None, err) return if 'resultCode' in res['protocolOp']: if res['protocolOp']['resultCode'] != 'success': raise LDAPSearchException(res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage']) for control in res['controls']: if control['controlType'] == b'1.2.840.113556.1.4.319': try: cookie = SearchControlValue.load(control['controlValue']).native['cookie'] except Exception as e: raise e break else: raise Exception('SearchControl missing from server response!') else: yield (convert_result(res['protocolOp']), None) if cookie == b'': break except Exception as e: yield (None, e) async def whoami(self): if self.status != MSLDAPClientStatus.RUNNING: return None, Exception('Connection not running! Probably encountered an error') ext = { 'requestName': b'1.3.6.1.4.1.4203.1.11.3', } br = { 'extendedReq' : ExtendedRequest(ext)} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return None, res if res.native['protocolOp']['resultCode'] != 'success': return False, LDAPBindException( res['protocolOp']['resultCode'], res['protocolOp']['diagnosticMessage'] ) return res.native['protocolOp']['responseValue'].decode(), None async def get_serverinfo(self): if self.status not in [MSLDAPClientStatus.CONNECTED, MSLDAPClientStatus.RUNNING]: return None, Exception('Connection not running! Probably encountered an error') attributes = [ b'subschemaSubentry', b'dsServiceName', b'namingContexts', b'defaultNamingContext', b'schemaNamingContext', b'configurationNamingContext', b'rootDomainNamingContext', b'supportedControl', b'supportedLDAPVersion', b'supportedLDAPPolicies', b'supportedSASLMechanisms', b'dnsHostName', b'ldapServiceName', b'serverName', b'supportedCapabilities' ] filt = { 'present' : 'objectClass'.encode() } searchreq = { 'baseObject' : b'', 'scope': 0, 'derefAliases': 0, 'sizeLimit': 1, 'timeLimit': self.target.timeout - 1, 'typesOnly': False, 'filter': Filter(filt), 'attributes': attributes, } br = { 'searchRequest' : SearchRequest( searchreq )} msg = { 'protocolOp' : protocolOp(br)} msg_id = await self.send_message(msg) res = await self.recv_message(msg_id) res = res[0] if isinstance(res, Exception): return None, res return convert_attributes(res.native['protocolOp']['attributes']), None ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/examples/0000775000175000017500000000000014535076203015464 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/examples/__init__.py0000664000175000017500000000007614531630505017575 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/examples/jsontest.py0000664000175000017500000001310414531630505017703 0ustar00webdevwebdevimport json from tqdm import tqdm def compare_links(l1, l2): for entry in l1: if not isinstance(entry, dict): print('TYPE_MISSMATCH', f"{entry} not a dict") else: for ce in l2: if ce['GUID'] == entry['GUID'] and ce['IsEnforced'] == entry['IsEnforced']: break else: print('MISSING_LINK', f"{entry['GUID']} not in l2") def compare_aces(l1, l2): for entry in l1: if not isinstance(entry, dict): print('TYPE_MISSMATCH', f"{entry} not a dict") else: for ce in l2: if ce['PrincipalSID'] == entry['PrincipalSID'] and ce['PrincipalType'] == entry['PrincipalType'] and ce['RightName'] == entry['RightName'] and ce['IsInherited'] == entry['IsInherited']: #print('MATCH', f"{entry['PrincipalSID']} in l2") break else: print('MISSING_ACE', f"{entry['PrincipalSID']} not in l2") def compare_objlist(ctype, l1, l2): for entry in l1: if not isinstance(entry, dict): print('TYPE_MISSMATCH %s' % ctype, f"{entry} not a dict") else: for ce in l2: if ce['ObjectIdentifier'] == entry['ObjectIdentifier'] and ce['ObjectType'] == entry['ObjectType']: #print('MATCH', f"{entry['ObjectIdentifier']} in l2") break else: print('MISSING_%s' % ctype, f"{entry['ObjectIdentifier']} not in l2") def compare_dict(label, d1, d2): #print('Checking %s' % label) for k in d1: #print('Checking %s -> %s' % (label, k)) if k not in d2: yield ('MISSING_PARAM',k, f"{k} not in dict") if isinstance(d1[k], (str, int, float, bool)): if k not in d2: yield ('MISSING_PARAM', k, f"'{k}' not in dict") else: #print('Checking %s -> %s Exists!' % (label, k)) if d2[k] != d1[k]: yield ('NOT_EQ', k, f"'{k}' value not equal in dict. D1: {d1[k]} D2: {d2[k]}") #else: # print('Checking %s -> %s Matches!' % (label, k)) if isinstance(d1[k], list): if k not in d2: yield ('MISSING_PARAM', k, f"'{k}' not in dict") else: #print('Checking %s -> %s Exists!' % (label, k)) if isinstance(d2[k], list): if(len(d1[k]) != len(d2[k])): yield ('NOT_EQ', k, f"'{k}' length not equal in dict. D1: d1[{k}] D2: d2[{k}]") if k == 'Links': compare_links(d1[k], d2[k]) elif k == 'Aces': compare_aces(d1[k], d2[k]) elif k in ['ChildObjects', 'Members']: compare_objlist(k,d1[k], d2[k]) else: for i, item in enumerate(d1[k]): if i >= len(d2[k]): yield ('MISSING_PARAM', f"'{k}[{i}]'", f"'{k}[{i}]' not in dict") else: for k2 in item: if k2 not in d2[k][i]: yield ('MISSING_PARAM', f"'{k}[{i}][{k2}]'", f"'{k}[{i}][{k2}]' not in dict") else: yield ('TYPE_MISMATCH', k, f"{k} not a list in dict. D1: {d1[k]} D2: {d2[k]}") if isinstance(d1[k], dict): if k not in d2: yield ('MISSING_PARAM', k, f"'{k}' not in dict") else: if isinstance(d2[k], dict): compare_dict('%s -> %s' % (label, k), d1[k], d2[k]) else: yield ('TYPE_MISMATCH', k, f"{k} not a dict in dict") filelist = [ ('/home/webdev/Desktop/comparer/good/good_domains.json', '/home/webdev/Desktop/projects/msldap/domains.json'), ('/home/webdev/Desktop/comparer/good/good_groups.json', '/home/webdev/Desktop/projects/msldap/groups.json'), #('/home/webdev/Desktop/comparer/good/good_users.json', '/home/webdev/Desktop/projects/msldap/users.json'), ('/home/webdev/Desktop/comparer/good/good_computers.json', '/home/webdev/Desktop/projects/msldap/computers.json'), ('/home/webdev/Desktop/comparer/good/good_containers.json', '/home/webdev/Desktop/projects/msldap/containers.json'), ('/home/webdev/Desktop/comparer/good/good_gpos.json', '/home/webdev/Desktop/projects/msldap/gpos.json'), ('/home/webdev/Desktop/comparer/good/good_ous.json', '/home/webdev/Desktop/projects/msldap/ous.json'), ] for filetuple in filelist: print('Comparing %s to %s' % filetuple) with open(filetuple[0]) as f: f.seek(3) json2 = json.load(f) print('Loading test file...') with open(filetuple[1]) as f: json1 = json.load(f) bypass_diff = { 'NOT_EQ': { 'whencreated': 1 } } total = len(json2['data']) pbar = tqdm(total=total) for guser in json2['data']: pbar.update(1) for user in json1['data']: if user['ObjectIdentifier'] == guser['ObjectIdentifier']: #print(user['Aces']) #print(guser['Aces']) for diff_type, param_name, desc in compare_dict(guser['ObjectIdentifier'], guser, user): if diff_type in bypass_diff: if param_name in bypass_diff[diff_type]: continue print('%s -> %s' % (user['ObjectIdentifier'], desc)) #input() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701937323.0 msldap-0.5.9/msldap/examples/msldapbloodhound.py0000664000175000017500000000111714534300253021366 0ustar00webdevwebdevimport asyncio from msldap.bloodhound import MSLDAPDump2Bloodhound async def amain(): args = parser.parse_args() msldap = MSLDAPDump2Bloodhound(args.url) await msldap.run() if __name__ == '__main__': import argparse parser = argparse.ArgumentParser(description='Bloodhound collector for MSLDAP') parser.add_argument('url', help='LDAP connection URL, or ADEXPLORER dat file path in the form adexplorer://') print(""" WARNING: This script is still in development. It is not guaranteed to provide the same results as the original Bloodhound collector. """) asyncio.run(amain()) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701469935.0 msldap-0.5.9/msldap/examples/msldapclient.py0000664000175000017500000014317314532457357020540 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import asyncio import traceback import logging import shlex import datetime import copy import typing import json import base64 import zipfile import os from asysocks.unicomm.common.target import UniTarget from asyauth.common.credentials import UniCredential from msldap.external.aiocmd.aiocmd import aiocmd from msldap.external.asciitree.asciitree import LeftAligned from tqdm import tqdm from msldap import logger from asysocks import logger as sockslogger from asyauth import logger as authlogger from msldap.client import MSLDAPClient from msldap.commons.factory import LDAPConnectionFactory from msldap.ldap_objects import MSADUser, MSADMachine, MSADUser_TSV_ATTRS, \ MSADMachine_ATTRS, MSADGroup_ATTRS, MSADOU_ATTRS, MSADInfo_ATTRS, \ MSADContainer_ATTRS, MSADGPO_ATTRS, MSADDomainTrust_ATTRS from msldap.examples.utils.completers import PathCompleter from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR, SE_SACL from winacl.dtyp.ace import ACCESS_ALLOWED_OBJECT_ACE, ADS_ACCESS_MASK, AceFlags,\ ACE_OBJECT_PRESENCE, ACEType, ACCESS_ALLOWED_ACE, ACCESS_DENIED_ACE from winacl.dtyp.sid import SID from winacl.dtyp.guid import GUID from winacl.dtyp.acl import ACL from msldap.ldap_objects.adcertificatetemplate import MSADCertificateTemplate,\ EX_RIGHT_CERTIFICATE_ENROLLMENT, CertificateNameFlag from msldap.wintypes.asn1.sdflagsrequest import SDFlagsRequest from tabulate import tabulate from msldap.commons.exceptions import LDAPSearchException class MSLDAPClientConsole(aiocmd.PromptToolkitCmd): def __init__(self, url = None): aiocmd.PromptToolkitCmd.__init__(self, ignore_sigint=False) #Setting this to false, since True doesnt work on windows... self.conn_url = url if url is not None and isinstance(url, LDAPConnectionFactory) is False: self.conn_url = LDAPConnectionFactory.from_url(url) self.connection = None self.adinfo = None self.ldapinfo = None self.domain_name = None self.__current_dirs = {} self._current_dn = None async def do_login(self, url = None): """Performs connection and login""" try: if self.conn_url is None and url is None: print('No URL was set, cant do logon') if url is not None and isinstance(url, LDAPConnectionFactory) is False: self.conn_url = LDAPConnectionFactory.from_url(url) logger.debug(self.conn_url.get_credential()) logger.debug(self.conn_url.get_target()) self.connection = self.conn_url.get_client() self.connection.keepalive = True _, err = await self.connection.connect() if err is not None: raise err logger.debug('BIND OK!') self.prompt = '[%s]> ' % (self.connection._tree,) self._current_dn = self.connection._tree if self.connection._con.is_anon is False: await self.do_cd(self._current_dn) else: print('Anonymous connection. Most functionalities will not work!') return True except: traceback.print_exc() return False async def do_ldapinfo(self, show = True): """Prints detailed LDAP connection info (DSA)""" try: if self.ldapinfo is None: self.ldapinfo = self.connection.get_server_info() if show is True: for k in self.ldapinfo: if isinstance(self.ldapinfo[k], list): for item in self.ldapinfo[k]: print('%s : %s' % (k, item)) else: print('%s : %s' % (k, self.ldapinfo[k])) return True except: traceback.print_exc() return False async def do_adinfo(self, show = True): """Prints detailed Active Driectory info""" try: if self.adinfo is None: self.adinfo = self.connection._ldapinfo self.domain_name = self.adinfo.distinguishedName.replace('DC','').replace('=','').replace(',','.') if show is True: print(self.adinfo) return True except: traceback.print_exc() return False async def do_spns(self): """Fetches kerberoastable user accounts""" try: await self.do_ldapinfo(False) async for user, err in self.connection.get_all_service_users(): if err is not None: raise err print(user.sAMAccountName) return True except: traceback.print_exc() return False async def do_asrep(self): """Fetches ASREP-roastable user accounts""" try: await self.do_ldapinfo(False) async for user, err in self.connection.get_all_knoreq_users(): if err is not None: raise err print(user.sAMAccountName) return True except: traceback.print_exc() return False async def do_computeraddr(self): """Fetches all computer accounts""" try: await self.do_adinfo(False) #machine_filename = '%s_computers_%s.txt' % (self.domain_name, datetime.datetime.now().strftime("%Y%m%d-%H%M%S")) async for machine, err in self.connection.get_all_machines(attrs=['sAMAccountName', 'dNSHostName']): if err is not None: raise err dns = machine.dNSHostName if dns is None: dns = '%s.%s' % (machine.sAMAccountName[:-1], self.domain_name) print(str(dns)) return True except: traceback.print_exc() return False async def do_dump(self): """Fetches ALL user and machine accounts from the domain with a LOT of attributes""" zip_filename = 'dump_%s.zip' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") try: await self.do_adinfo(False) await self.do_ldapinfo(False) tname = 'domain_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADInfo_ATTRS)+'\r\n') adinfo, err = await self.connection.get_ad_info() if err is not None: raise err f.write('\t'.join(adinfo.get_row(MSADInfo_ATTRS))+'\r\n') print('Adinfo was written to %s' % users_filename) with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'schema_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.json' % tname try: pbar = tqdm(desc = 'Writing schema to file %s' % users_filename) schema = {} with open(users_filename, 'w', newline='', encoding = 'utf8') as f: async for user, err in self.connection.get_all_schemaentry(['name', 'schemaidguid']): if err is not None: raise err pbar.update() schema[user.name.lower()] = str(user.schemaIDGUID) json.dump(schema, f) print('Schema dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'trusts_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing trusts to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADDomainTrust_ATTRS)+'\r\n') async for user, err in self.connection.get_all_trusts(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADDomainTrust_ATTRS))+'\r\n') print('Trust dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'users_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing users to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADUser_TSV_ATTRS)+'\r\n') async for user, err in self.connection.get_all_users(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADUser_TSV_ATTRS))+'\r\n') print('Users dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'computers_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing computers to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADMachine_ATTRS)+'\r\n') async for user, err in self.connection.get_all_machines(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADMachine_ATTRS))+'\r\n') print('Computer dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'groups_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing groups to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADGroup_ATTRS)+'\r\n') async for user, err in self.connection.get_all_groups(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADGroup_ATTRS))+'\r\n') print('Group dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'ous_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing OUs to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADOU_ATTRS)+'\r\n') async for user, err in self.connection.get_all_ous(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADOU_ATTRS))+'\r\n') print('OU dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'containers_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing Containers to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADContainer_ATTRS)+'\r\n') async for user, err in self.connection.get_all_containers(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADContainer_ATTRS))+'\r\n') print('Container dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass tname = 'gpos_%s' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") users_filename = '%s.tsv' % tname try: pbar = tqdm(desc = 'Writing GPOs to file %s' % users_filename) with open(users_filename, 'w', newline='', encoding = 'utf8') as f: f.write('\t'.join(MSADOU_ATTRS)+'\r\n') async for user, err in self.connection.get_all_gpos(): if err is not None: raise err pbar.update() f.write('\t'.join(user.get_row(MSADGPO_ATTRS))+'\r\n') print('GPO dump was written to %s' % users_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(users_filename, arcname = users_filename) finally: try: os.remove(users_filename) except: pass try: dns_filename = 'dns_%s.tsv' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") pbar = tqdm(desc = 'Writing DNS records to file %s' % dns_filename) with open(dns_filename, 'w', newline='', encoding = 'utf8') as f: async for zonedn, name, dnsrecod, err in self.connection.dnsentries(): if err is not None: raise err dnsdataobj = dnsrecod.get_formatted() line = '\t'.join([zonedn, name, dnsrecod.Type.name, dnsdataobj.to_line()]) f.write(line + '\r\n') pbar.update(1) print('DNS dump was written to %s' % dns_filename) pbar.close() with zipfile.ZipFile(zip_filename, 'a', compression=zipfile.ZIP_LZMA) as dz: dz.write(dns_filename, arcname = dns_filename) finally: try: os.remove(dns_filename) except: pass print('All dumps were written to %s' % zip_filename) return True except: traceback.print_exc() return False def get_current_dirs(self): if self.__current_dirs is None: return [] curdirs = [] for dirname in self.__current_dirs: if dirname.find(' ') != -1: dirname = "'%s'" % dirname curdirs.append(dirname) return curdirs def _cd_completions(self): return PathCompleter(get_current_dirs = self.get_current_dirs) async def do_cd(self, path): """Change current work directory""" original_path = self._current_dn try: if path == '.': self._current_dn = original_path elif path == '..': #this is not a good solution but I don't have to to write a proper DN parser... #TODO: implement DN parsing self._current_dn = original_path[original_path.find(',')+1:] else: self._current_dn = path if path in self.__current_dirs: self._current_dn = self.__current_dirs[path] tree_data = await self.connection.get_tree_plot(self._current_dn, level=1) root = list(tree_data.keys())[0] self.__current_dirs = {} for dn in tree_data[root].keys(): lookup_dn = dn[:-(len(self._current_dn)+1)] self.__current_dirs[lookup_dn] = dn self.prompt = '[%s]> ' % (self._current_dn,) return True except Exception as e: print('Change directory error! %s' % e) self._current_dn = original_path self.prompt = '[%s]> ' % (self._current_dn,) return False async def do_ls(self, fullpath = False): """Print objects in current work directory""" for dn in self.__current_dirs: entry = dn if fullpath is not False: entry = self.__current_dirs[dn] print(entry) return True async def do_cat(self, attributes="*", dn=''): """Print attributes of object. Without arguments it will cat the current DN""" attributes = attributes.split(",") if dn == '': dn = self._current_dn async for entry, err in self.connection.pagedsearch(query="(distinguishedName=%s)"%dn, attributes=attributes, tree=dn): if err is not None: raise err for attr in entry["attributes"]: if type(entry["attributes"][attr]) == list: for i, val in enumerate(entry["attributes"][attr]): print("%s [%s]: %s" % (attr, i, val)) else: val = entry["attributes"][attr] print("%s: %s" % (attr, val)) return True async def do_modify(self, dn, attribute, value): """Modify an attribute of object. Only works with string data types!""" changes = { attribute : [('replace', value)] } _, err = await self.connection.modify(dn, changes) if err is not None: raise err print('Modify OK!') return True async def do_query(self, query, attributes = "-"): """Performs a raw LDAP query against the server. Secondary parameter is the requested attributes SEPARATED WITH COMMA (,)""" try: await self.do_ldapinfo(False) if attributes is None: attributes = '*' if attributes.find(','): attributes = attributes.split(',') logging.debug('Query: %s' % (query)) logging.debug('Attributes: %s' % (attributes)) async for entry, err in self.connection.pagedsearch(query, attributes): if err is not None: raise err print(entry) return True except: traceback.print_exc() return False async def do_tree(self, dn = None, level = 1): """Prints a tree from the given DN (if not set, the top) and with a given depth (default: 1)""" try: await self.do_ldapinfo(False) if level is None: level = 1 level = int(level) if dn is not None: try: int(dn) except: pass else: level = int(dn) dn = None if dn is None: await self.do_ldapinfo(False) dn = self.connection._tree logging.debug('Tree on %s' % dn) tree_data = await self.connection.get_tree_plot(dn, level) tr = LeftAligned() print(tr(tree_data)) return True except: traceback.print_exc() return False async def do_user(self, samaccountname, to_print=True): """Feteches a user object based on the sAMAccountName of the user""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) user, err = await self.connection.get_user(samaccountname) if err is not None: raise err if to_print is True: if user is None: print('User not found!') else: print(user) return user except: traceback.print_exc() return False async def do_machine(self, samaccountname): """Feteches a machine object based on the sAMAccountName of the machine""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) machine, err = await self.connection.get_machine(samaccountname) if err is not None: raise err if machine is None: print('machine not found!') else: print(machine) ####TEST x = SECURITY_DESCRIPTOR.from_bytes(machine.allowedtoactonbehalfofotheridentity) print(x) return True except: traceback.print_exc() return False async def do_schemaentry(self, cn): """Feteches a schema object entry object based on the DN of the object (must start with CN=)""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) schemaentry, err = await self.connection.get_schemaentry(cn) if err is not None: raise err print(str(schemaentry)) return True except: traceback.print_exc() return False async def do_allschemaentry(self): """Feteches all schema object entry objects""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) async for schemaentry, err in self.connection.get_all_schemaentry(): if err is not None: raise err print(str(schemaentry)) return True except: traceback.print_exc() return False async def do_sam2dn(self, sAMAccountName): """Fetches the DN of an object based on the sAMAccountName""" dn, err = await self.connection.sam2dn(sAMAccountName) if err is not None: raise err print(dn) return True async def do_sid2dn(self, sid): """Fetches the DN of an object based on the objectSid""" dn, err = await self.connection.sid2dn(sid) if err is not None: raise err print(dn) return True async def do_dn2sid(self, dn): """Fetches the objectSid of an object based on the DN""" sid, err = await self.connection.dn2sid(dn) if err is not None: raise err print(sid) return True async def do_dn2sam(self, dn): """Fetches the sAMAccountName of an object based on the DN""" sam, err = await self.connection.dn2sam(dn) if err is not None: raise err print(sam) return True async def do_dadms(self): """Lists all members of the domain administrators group""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) dn, err = await self.connection.sid2dn(self.adinfo.objectSid + '-512') if err is not None: raise err async for obj, err in self.connection.get_group_members(dn, recursive=True): if err is not None: raise err print(obj.distinguishedName) return True except: traceback.print_exc() return False async def do_groupmembers(self, dn, recursive = True): """Returns all member users in a group specified by DN""" try: if recursive is not False or recursive != '0': recursive = True async for obj, err in self.connection.get_group_members(dn, recursive=recursive): if err is not None: raise err print(obj.distinguishedName) return True except Exception as e: traceback.print_exc() return False async def do_addallowedtoactonbehalfofotheridentity(self, target_dn, other_identity_sid): """Adds a SID to the msDS-AllowedToActOnBehalfOfOtherIdentity protperty of target_dn""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) try: computer_sid = SID.from_string(other_identity_sid) except: print('Incorrect SID!') return False, Exception('Incorrect SID') query = '(distinguishedName=%s)' % target_dn async for entry, err in self.connection.pagedsearch(query, ['msDS-AllowedToActOnBehalfOfOtherIdentity', 'objectSid']): if err is not None: raise err if 'msDS-AllowedToActOnBehalfOfOtherIdentity' not in entry['attributes']: print('Attribute does not exist on the current object, crafing new SD') target_sd = SECURITY_DESCRIPTOR() target_sd.Control = SE_SACL.SE_DACL_PRESENT | SE_SACL.SE_SELF_RELATIVE target_sd.Owner = SID.from_string('S-1-5-32-544') target_sd.Group = None target_sd.Sacl = None target_sd.Dacl = ACL() target_sd.Dacl.AclRevision = 4 target_sd.Dacl.Sbz1 = 0 target_sd.Dacl.Sbz2 = 0 else: target_sd = SECURITY_DESCRIPTOR.from_bytes(entry['attributes']['msDS-AllowedToActOnBehalfOfOtherIdentity']) break else: print('Target DN not found!') return False, Exception('Target DN not found!') # checking if account is already there for ace in target_sd.Dacl.aces: if ace.Sid == computer_sid: print('Account is already there!') return False, Exception('Account is already there!') print('Constructing new ACE') ace = ACCESS_ALLOWED_ACE() ace.AceFlags = 0 #ace.AceSize = 0 ace.Mask = 983551 ace.Sid = computer_sid new_sd = copy.deepcopy(target_sd) new_sd.Dacl.aces.append(ace) changes = { 'msDS-AllowedToActOnBehalfOfOtherIdentity' : [('replace', new_sd.to_bytes())] } _, err = await self.connection.modify(target_dn, changes) if err is not None: raise err print('Change OK!') except: traceback.print_exc() async def do_changeowner(self, new_owner_sid, target_dn, target_attribute = None): """Changes the owner in a Security Descriptor to the new_owner_sid on an LDAP object or on an LDAP object's attribute identified by target_dn and target_attribute. target_attribute can be omitted to change the target_dn's SD's owner""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) _, err = await self.connection.change_priv_owner(new_owner_sid, target_dn, target_attribute = target_attribute) if err is not None: raise err except: traceback.print_exc() return False async def do_addprivdcsync(self, user_dn, forest = None): """Adds DCSync rights to the given user by modifying the forest's Security Descriptor to add GetChanges and GetChangesAll ACE""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) _, err = await self.connection.add_priv_dcsync(user_dn, self.adinfo.distinguishedName) if err is not None: raise err print('Change OK!') return True except: traceback.print_exc() return False async def do_addprivaddmember(self, user_dn, group_dn): """Adds AddMember rights to the user on the group specified by group_dn""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) _, err = await self.connection.add_priv_addmember(user_dn, group_dn) if err is not None: raise err print('Change OK!') return True except: traceback.print_exc() return False async def do_setsd(self, target_dn, sddl): """Updates the security descriptor of an object""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) try: new_sd = SECURITY_DESCRIPTOR.from_sddl(sddl) except: print('Incorrect SDDL input!') return False, Exception('Incorrect SDDL input!') _, err = await self.connection.set_objectacl_by_dn(target_dn, new_sd.to_bytes()) if err is not None: raise err print('Change OK!') return True except: print('Erro while updating security descriptor!') traceback.print_exc() return False async def do_getsd(self, dn, opts=' '): """Feteches security info for a given DN""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) sec_info, err = await self.connection.get_objectacl_by_dn(dn) if err is not None: raise err sd = SECURITY_DESCRIPTOR.from_bytes(sec_info) domain, username, err = await self.connection.resolv_sid(sd.Owner.to_sddl()) print("OWNER: %s\\%s" % (domain, username)) domain, username, err = await self.connection.resolv_sid(sd.Group.to_sddl()) print("GROUP: %s\\%s" % (domain, username)) out = [] for ace in sd.Dacl.aces: if SID.wellknown_sid_lookup(ace.Sid.to_sddl()): canonical = SID.wellknown_sid_lookup(ace.Sid.to_sddl()) else: domain, username, err = await self.connection.resolv_sid(ace.Sid.to_sddl()) if username != '???': canonical = '%s\\%s' % (domain, username) else: canonical = ace.Sid.to_sddl() if opts[0] == 'g': row = [] for line in str(ace).split("\n"): row.append(line.split(":")[-1]) out.append([canonical] + row) elif opts[0] == 'p': for line in str(ace).split("\n"): out.append([canonical, line]) if opts[0] == 'g': print(tabulate(out, headers=["Who","Type","Flags","SID","Mask","ObjectType","InheritedObjectType","ObjectFlags","ACType",""])) elif opts[0] == 'p': print(tabulate(out, headers=["Who","ACE"])) else: print(sd.to_sddl()) return True except: traceback.print_exc() return False async def do_gpos(self): """Feteches security info for a given DN""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) async for gpo, err in self.connection.get_all_gpos(): if err is not None: raise err print(gpo) return True except: traceback.print_exc() return False async def do_laps(self): """Feteches all laps passwords""" try: # trying to get the old version LAPS async for entry, err in self.connection.get_all_laps(): if err is not None: raise err if 'ms-Mcs-AdmPwd' in entry['attributes']: pwd = entry['attributes']['ms-Mcs-AdmPwd'] print('%s : %s' % (entry['attributes']['cn'], pwd)) # now trying to get the new version LAPS async for entry, err in self.connection.get_all_laps_windows(): if err is not None: raise err if 'msLAPS-Password' in entry['attributes']: pwd = entry['attributes']['msLAPS-Password'] print('%s : %s' % (entry['attributes']['cn'], pwd)) if 'msLAPS-EncryptedPassword' in entry['attributes']: pwd = entry['attributes']['msLAPS-EncryptedPassword'] print('%s : %s' % (entry['attributes']['cn'], pwd.hex())) if 'msLAPS-EncryptedPasswordHistory' in entry['attributes']: pwd = entry['attributes']['msLAPS-EncryptedPasswordHistory'] print('%s : %s' % (entry['attributes']['cn'], pwd)) if 'msLAPS-EncryptedDSRMPassword' in entry['attributes']: pwd = entry['attributes']['msLAPS-EncryptedDSRMPassword'] print('%s : %s' % (entry['attributes']['cn'], pwd)) if 'msLAPS-EncryptedDSRMPasswordHistory' in entry['attributes']: pwd = entry['attributes']['msLAPS-EncryptedDSRMPasswordHistory'] print('%s : %s' % (entry['attributes']['cn'], pwd)) return True except: traceback.print_exc() return False async def do_groupmembership(self, dn): """Feteches names all groupnames the user is a member of for a given DN""" try: await self.do_ldapinfo(False) await self.do_adinfo(False) group_sids = [] async for group_sid, err in self.connection.get_tokengroups(dn): if err is not None: raise err group_sids.append(group_sid) group_dn, err = await self.connection.get_dn_for_objectsid(group_sid) if err is not None: raise err print('%s - %s' % (group_dn, group_sid)) if len(group_sids) == 0: print('No memberships found') return True except Exception as e: traceback.print_exc() return False async def do_bindtree(self, newtree): """Changes the LDAP TREE for future queries. MUST be DN format eg. 'DC=test,DC=corp'""" self.connection._tree = newtree async def do_trusts(self): """Feteches gives back domain trusts""" try: async for entry, err in self.connection.get_all_trusts(): if err is not None: raise err print(entry.get_line()) return True except: traceback.print_exc() return False async def do_adduser(self, user_dn, password): """Creates a new domain user with password""" try: _, err = await self.connection.create_user_dn(user_dn, password) if err is not None: raise err print('User added') return True except: traceback.print_exc() return False async def do_deluser(self, user_dn): """Deletes the user! This action is irrecoverable (actually domain admins can do that but probably will shout with you)""" try: _, err = await self.connection.delete_user(user_dn) if err is not None: raise err print('Goodbye, Caroline.') return True except: traceback.print_exc() return False async def do_changeuserpw(self, user_dn, newpass, oldpass = None): """Changes user password, if you are admin then old pw doesnt need to be supplied""" try: _, err = await self.connection.change_password(user_dn, newpass, oldpass) if err is not None: raise err print('User password changed') return True except: traceback.print_exc() return False async def do_unlockuser(self, user_dn): """Unlock user by setting lockoutTime to 0""" try: _, err = await self.connection.unlock_user(user_dn) if err is not None: raise err print('User unlocked') return True except: traceback.print_exc() return False async def do_enableuser(self, user_dn): """Unlock user by flipping useraccountcontrol bits""" try: _, err = await self.connection.enable_user(user_dn) if err is not None: raise err print('User enabled') return True except: traceback.print_exc() return False async def do_disableuser(self, user_dn): """Unlock user by flipping useraccountcontrol bits""" try: _, err = await self.connection.disable_user(user_dn) if err is not None: raise err print('User disabled') return True except: traceback.print_exc() return False async def do_addspn(self, user_dn, spn): """Adds an SPN entry to the users account""" try: _, err = await self.connection.add_user_spn(user_dn, spn) if err is not None: raise err print('SPN added!') return True except: traceback.print_exc() return False async def do_delspn(self, user_dn, spn): """Removes an SPN entry to the users account""" try: _, err = await self.connection.del_user_spn(user_dn, spn) if err is not None: raise err print('SPN removed!') return True except: traceback.print_exc() return False async def do_addhostname(self, user_dn, hostname): """Adds additional hostname to computer account""" try: _, err = await self.connection.add_additional_hostname(user_dn, hostname) if err is not None: raise err print('Hostname added!') return True except: traceback.print_exc() return False async def do_addusertogroup(self, user_dn, group_dn): """Adds user to specified group. Both user and group must be in DN format!""" try: _, err = await self.connection.add_user_to_group(user_dn, group_dn) if err is not None: raise err print('User added to group!') return True except: traceback.print_exc() return False async def do_deluserfromgroup(self, user_dn, group_dn): """Removes user from specified group. Both user and group must be in DN format!""" try: _, err = await self.connection.del_user_from_group(user_dn, group_dn) if err is not None: raise err print('User added to group!') return True except: traceback.print_exc() return False async def do_rootcas(self, to_print = True): """Lists Root CA certificates""" try: cas = [] async for ca, err in self.connection.list_root_cas(): if err is not None: raise err cas.append(ca) if to_print is True: print(ca) return cas except: traceback.print_exc() return False async def do_ntcas(self, to_print = True): """Lists NT CA certificates""" try: cas = [] async for ca, err in self.connection.list_ntcas(): if err is not None: raise err cas.append(ca) if to_print is True: print(ca) return cas except: traceback.print_exc() return False async def do_aiacas(self, to_print = True): """Lists AIA CA certificates""" try: cas = [] async for ca, err in self.connection.list_aiacas(): if err is not None: raise err cas.append(ca) if to_print is True: print(ca) return cas except: traceback.print_exc() return False async def do_enrollmentservices(self, to_print=True): """Lists AIA CA certificates""" try: services = [] async for srv, err in self.connection.list_enrollment_services(): if err is not None: raise err services.append(srv) if to_print is True: print(srv) return services except: traceback.print_exc() return False async def do_addcerttemplatenameflagaltname(self, certtemplatename, flags = None): """Modifyies the msPKI-Certificate-Name-Flag value of the specified certificate template and enables ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME bit. If 'flags' is present then it will assign that value.""" try: template = None async for template, err in self.connection.list_certificate_templates(certtemplatename): if err is not None: raise err break if template is None: raise Exception("Template could not be found!") template = typing.cast(MSADCertificateTemplate, template) if flags is not None: flags = int(flags) else: flags = int(CertificateNameFlag(template.Certificate_Name_Flag) | CertificateNameFlag.ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME) changes = { 'msPKI-Certificate-Name-Flag' : [('replace', flags)] } _, err = await self.connection.modify(template.distinguishedName, changes) if err is not None: raise err print('Modify OK!') return True except: traceback.print_exc() return False async def do_addenrollmentright(self, certtemplatename, user_dn): """Grants enrollment rights to a user (by DN) for the specified certificate template.""" try: user_sid, err = await self.connection.get_objectsid_for_dn(user_dn) if err is not None: raise err template = None async for template, err in self.connection.list_certificate_templates(certtemplatename): if err is not None: raise err break if template is None: raise Exception("Template could not be found!") template = typing.cast(MSADCertificateTemplate, template) new_sd = copy.deepcopy(template.nTSecurityDescriptor) ace = ACCESS_ALLOWED_OBJECT_ACE() ace.Sid = SID.from_string(user_sid) ace.ObjectType = GUID.from_string(EX_RIGHT_CERTIFICATE_ENROLLMENT) ace.AceFlags = AceFlags(0) ace.Mask = ADS_ACCESS_MASK.READ_PROP | ADS_ACCESS_MASK.WRITE_PROP | ADS_ACCESS_MASK.CONTROL_ACCESS ace.Flags = ACE_OBJECT_PRESENCE.ACE_OBJECT_TYPE_PRESENT new_sd.Dacl.aces.append(ace) _, err = await self.connection.set_objectacl_by_dn(template.distinguishedName, new_sd.to_bytes(), flags=SDFlagsRequest.DACL_SECURITY_INFORMATION) if err is not None: raise err print('SD set sucessfully') return True except: traceback.print_exc() return False async def do_certtemplates(self, name = None, to_print = True): """Lists certificate templates""" try: services = await self.do_enrollmentservices(to_print=False) templates = [] async for template, err in self.connection.list_certificate_templates(name): if err is not None: raise err lt = None if template.nTSecurityDescriptor is not None: lt, err = await self.connection.resolv_sd(template.nTSecurityDescriptor) if err is not None: raise err template.sid_lookup_table = lt for srv in services: if template.name in srv.certificateTemplates: template.enroll_services.append('%s\\%s' % (srv.dNSHostName, srv.name)) templates.append(template) if to_print is True: print(template.prettyprint()) return templates except: traceback.print_exc() return False async def do_sidresolv(self, sid, to_print = True): """Returns the domain and username for SID""" try: domain, username, err = await self.connection.resolv_sid(sid) if err is not None: raise err res = '%s\\%s' % (domain, username) if to_print is True: print(res) return res except: traceback.print_exc() return False async def do_certify(self, cmd = None, username = None): """ADCA security test""" try: es = await self.do_enrollmentservices(to_print=False) if es is False: raise Exception('Listing enrollment Services error! %s' % es) if es is None: raise Exception('No Enrollment Services present, stopping!') templates = await self.do_certtemplates(to_print=False) if templates is False: raise Exception('Listing templates error! %s' % es) if templates is None: raise Exception('No templates exists!') for enrollment in es: print(enrollment) if cmd is not None: if cmd.lower().startswith('vuln') is True: tokengroups = None if username is not None: tokengroups, err = await self.connection.get_tokengroups_user(username) if err is not None: raise err for template in templates: isvuln, reason = template.is_vulnerable(tokengroups) if isvuln is True: print(reason) print(template) else: for template in templates: print(template) return True except: traceback.print_exc() return False async def do_whoamiraw(self): """Simple whoami""" try: res, err = await self.connection.whoami() if err is not None: raise err print(res) except: traceback.print_exc() return False async def do_whoami(self): """Full whoami""" try: res, err = await self.connection.whoamifull() if err is not None: raise err for x in res: if isinstance(res[x], str) is True: print('%s: %s' % (x, res[x])) elif isinstance(res[x], dict) is True: for k in res[x]: print('Group: %s (%s)' % (k,'\\'.join(res[x][k]))) return True except: traceback.print_exc() return False, None async def do_gmsa(self): """Lists all managed service accounts (MSA). If user has permissions it retrieves the password as well""" try: print('---------------------------------------------') async for samaccountname, memberships, pwblob, err in self.connection.list_gmsa(): if err is not None: raise err print('Username: %s' % samaccountname) allowed_machines = [] if memberships is not None: for entry in memberships.Dacl.aces: if entry.AceType == ACEType.ACCESS_ALLOWED_ACE_TYPE: try: user = await self.do_sidresolv(entry.Sid, to_print=False) allowed_machines.append(user) except: allowed_machines.append(entry.Sid) for mname in allowed_machines: print('Allowed machine: %s' % mname) if pwblob is not None: print('Password: %s' % pwblob.CurrentPassword[:-2].hex()) print('Password -NT-: %s' % pwblob.nt_hash) else: print('Password: ') print('---------------------------------------------') except: traceback.print_exc() return False async def do_genschema(self): """Generates schema data. This will take a long time.""" try: import json attributes = {} testattr = {} async for attribute, err in self.connection.get_all_schemaentry(): if err is not None: raise err attributes[attribute.lDAPDisplayName] = attribute.to_dict() try: if attribute.isSingleValued is not None: testattr[attribute.lDAPDisplayName] = attribute.get_type() except: print(print(attribute.to_dict())) with open('adschema.json','w') as f: json.dump(attributes,f) with open('adschema.py', 'w', newline = '') as f: f.write('LDAP_WELL_KNOWN_ATTRS = {\r\n') line = '' for attrname in testattr: line += '\t"%s" : %s,\r\n' % (attrname, testattr[attrname]) f.write(line) f.write('}') except: traceback.print_exc() return False async def do_addcomputer(self, computername=None, password=None): """Adds a new computer account""" try: computer, password, err = await self.connection.add_computer(computername, password) if err is not None: raise err print(computer) print('sAMAccountName: %s' % computer.sAMAccountName) print('Password: %s' % password) except: traceback.print_exc() return False async def do_changesamaccountname(self, dn, newname): """Changes the sAMAccountName of a given DN""" try: err = await self.connection.change_samaccountname(dn, newname) if err is not None: raise err print('OK') except: traceback.print_exc() return False async def do_unconstrained(self): """Lists all unconstrained delegation objects""" try: print('Objects with Unconstrained Delegation set:') async for entry, err in self.connection.get_unconstrained_machines(): if err is not None: raise err print(entry) async for entry, err in self.connection.get_unconstrained_users(): if err is not None: raise err print(entry) except: traceback.print_exc() return False async def do_constrained(self): """Lists all constrained delegation objects""" try: print('Objects with Constrained Delegation set:') async for entry, err in self.connection.get_all_constrained(): if err is not None: raise err sname = entry.get('sAMAccountName', '') for x in entry.get('msDS-AllowedToDelegateTo', []): print('%s -> %s' % (sname, x)) except: traceback.print_exc() return False async def do_s4u2proxy(self): """Lists all S4U2Proxy objects""" try: print('S4U2Proxy set:') async for entry, err in self.connection.get_all_s4u2proxy(): if err is not None: raise err print(entry) except: traceback.print_exc() return False async def do_test(self): """testing, dontuse""" try: async for entry, err in self.connection.get_all_objectacl(): if err is not None: raise err if entry.objectClass[-1] != 'user': print(entry.objectClass) return True except: traceback.print_exc() return False """ async def do_info(self): try: except Exception as e: traceback.print_exc() """ async def do_dnszones(self): """Lists all DNS zones""" try: async for entry, err in self.connection.dnslistzones(): if err is not None: raise err print(entry) return True except: traceback.print_exc() return False async def do_dnsdump(self, zone = None): try: if zone == '': zone = None dns_filename = 'dns_%s.tsv' % datetime.datetime.now().strftime("%Y%m%d-%H%M%S") pbar = tqdm(desc = 'Writing DNS records to file %s' % dns_filename) with open(dns_filename, 'w', newline='', encoding = 'utf8') as f: async for zonedn, name, dnsrecod, err in self.connection.dnsentries(zone): if err is not None: raise err dnsdataobj = dnsrecod.get_formatted() line = '\t'.join([zonedn, name, dnsrecod.Type.name, dnsdataobj.to_line()]) f.write(line + '\r\n') pbar.update(1) return True except Exception as e: traceback.print_exc() return False async def do_pre2000(self): """Lists potentially abusable machine accounts created with pre windows-2000 flag""" try: query = '(&(userAccountControl=4128)(logonCount=0))' async for entry, err in self.connection.pagedsearch(query, attributes=['sAMAccountName']): if err is not None: raise err print(entry) return True except: traceback.print_exc() return False async def amain(args): import platform if args.url is not None: client = MSLDAPClientConsole(args.url) else: if platform.system() != 'Windows': raise Exception('This function only works on Windows systems!') from asyauth.common.credentials import UniCredential from msldap.commons.target import MSLDAPTarget, UniProto from winacl.functions.highlevel import get_logon_info cred = UniCredential.get_sspi(args.authtype) userinfo = get_logon_info() if args.target is not None: ip = args.target if args.target.find(':') is not None: ip, port = args.target.split(':') target = MSLDAPTarget(ip=ip, port=port) else: if userinfo['logonserver'] is not None and len(userinfo['logonserver']) > 0: target = MSLDAPTarget( ip=userinfo['logonserver'], hostname = userinfo['logonserver'], dc_ip=userinfo['logonserver'], domain=userinfo['dnsdomainname'], ) if args.ldaps is True: target = MSLDAPTarget( ip=userinfo['logonserver'], hostname = userinfo['logonserver'], protocol = UniProto.CLIENT_SSL_TCP, port = 636, dc_ip=userinfo['logonserver'], domain=userinfo['dnsdomainname'], ) else: raise Exception('Couldnt find logonserver! Are you connected to a domain?') factory = LDAPConnectionFactory(cred, target) client = MSLDAPClientConsole(factory) if len(args.commands) == 0: if args.no_interactive is True: print('Not starting interactive!') return res = await client._run_single_command('login', []) if res is False: return await client.run() else: for command in args.commands: if command == 'i': await client.run() return cmd = shlex.split(command) res = await client._run_single_command(cmd[0], cmd[1:]) if res is False: return def main(): import argparse import platform protocols = """LDAP : basic LDAP protocol LDAPS: LDAP over SSL GC : Global Catalog GCS : Global Catalog over SSL""" authprotos = """ntlm : SASL NTLM authentication kerberos : SASL Kerberos authentication sspi-ntlm: SSPI authentication using NTLM (Windows only, uses SASL) sspi-kerberos: SSPI authentication using Kerberos (Windows only, uses SASL) simple : LDAP SIMPLE authentication plain : PLAIN authentication sicily : SICILY authentication ssl : Authenticate with SSL certificate none : No authentication, anonymous bind """ usage = UniCredential.get_help(protocols, authprotos, '') usage += UniTarget.get_help() usage += """ Examples: All of the following examples show LDAP auth to the DC of TEST.corp domain at Win2019AD.test.corp(10.10.10.2) Kerberos authentication needs the FQDN of the DC, so we use the 'dc' parameter to specify the DC. Anonymous BIND: ldap://10.10.10.2 Username and password authentication using NTLM over plaintext LDAP: ldap+ntlm-password://TEST\\victim:password@10.10.10.2 Username and password authentication using NTLM over SSL/TLS: ldaps+ntlm-password://TEST\\victim:password@10.10.10.2 Username and password authentication using Kerberos over plaintext LDAP: ldap+kerberos-password://TEST\\victim:password@10.10.10.2/?dc=10.10.10.2 Username and password authentication using Kerberos over SSL/TLS: ldaps+kerberos-password://TEST\\victim:password@10.10.10.2/?dc=10.10.10.2 NTLM authentication using the NT hash over plaintext LDAP: ldap+ntlm-nt://TEST\\victim:@10.10.10.2 Kerberos authentication using the RC4 key over plaintext LDAP: ldap+kerberos-rc4://TEST\\victim:@10.10.10.2/?dc=10.10.10.2 SICILY authentication using the NT hash over plaintext LDAP: ldap+sicily-nt://TEST\\victim:@10.10.10.2 Kerberos authentication using AES key over plaintext LDAP: ldap+kerberos-aes://TEST\\victim:@10.10.10.2/?dc=10.10.10.2 Kerberos authentication using CCACHE file over plaintext LDAP: ldap+kerberos-ccache://TEST\\victim:@10.10.10.2/?dc=10.10.10.2 Kerberos authentication using keytab file over plaintext LDAP: ldap+kerberos-keytab://TEST\\victim:@10.10.10.2/?dc=10.10.10.2 Kerberos authentication using P12 or PFX file over plaintext LDAP (notice that keyfile password is at the 'password' filed): ldap+kerberos-pfx://TEST\\victim:admin@10.10.10.2/?dc=10.10.10.2&keydata= SSL authentication using P12 or PFX file over plaintext LDAP, automatically performs STARTTLS: ldap+ssl://10.10.10.2/?sslcert=&sslpassword=' SSL authentication using P12 or PFX file over SSL/TLS LDAP: ldaps+ssl://10.10.10.2/?sslcert=&sslpassword=' """ parser = argparse.ArgumentParser(description='MS LDAP library', usage = usage) parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') parser.add_argument('-n', '--no-interactive', action='store_true') if platform.system() == 'Windows': group = parser.add_argument_group(title='URL') group.add_argument('--url', help='Connection string in URL format.') group2 = parser.add_argument_group(title='Without URL') group2.add_argument('--authtype', default='ntlm', help='Connection string in URL format.') group2.add_argument('--target', help='Address of LDAP server.') group2.add_argument('--ldaps', action='store_true', help='Use LDAPS') else: parser.add_argument('url', help='Connection string in URL format.') parser.add_argument('commands', nargs='*', help="Takes a series of commands which will be executed until error encountered. If the command is 'i' is encountered during execution it drops back to interactive shell.") args = parser.parse_args() ###### VERBOSITY if args.verbose == 0: logging.basicConfig(level=logging.INFO) else: sockslogger.setLevel(logging.DEBUG) logger.setLevel(logging.DEBUG) authlogger.setLevel(logging.DEBUG) logging.basicConfig(level=logging.DEBUG) asyncio.run(amain(args)) if __name__ == '__main__': main() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/examples/msldapcompdnslist.py0000664000175000017500000000455114531630505021600 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import asyncio import traceback import logging from msldap import logger from asysocks import logger as sockslogger from msldap.commons.factory import LDAPConnectionFactory class MSLDAPCompDomainList: def __init__(self, ldap_url): self.conn_url = ldap_url self.connection = None self.adinfo = None self.ldapinfo = None self.domain_name = None async def login(self): """Performs connection and login""" try: logger.debug(self.conn_url.get_credential()) logger.debug(self.conn_url.get_target()) self.connection = self.conn_url.get_client() _, err = await self.connection.connect() if err is not None: raise err return True, None except Exception as e: return False, e async def do_adinfo(self, show = True): """Prints detailed Active Driectory info""" try: if self.adinfo is None: self.adinfo = self.connection._ldapinfo self.domain_name = self.adinfo.distinguishedName.replace('DC','').replace('=','').replace(',','.') if show is True: print(self.adinfo) return True, None except Exception as e: return False, e async def run(self): try: _, err = await self.login() if err is not None: raise err _, err = await self.do_adinfo(False) if err is not None: raise err async for machine, err in self.connection.get_all_machines(attrs=['sAMAccountName', 'dNSHostName']): if err is not None: raise err dns = machine.dNSHostName if dns is None: dns = '%s.%s' % (machine.sAMAccountName[:-1], self.domain_name) print(str(dns)) except: traceback.print_exc() def main(): import argparse parser = argparse.ArgumentParser(description='MS LDAP library') parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked') parser.add_argument('-n', '--no-interactive', action='store_true') parser.add_argument('url', help='Connection string in URL format.') args = parser.parse_args() ###### VERBOSITY if args.verbose == 0: logging.basicConfig(level=logging.INFO) else: sockslogger.setLevel(logging.DEBUG) logger.setLevel(logging.DEBUG) logging.basicConfig(level=logging.DEBUG) ldap_url = LDAPConnectionFactory.from_url(args.url) compdomlist = MSLDAPCompDomainList(ldap_url) asyncio.run(compdomlist.run()) if __name__ == '__main__': main()././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/examples/utils/0000775000175000017500000000000014535076203016624 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/examples/utils/__init__.py0000664000175000017500000000000014531630505020720 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/examples/utils/completers.py0000664000175000017500000000401614531630505021351 0ustar00webdevwebdevimport os from typing import Callable, Iterable, List, Optional from prompt_toolkit.completion import CompleteEvent, Completer, Completion from prompt_toolkit.document import Document import traceback class PathCompleter(Completer): """ Complete for Path variables. :param get_paths: Callable which returns a list of directories to look into when the user enters a relative path. :param file_filter: Callable which takes a filename and returns whether this file should show up in the completion. ``None`` when no filtering has to be done. :param min_input_len: Don't do autocompletion when the input string is shorter. """ def __init__(self, only_directories: bool = False, get_current_dirs: Optional[Callable[[], List[str]]] = None, file_filter: Optional[Callable[[str], bool]] = None, min_input_len: int = 0, expanduser: bool = False) -> None: self.only_directories = only_directories self.get_current_dirs = get_current_dirs or (lambda: ['.']) self.file_filter = file_filter or (lambda _: True) self.min_input_len = min_input_len self.expanduser = expanduser def get_completions(self, document: Document, complete_event: CompleteEvent) -> Iterable[Completion]: text = document.text_before_cursor # Complete only when we have at least the minimal input length, # otherwise, we can too many results and autocompletion will become too # heavy. if len(text) < self.min_input_len: return try: #print('Called!') # Do tilde expansion. #if self.expanduser: # text = os.path.expanduser(text) # Directories where to look. dirnames = self.get_current_dirs() #print(text) for dirname in dirnames: if dirname.startswith(text): completion = dirname[len(text):] yield Completion(completion, 0, display=dirname) #elif dirname.find('=') != -1: # m = dirname.find('=') + 1 # if dirname[m:].startswith(text): # completion = dirname # yield Completion(completion, 0, display=dirname) except Exception as e: traceback.print_exc()././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/external/0000775000175000017500000000000014535076203015470 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/__init__.py0000664000175000017500000000000014531630505017564 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/external/aiocmd/0000775000175000017500000000000014535076203016724 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/aiocmd/__init__.py0000664000175000017500000000000014531630505021020 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/external/aiocmd/aiocmd/0000775000175000017500000000000014535076203020160 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/aiocmd/aiocmd/__init__.py0000664000175000017500000000000014531630505022254 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/aiocmd/aiocmd/aiocmd.py0000664000175000017500000001400614531630505021764 0ustar00webdevwebdevimport asyncio import inspect import shlex import signal import sys from prompt_toolkit import PromptSession from prompt_toolkit.completion import WordCompleter from prompt_toolkit.key_binding import KeyBindings from prompt_toolkit.patch_stdout import patch_stdout try: from prompt_toolkit.completion.nested import NestedCompleter except ImportError: from aiocmd.nested_completer import NestedCompleter class ExitPromptException(Exception): pass class PromptToolkitCmd: """Baseclass for custom CLIs Works similarly to the built-in Cmd class. You can inherit from this class and implement: - do_ - This will add the "" command to the cli. The method may receive arguments (required) and keyword arguments (optional). - __completions - Returns a custom Completer class to use as a completer for this action. Additionally, the user cant change the "prompt" variable to change how the prompt looks, and add command aliases to the 'aliases' dict. """ ATTR_START = "do_" prompt = "$ " doc_header = "Documented commands:" aliases = {"?": "help", "exit": "quit"} def __init__(self, ignore_sigint=True): self.completer = self._make_completer() self.session = None self._ignore_sigint = ignore_sigint self._currently_running_task = None async def run(self): if self._ignore_sigint and sys.platform != "win32": asyncio.get_event_loop().add_signal_handler(signal.SIGINT, self._sigint_handler) self.session = PromptSession(enable_history_search=True, key_bindings=self._get_bindings()) try: with patch_stdout(): await self._run_prompt_forever() finally: if self._ignore_sigint and sys.platform != "win32": asyncio.get_event_loop().remove_signal_handler(signal.SIGINT) self._on_close() async def _run_prompt_forever(self): while True: try: result = await self.session.prompt_async(self.prompt, completer=self.completer) except EOFError: return if not result: continue args = shlex.split(result) if args[0] in self.command_list: try: self._currently_running_task = asyncio.ensure_future( self._run_single_command(args[0], args[1:])) await self._currently_running_task except asyncio.CancelledError: print() continue except ExitPromptException: return else: print("Command %s not found!" % args[0]) def _sigint_handler(self): if self._currently_running_task: self._currently_running_task.cancel() def _get_bindings(self): bindings = KeyBindings() bindings.add("c-c")(lambda event: self._interrupt_handler(event)) return bindings async def _run_single_command(self, command, args): command_real_args, command_real_kwargs = self._get_command_args(command) if len(args) < len(command_real_args) or len(args) > (len(command_real_args) + len(command_real_kwargs)): print("Bad command args. Usage: %s" % self._get_command_usage(command, command_real_args, command_real_kwargs)) return try: com_func = self._get_command(command) if asyncio.iscoroutinefunction(com_func): res = await com_func(*args) else: res = com_func(*args) return res except (ExitPromptException, asyncio.CancelledError): raise except Exception as ex: print("Command failed: ", ex) def _interrupt_handler(self, event): event.cli.current_buffer.text = "" def _make_completer(self): return NestedCompleter({com: self._completer_for_command(com) for com in self.command_list}) def _completer_for_command(self, command): if not hasattr(self, "_%s_completions" % command): return WordCompleter([]) return getattr(self, "_%s_completions" % command)() def _get_command(self, command): if command in self.aliases: command = self.aliases[command] return getattr(self, self.ATTR_START + command) def _get_command_args(self, command): args = [param for param in inspect.signature(self._get_command(command)).parameters.values() if param.default == param.empty] kwargs = [param for param in inspect.signature(self._get_command(command)).parameters.values() if param.default != param.empty] return args, kwargs def _get_command_usage(self, command, args, kwargs): return ("%s %s %s" % (command, " ".join("<%s>" % arg for arg in args), " ".join("[%s]" % kwarg for kwarg in kwargs), )).strip() @property def command_list(self): return [attr[len(self.ATTR_START):] for attr in dir(self) if attr.startswith(self.ATTR_START)] + list(self.aliases.keys()) def do_help(self): print() print(self.doc_header) print("=" * len(self.doc_header)) print() get_usage = lambda command: self._get_command_usage(command, *self._get_command_args(command)) max_usage_len = max([len(get_usage(command)) for command in self.command_list]) for command in sorted(self.command_list): command_doc = self._get_command(command).__doc__ print(("%-" + str(max_usage_len + 2) + "s%s") % (get_usage(command), command_doc or "")) def do_quit(self): """Exit the prompt""" raise ExitPromptException() def _on_close(self): """Optional hook to call on closing the cmd""" pass ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/aiocmd/aiocmd/nested_completer.py0000664000175000017500000000715014531630505024066 0ustar00webdevwebdev""" Nestedcompleter for completion of hierarchical data structures. """ from typing import Dict, Iterable, Mapping, Optional, Set, Union from prompt_toolkit.completion import CompleteEvent, Completer, Completion from prompt_toolkit.completion.word_completer import WordCompleter from prompt_toolkit.document import Document __all__ = [ 'NestedCompleter' ] NestedDict = Mapping[str, Union['NestedDict', Set[str], None, Completer]] class NestedCompleter(Completer): """ Completer which wraps around several other completers, and calls any the one that corresponds with the first word of the input. By combining multiple `NestedCompleter` instances, we can achieve multiple hierarchical levels of autocompletion. This is useful when `WordCompleter` is not sufficient. If you need multiple levels, check out the `from_nested_dict` classmethod. """ def __init__(self, options: Dict[str, Optional[Completer]], ignore_case: bool = True) -> None: self.options = options self.ignore_case = ignore_case def __repr__(self) -> str: return 'NestedCompleter(%r, ignore_case=%r)' % (self.options, self.ignore_case) @classmethod def from_nested_dict(cls, data: NestedDict) -> 'NestedCompleter': """ Create a `NestedCompleter`, starting from a nested dictionary data structure, like this: .. code:: data = { 'show': { 'version': None, 'interfaces': None, 'clock': None, 'ip': {'interface': {'brief'}} }, 'exit': None 'enable': None } The value should be `None` if there is no further completion at some point. If all values in the dictionary are None, it is also possible to use a set instead. Values in this data structure can be a completers as well. """ options = {} for key, value in data.items(): if isinstance(value, Completer): options[key] = value elif isinstance(value, dict): options[key] = cls.from_nested_dict(value) elif isinstance(value, set): options[key] = cls.from_nested_dict({item: None for item in value}) else: assert value is None options[key] = None return cls(options) def get_completions(self, document: Document, complete_event: CompleteEvent) -> Iterable[Completion]: # Split document. text = document.text_before_cursor.lstrip() # If there is a space, check for the first term, and use a # subcompleter. if ' ' in text: first_term = text.split()[0] completer = self.options.get(first_term) # If we have a sub completer, use this for the completions. if completer is not None: remaining_text = document.text[len(first_term):].lstrip() move_cursor = len(document.text) - len(remaining_text) new_document = Document( remaining_text, cursor_position=document.cursor_position - move_cursor) for c in completer.get_completions(new_document, complete_event): yield c # No space in the input: behave exactly like `WordCompleter`. else: completer = WordCompleter(list(self.options.keys()), ignore_case=self.ignore_case) for c in completer.get_completions(document, complete_event): yield c ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/aiocmd/setup.py0000664000175000017500000000131614531630505020434 0ustar00webdevwebdevfrom setuptools import setup, find_packages setup(name='aiocmd', packages=find_packages("."), version='0.1.4', author='Dor Green', author_email='dorgreen1@gmail.com', description='Coroutine-based CLI generator using prompt_toolkit', url='http://github.com/KimiNewt/aiocmd', keywords=['asyncio', 'cmd'], license='MIT', install_requires=[ 'prompt_toolkit>=2.0.9' ], classifiers=[ 'License :: OSI Approved :: MIT License', 'Programming Language :: Python :: 3', 'Programming Language :: Python :: 3.5', 'Programming Language :: Python :: 3.6', 'Programming Language :: Python :: 3.7' ]) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0034087 msldap-0.5.9/msldap/external/asciitree/0000775000175000017500000000000014535076203017440 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/__init__.py0000664000175000017500000000000014531630505021534 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0074086 msldap-0.5.9/msldap/external/asciitree/asciitree/0000775000175000017500000000000014535076203021410 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/asciitree/__init__.py0000664000175000017500000000470314531630505023522 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- from .drawing import BoxStyle from .traversal import DictTraversal from .util import KeyArgsConstructor class LeftAligned(KeyArgsConstructor): """Creates a renderer for a left-aligned tree. Any attributes of the resulting class instances can be set using constructor arguments.""" draw = BoxStyle() "The draw style used. See :class:`~asciitree.drawing.Style`." traverse = DictTraversal() "Traversal method. See :class:`~asciitree.traversal.Traversal`." def render(self, node): """Renders a node. This function is used internally, as it returns a list of lines. Use :func:`~asciitree.LeftAligned.__call__` instead. """ lines = [] children = self.traverse.get_children(node) lines.append(self.draw.node_label(self.traverse.get_text(node))) for n, child in enumerate(children): child_tree = self.render(child) if n == len(children) - 1: # last child does not get the line drawn lines.append(self.draw.last_child_head(child_tree.pop(0))) lines.extend(self.draw.last_child_tail(l) for l in child_tree) else: lines.append(self.draw.child_head(child_tree.pop(0))) lines.extend(self.draw.child_tail(l) for l in child_tree) return lines def __call__(self, tree): """Render the tree into string suitable for console output. :param tree: A tree.""" return '\n'.join(self.render(self.traverse.get_root(tree))) # legacy support below from .drawing import Style from .traversal import Traversal class LegacyStyle(Style): def node_label(self, text): return text def child_head(self, label): return ' +--' + label def child_tail(self, line): return ' |' + line def last_child_head(self, label): return ' +--' + label def last_child_tail(self, line): return ' ' + line def draw_tree(node, child_iter=lambda n: n.children, text_str=str): """Support asciitree 0.2 API. This function solely exist to not break old code (using asciitree 0.2). Its use is deprecated.""" return LeftAligned(traverse=Traversal(get_text=text_str, get_children=child_iter), draw=LegacyStyle())(node) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/asciitree/drawing.py0000664000175000017500000000553514531630505023422 0ustar00webdevwebdevfrom .util import KeyArgsConstructor BOX_LIGHT = { 'UP_AND_RIGHT': u'\u2514', 'HORIZONTAL': u'\u2500', 'VERTICAL': u'\u2502', 'VERTICAL_AND_RIGHT': u'\u251C', } #: Unicode box-drawing glyphs, light style BOX_HEAVY = { 'UP_AND_RIGHT': u'\u2517', 'HORIZONTAL': u'\u2501', 'VERTICAL': u'\u2503', 'VERTICAL_AND_RIGHT': u'\u2523', } #: Unicode box-drawing glyphs, heavy style BOX_DOUBLE = { 'UP_AND_RIGHT': u'\u255A', 'HORIZONTAL': u'\u2550', 'VERTICAL': u'\u2551', 'VERTICAL_AND_RIGHT': u'\u2560', } #: Unicode box-drawing glyphs, double-line style BOX_ASCII = { 'UP_AND_RIGHT': u'+', 'HORIZONTAL': u'-', 'VERTICAL': u'|', 'VERTICAL_AND_RIGHT': u'+', } #: Unicode box-drawing glyphs, using only ascii ``|+-`` characters. BOX_BLANK = { 'UP_AND_RIGHT': u' ', 'HORIZONTAL': u' ', 'VERTICAL': u' ', 'VERTICAL_AND_RIGHT': u' ', } #: Unicode box-drawing glyphs, using only spaces. class Style(KeyArgsConstructor): """Rendering style for trees.""" label_format = u'{}' #: Format for labels. def node_label(self, text): """Render a node text into a label.""" return self.label_format.format(text) def child_head(self, label): """Render a node label into final output.""" return label def child_tail(self, line): """Render a node line that is not a label into final output.""" return line def last_child_head(self, label): """Like :func:`~asciitree.drawing.Style.child_head` but only called for the last child.""" return label def last_child_tail(self, line): """Like :func:`~asciitree.drawing.Style.child_tail` but only called for the last child.""" return line class BoxStyle(Style): """A rendering style that uses box draw characters and a common layout.""" gfx = BOX_ASCII #: Glyhps to use. label_space = 1 #: Space between glyphs and label. horiz_len = 2 #: Length of horizontal lines indent = 1 #: Indent for subtrees def child_head(self, label): return (' ' * self.indent + self.gfx['VERTICAL_AND_RIGHT'] + self.gfx['HORIZONTAL'] * self.horiz_len + ' ' * self.label_space + label) def child_tail(self, line): return (' ' * self.indent + self.gfx['VERTICAL'] + ' ' * self.horiz_len + line) def last_child_head(self, label): return (' ' * self.indent + self.gfx['UP_AND_RIGHT'] + self.gfx['HORIZONTAL'] * self.horiz_len + ' ' * self.label_space + label) def last_child_tail(self, line): return (' ' * self.indent + ' ' * len(self.gfx['VERTICAL']) + ' ' * self.horiz_len + line) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/asciitree/traversal.py0000664000175000017500000000216614531630505023767 0ustar00webdevwebdevfrom .util import KeyArgsConstructor class Traversal(KeyArgsConstructor): """Traversal method. Used by the tree rendering functions like :class:`~asciitree.LeftAligned`. """ def get_children(self, node): """Return a list of children of a node.""" raise NotImplementedError def get_root(self, tree): """Return a node representing the tree root from the tree.""" return tree def get_text(self, node): """Return the text associated with a node.""" return str(node) class DictTraversal(Traversal): """Traversal suitable for a dictionary. Keys are tree labels, all values must be dictionaries as well.""" def get_children(self, node): return list(node[1].items()) def get_root(self, tree): return list(tree.items())[0] def get_text(self, node): return node[0] class AttributeTraversal(Traversal): """Attribute traversal. Uses an attribute of a node as its list of children. """ attribute = 'children' #: Attribute to use. def get_children(self, node): return getattr(node, self.attribute) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/asciitree/util.py0000664000175000017500000000021014531630505022725 0ustar00webdevwebdevclass KeyArgsConstructor(object): def __init__(self, **kwargs): for k, v in kwargs.items(): setattr(self, k, v) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/asciitree/setup.py0000664000175000017500000000102114531630505021141 0ustar00webdevwebdev#!/usr/bin/env python # -*- coding: utf-8 -*- import os from setuptools import setup, find_packages def read(fname): return open(os.path.join(os.path.dirname(__file__), fname)).read() setup( name='asciitree', version='0.3.3', description='Draws ASCII trees.', long_description=read('README.rst'), author='Marc Brinkmann', author_email='git@marcbrinkmann.de', url='http://github.com/mbr/asciitree', license='MIT', packages=find_packages(exclude=['tests']), install_requires=[], ) ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0074086 msldap-0.5.9/msldap/external/bloodhoundpy/0000775000175000017500000000000014535076203020176 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/external/bloodhoundpy/__init__.py0000664000175000017500000000000014531630505022272 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701937887.0 msldap-0.5.9/msldap/external/bloodhoundpy/acls.py0000664000175000017500000006365114534301337021503 0ustar00webdevwebdev#################### # # Copyright (c) 2022 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### #from __future__ import unicode_literals import re import binascii from msldap import logger from msldap.external.bloodhoundpy.lib.cstruct import * from io import BytesIO #from future.utils import iteritems, native_str from struct import unpack, pack def bin_to_string(uuid): uuid1, uuid2, uuid3 = unpack('HHL', uuid[8:16]) return '%08X-%04X-%04X-%04X-%04X%08X' % (uuid1, uuid2, uuid3, uuid4, uuid5, uuid6) def string_to_bin(uuid): # If a UUID in the 00000000000000000000000000000000 format, let's return bytes as is if '-' not in uuid: return binascii.unhexlify(uuid) # If a UUID in the 00000000-0000-0000-0000-000000000000 format, parse it as Variant 2 UUID # The first three components of the UUID are little-endian, and the last two are big-endian matches = re.match(r"([\dA-Fa-f]{8})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})-([\dA-Fa-f]{4})([\dA-Fa-f]{8})", uuid) (uuid1, uuid2, uuid3, uuid4, uuid5, uuid6) = [int(x, 16) for x in matches.groups()] uuid = pack('HHL', uuid4, uuid5, uuid6) return uuid # Extended rights and property GUID mapping, converted to binary so we don't have to do this # for every comparison. # Source: https://msdn.microsoft.com/en-us/library/cc223512.aspx EXTRIGHTS_GUID_MAPPING = { "GetChanges": string_to_bin("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"), "GetChangesAll": string_to_bin("1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"), "GetChangesInFilteredSet": string_to_bin("89e95b76-444d-4c62-991a-0facbeda640c"), "WriteMember": string_to_bin("bf9679c0-0de6-11d0-a285-00aa003049e2"), "UserForceChangePassword": string_to_bin("00299570-246d-11d0-a768-00aa006e0529"), "AllowedToAct": string_to_bin("3f78c3e5-f79a-46bd-a0b8-9d18116ddc79"), "UserAccountRestrictionsSet": string_to_bin("4c164200-20c0-11d0-a768-00aa006e0529") } def parse_binary_acl(dn, entry, entrytype, acl, objecttype_guid_map): """ Main ACL structure parse function. This is offloaded to subprocesses and takes the current entry and the acl data as argument. This is then returned and processed back in the main process """ if not acl: return dn, entry, [] sd = SecurityDescriptor(BytesIO(acl)) # Check for protected DACL flag entry['IsACLProtected'] = sd.has_control(sd.PD) relations = [] # Parse owner osid = str(sd.owner_sid) ignoresids = ["S-1-3-0", "S-1-5-18", "S-1-5-10"] # Ignore Creator Owner or Local System if osid not in ignoresids: relations.append(build_relation(osid, 'Owns', inherited=False)) for ace_object in sd.dacl.aces: if ace_object.ace.AceType != 0x05 and ace_object.ace.AceType != 0x00: # These are the only two aces we care about currently logger.debug('Don\'t care about acetype %d', ace_object.ace.AceType) continue # Check if sid is ignored sid = str(ace_object.acedata.sid) # Ignore Creator Owner or Local System if sid in ignoresids: continue # For debugging, print specific aces # if sid == "S-1-5-21-2895268558-4179327395-2773671012-513": # print(ace_object) if ace_object.ace.AceType == 0x05: is_inherited = ace_object.has_flag(ACE.INHERITED_ACE) # ACCESS_ALLOWED_OBJECT_ACE if not ace_object.has_flag(ACE.INHERITED_ACE) and ace_object.has_flag(ACE.INHERIT_ONLY_ACE): # ACE is set on this object, but only inherited, so not applicable to us continue # Check if the ACE has restrictions on object type (inherited case) if ace_object.has_flag(ACE.INHERITED_ACE) \ and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_INHERITED_OBJECT_TYPE_PRESENT): # Verify if the ACE applies to this object type if not ace_applies(ace_object.acedata.get_inherited_object_type().lower(), entrytype, objecttype_guid_map): continue mask = ace_object.acedata.mask # Now the magic, we have to check all the rights BloodHound cares about # Check generic access masks first if mask.has_priv(ACCESS_MASK.GENERIC_ALL) or mask.has_priv(ACCESS_MASK.WRITE_DACL) \ or mask.has_priv(ACCESS_MASK.WRITE_OWNER) or mask.has_priv(ACCESS_MASK.GENERIC_WRITE): # For all generic rights we should check if it applies to our object type if ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and not ace_applies(ace_object.acedata.get_object_type().lower(), entrytype, objecttype_guid_map): # If it does not apply, break out of the loop here in order to # avoid individual rights firing later on continue # Check from high to low, ignore lower privs which may also match the bitmask, # even though this shouldn't happen since we check for exact matches currently if mask.has_priv(ACCESS_MASK.GENERIC_ALL): # Report this as LAPS rights if it's a computer object AND laps is enabled if entrytype == 'computer' and \ ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) and \ entry['Properties']['haslaps']: if ace_object.acedata.get_object_type().lower() == objecttype_guid_map['ms-mcs-admpwd']: relations.append(build_relation(sid, 'ReadLAPSPassword', inherited=is_inherited)) else: relations.append(build_relation(sid, 'GenericAll', inherited=is_inherited)) continue if mask.has_priv(ACCESS_MASK.GENERIC_WRITE): relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) # Don't skip this if it's the domain object, since BloodHound reports duplicate # rights as well, and this might influence some queries if entrytype != 'domain' and entrytype != 'computer': continue # These are specific bitmasks so don't break the loop from here if mask.has_priv(ACCESS_MASK.WRITE_DACL): relations.append(build_relation(sid, 'WriteDacl', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_OWNER): relations.append(build_relation(sid, 'WriteOwner', inherited=is_inherited)) # Property write privileges writeprivs = ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP) if writeprivs: # GenericWrite if entrytype in ['user', 'group', 'computer', 'gpo'] and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) if entrytype == 'group' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['WriteMember']): relations.append(build_relation(sid, 'AddMember', '', inherited=is_inherited)) if entrytype == 'computer' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['AllowedToAct']): relations.append(build_relation(sid, 'AddAllowedToAct', '', inherited=is_inherited)) # Property set, but ignore Domain Admins since they already have enough privileges anyway if entrytype == 'computer' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['UserAccountRestrictionsSet']) and not sid.endswith('-512'): relations.append(build_relation(sid, 'WriteAccountRestrictions', '', inherited=is_inherited)) # Since 4.0 # Key credential link property write rights if entrytype in ['user', 'computer'] and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and 'ms-ds-key-credential-link' in objecttype_guid_map and ace_object.acedata.get_object_type().lower() == objecttype_guid_map['ms-ds-key-credential-link']: relations.append(build_relation(sid, 'AddKeyCredentialLink', inherited=is_inherited)) # ServicePrincipalName property write rights (exclude generic rights) if entrytype == 'user' and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and ace_object.acedata.get_object_type().lower() == objecttype_guid_map['service-principal-name']: relations.append(build_relation(sid, 'WriteSPN', inherited=is_inherited)) elif ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_SELF): # Self add - since 4.0 if entrytype == 'group' and ace_object.acedata.data.ObjectType == EXTRIGHTS_GUID_MAPPING['WriteMember']: relations.append(build_relation(sid, 'AddSelf', '', inherited=is_inherited)) # Property read privileges if ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_READ_PROP): if entrytype == 'computer' and \ ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) and \ entry['Properties']['haslaps']: if ace_object.acedata.get_object_type().lower() == objecttype_guid_map['ms-mcs-admpwd']: relations.append(build_relation(sid, 'ReadLAPSPassword', inherited=is_inherited)) # Extended rights control_access = ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS) if control_access: # All Extended if entrytype in ['user', 'domain'] and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) # Also report all extended if no laps if entrytype == 'computer' and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChanges']): relations.append(build_relation(sid, 'GetChanges', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChangesAll']): relations.append(build_relation(sid, 'GetChangesAll', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChangesInFilteredSet']): relations.append(build_relation(sid, 'GetChangesInFilteredSet', '', inherited=is_inherited)) if entrytype == 'user' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['UserForceChangePassword']): relations.append(build_relation(sid, 'ForceChangePassword', '', inherited=is_inherited)) if ace_object.ace.AceType == 0x00: is_inherited = ace_object.has_flag(ACE.INHERITED_ACE) mask = ace_object.acedata.mask # ACCESS_ALLOWED_ACE if not ace_object.has_flag(ACE.INHERITED_ACE) and ace_object.has_flag(ACE.INHERIT_ONLY_ACE): # ACE is set on this object, but only inherited, so not applicable to us continue if mask.has_priv(ACCESS_MASK.GENERIC_ALL): # Generic all includes all other rights, so skip from here relations.append(build_relation(sid, 'GenericAll', inherited=is_inherited)) continue if mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP): # Genericwrite is only for properties, don't skip after if entrytype in ['user', 'group', 'computer', 'gpo']: relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_OWNER): relations.append(build_relation(sid, 'WriteOwner', inherited=is_inherited)) # For users and domain, check extended rights if entrytype in ['user', 'domain'] and mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) # Also report all extended if no laps if entrytype == 'computer' and mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS) and \ sid != "S-1-5-32-544" and not sid.endswith('-512'): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_DACL): relations.append(build_relation(sid, 'WriteDacl', inherited=is_inherited)) # pprint.pprint(entry) # pprint.pprint(relations) return dn, entry, relations def can_write_property(ace_object, binproperty): ''' Checks if the access is sufficient to write to a specific property. This can either be because we have the right ADS_RIGHT_DS_WRITE_PROP and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_WRITE_PROP right and the ObjectType is empty, in which case we can write to any property. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx ''' if not ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP): return False if not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): # No ObjectType present - we have generic access on all properties return True # Both are binary here if ace_object.acedata.data.ObjectType == binproperty: return True return False def has_extended_right(ace_object, binrightguid): ''' Checks if the access is sufficient to control the right with the given GUID. This can either be because we have the right ADS_RIGHT_DS_CONTROL_ACCESS and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_CONTROL_ACCESS right and the ObjectType is empty, in which case we have all extended rights. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx ''' if not ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS): return False if not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): # No ObjectType present - we have all extended rights return True # Both are binary here if ace_object.acedata.data.ObjectType == binrightguid: return True return False def ace_applies(ace_guid, object_class, objecttype_guid_map): ''' Checks if an ACE applies to this object (based on object classes). Note that this function assumes you already verified that InheritedObjectType is set (via the flag). If this is not set, the ACE applies to all object types. ''' if ace_guid == objecttype_guid_map[object_class]: return True # If none of these match, the ACE does not apply to this object return False def build_relation(sid, relation, acetype='', inherited=False): if acetype != '': raise ValueError("BH 4.0 incompatible output called") return {'rightname': relation, 'sid': sid, 'inherited': inherited} #from multiprocessing import Pool #class AclEnumerator(object): # """ # Helper class for ACL parsing. # """ # def __init__(self, addomain, addc, collect): # self.addomain = addomain # self.addc = addc # # Store collection methods specified # self.collect = collect # self.pool = None # # def init_pool(self): # self.pool = Pool() """ The following is Security Descriptor parsing using cstruct Thanks to Erik Schamper for helping me implement this! """ #cdef = native_str(""" cdef = """ struct SECURITY_DESCRIPTOR { uint8 Revision; uint8 Sbz1; uint16 Control; uint32 OffsetOwner; uint32 OffsetGroup; uint32 OffsetSacl; uint32 OffsetDacl; }; struct LDAP_SID_IDENTIFIER_AUTHORITY { char Value[6]; }; struct LDAP_SID { uint8 Revision; uint8 SubAuthorityCount; LDAP_SID_IDENTIFIER_AUTHORITY IdentifierAuthority; uint32 SubAuthority[SubAuthorityCount]; }; struct ACL { uint8 AclRevision; uint8 Sbz1; uint16 AclSize; uint16 AceCount; uint16 Sbz2; char Data[AclSize - 8]; }; struct ACE { uint8 AceType; uint8 AceFlags; uint16 AceSize; char Data[AceSize - 4]; }; struct ACCESS_ALLOWED_ACE { uint32 Mask; LDAP_SID Sid; }; struct ACCESS_ALLOWED_OBJECT_ACE { uint32 Mask; uint32 Flags; char ObjectType[Flags & 1 * 16]; char InheritedObjectType[Flags & 2 * 8]; LDAP_SID Sid; }; """ c_secd = cstruct() c_secd.load(cdef, compiled=True) class SecurityDescriptor(object): # Control indexes in bit field SR = 0 # Self-Relative RM = 1 # RM Control Valid PS = 2 # SACL Protected PD = 3 # DACL Protected SI = 4 # SACL Auto-Inherited DI = 5 # DACL Auto-Inherited SC = 6 # SACL Computed Inheritance Required DC = 7 # DACL Computed Inheritance Required SS = 8 # Server Security DT = 9 # DACL Trusted SD = 10 # SACL Defaulted SP = 11 # SACL Present DD = 12 # DACL Defaulted DP = 13 # DACL Present GD = 14 # Group Defaulted OD = 15 # Owner Defaulted def has_control(self, control): # Convert to bin representation and # look up index. Slice off 0b return bin(self.control)[2:][control] == '1' def __init__(self, fh): self.fh = fh self.descriptor = c_secd.SECURITY_DESCRIPTOR(fh) self.control = self.descriptor.Control self.owner_sid = b'' self.group_sid = b'' self.sacl = b'' self.dacl = b'' if self.descriptor.OffsetOwner != 0: fh.seek(self.descriptor.OffsetOwner) self.owner_sid = LdapSid(fh=fh) if self.descriptor.OffsetGroup != 0: fh.seek(self.descriptor.OffsetGroup) self.group_sid = LdapSid(fh=fh) if self.descriptor.OffsetSacl != 0: fh.seek(self.descriptor.OffsetSacl) self.sacl = ACL(fh) if self.descriptor.OffsetDacl != 0: fh.seek(self.descriptor.OffsetDacl) self.dacl = ACL(fh) class LdapSid(object): def __init__(self, fh=None, in_obj=None): if fh: self.fh = fh self.ldap_sid = c_secd.LDAP_SID(fh) else: self.ldap_sid = in_obj def __repr__(self): return "S-{}-{}-{}".format(self.ldap_sid.Revision, bytearray(self.ldap_sid.IdentifierAuthority.Value)[5], "-".join(['{:d}'.format(v) for v in self.ldap_sid.SubAuthority])) class ACL(object): def __init__(self, fh): self.fh = fh self.acl = c_secd.ACL(fh) self.aces = [] buf = BytesIO(self.acl.Data) for i in range(self.acl.AceCount): self.aces.append(ACE(buf)) class ACCESS_ALLOWED_ACE(object): def __init__(self, fh): self.fh = fh self.data = c_secd.ACCESS_ALLOWED_ACE(fh) self.sid = LdapSid(in_obj=self.data.Sid) self.mask = ACCESS_MASK(self.data.Mask) def __repr__(self): return "" % (str(self.sid), str(self.mask)) class ACCESS_DENIED_ACE(ACCESS_ALLOWED_ACE): pass class ACCESS_ALLOWED_OBJECT_ACE(object): # Flag constants ACE_OBJECT_TYPE_PRESENT = 0x01 ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x02 def __init__(self, fh): self.fh = fh self.data = c_secd.ACCESS_ALLOWED_OBJECT_ACE(fh) self.sid = LdapSid(in_obj=self.data.Sid) self.mask = ACCESS_MASK(self.data.Mask) def has_flag(self, flag): return self.data.Flags & flag == flag def get_object_type(self): if self.has_flag(self.ACE_OBJECT_TYPE_PRESENT): return bin_to_string(self.data.ObjectType) return None def get_inherited_object_type(self): if self.has_flag(self.ACE_INHERITED_OBJECT_TYPE_PRESENT): return bin_to_string(self.data.InheritedObjectType) return None def __repr__(self): out = [] #for name, value in iteritems(vars(ACCESS_ALLOWED_OBJECT_ACE)): for name, value in vars(ACCESS_ALLOWED_OBJECT_ACE): if not name.startswith('_') and type(value) is int and self.has_flag(value): out.append(name) data = (' | '.join(out), str(self.sid), str(self.mask), self.get_object_type(), self.get_inherited_object_type()) return "" % data class ACCESS_DENIED_OBJECT_ACE(ACCESS_ALLOWED_OBJECT_ACE): pass """ ACCESS_MASK as described in 2.4.3 https://msdn.microsoft.com/en-us/library/cc230294.aspx """ class ACCESS_MASK(object): # Flag constants # These constants are only used when WRITING # and are then translated into their actual rights SET_GENERIC_READ = 0x80000000 SET_GENERIC_WRITE = 0x04000000 SET_GENERIC_EXECUTE = 0x20000000 SET_GENERIC_ALL = 0x10000000 # When reading, these constants are actually represented by # the following for Active Directory specific Access Masks # Reference: https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectoryrights?view=netframework-4.7.2 GENERIC_READ = 0x00020094 GENERIC_WRITE = 0x00020028 GENERIC_EXECUTE = 0x00020004 GENERIC_ALL = 0x000F01FF # These are actual rights (for all ACE types) MAXIMUM_ALLOWED = 0x02000000 ACCESS_SYSTEM_SECURITY = 0x01000000 SYNCHRONIZE = 0x00100000 WRITE_OWNER = 0x00080000 WRITE_DACL = 0x00040000 READ_CONTROL = 0x00020000 DELETE = 0x00010000 # ACE type specific mask constants (for ACCESS_ALLOWED_OBJECT_ACE) # Note that while not documented, these also seem valid # for ACCESS_ALLOWED_ACE types ADS_RIGHT_DS_CONTROL_ACCESS = 0x00000100 ADS_RIGHT_DS_CREATE_CHILD = 0x00000001 ADS_RIGHT_DS_DELETE_CHILD = 0x00000002 ADS_RIGHT_DS_READ_PROP = 0x00000010 ADS_RIGHT_DS_WRITE_PROP = 0x00000020 ADS_RIGHT_DS_SELF = 0x00000008 def __init__(self, mask): self.mask = mask def has_priv(self, priv): return self.mask & priv == priv def set_priv(self, priv): self.mask |= priv def remove_priv(self, priv): self.mask ^= priv def __repr__(self): out = [] #for name, value in iteritems(vars(ACCESS_MASK)): for name, value in vars(ACCESS_MASK): if not name.startswith('_') and type(value) is int and self.has_priv(value): out.append(name) return "" % (self.mask, ' | '.join(out)) class ACE(object): CONTAINER_INHERIT_ACE = 0x02 FAILED_ACCESS_ACE_FLAG = 0x80 INHERIT_ONLY_ACE = 0x08 INHERITED_ACE = 0x10 NO_PROPAGATE_INHERIT_ACE = 0x04 OBJECT_INHERIT_ACE = 0x01 SUCCESSFUL_ACCESS_ACE_FLAG = 0x04 def __init__(self, fh): self.fh = fh self.ace = c_secd.ACE(fh) self.acedata = None buf = BytesIO(self.ace.Data) if self.ace.AceType == 0x00: # ACCESS_ALLOWED_ACE self.acedata = ACCESS_ALLOWED_ACE(buf) elif self.ace.AceType == 0x05: # ACCESS_ALLOWED_OBJECT_ACE self.acedata = ACCESS_ALLOWED_OBJECT_ACE(buf) elif self.ace.AceType == 0x01: # ACCESS_DENIED_ACE self.acedata = ACCESS_DENIED_ACE(buf) elif self.ace.AceType == 0x06: # ACCESS_DENIED_OBJECT_ACE self.acedata = ACCESS_DENIED_OBJECT_ACE(buf) # else: # print 'Unsupported type %d' % self.ace.AceType if self.acedata: self.mask = ACCESS_MASK(self.acedata.data.Mask) def __repr__(self): out = [] #for name, value in iteritems(vars(ACE)): for name, value in vars(ACE): if not name.startswith('_') and type(value) is int and self.has_flag(value): out.append(name) return "" % (self.ace.AceType, ' | '.join(out), self.ace.AceFlags, str(self.acedata)) def has_flag(self, flag): return self.ace.AceFlags & flag == flag ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0074086 msldap-0.5.9/msldap/external/bloodhoundpy/lib/0000775000175000017500000000000014535076203020744 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701364038.0 msldap-0.5.9/msldap/external/bloodhoundpy/lib/__init__.py0000664000175000017500000000000014532140506023036 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701940372.0 msldap-0.5.9/msldap/external/bloodhoundpy/lib/cstruct.py0000664000175000017500000015422114534306224023010 0ustar00webdevwebdev# Copyright (c) 2018 Fox-IT Security Research Team # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # TODO: # - Rework definition parsing, maybe pycparser? # - Change expression implementation # - Lazy reading? import re import sys import ast import pprint import string import struct import ctypes as _ctypes from io import BytesIO from collections import OrderedDict try: from builtins import bytes as newbytes except ImportError: newbytes = bytes PY3 = sys.version_info > (3,) if PY3: long = int xrange = range DEBUG = False COLOR_RED = '\033[1;31m' COLOR_GREEN = '\033[1;32m' COLOR_YELLOW = '\033[1;33m' COLOR_BLUE = '\033[1;34m' COLOR_PURPLE = '\033[1;35m' COLOR_CYAN = '\033[1;36m' COLOR_WHITE = '\033[1;37m' COLOR_NORMAL = '\033[1;0m' COLOR_BG_RED = '\033[1;41m\033[1;37m' COLOR_BG_GREEN = '\033[1;42m\033[1;37m' COLOR_BG_YELLOW = '\033[1;43m\033[1;37m' COLOR_BG_BLUE = '\033[1;44m\033[1;37m' COLOR_BG_PURPLE = '\033[1;45m\033[1;37m' COLOR_BG_CYAN = '\033[1;46m\033[1;37m' COLOR_BG_WHITE = '\033[1;47m\033[1;30m' PRINTABLE = string.digits + string.ascii_letters + string.punctuation + " " COMPILE_TEMPL = """ class {name}(Structure): def __init__(self, cstruct, structure, source=None): self.structure = structure self.source = source super({name}, self).__init__(cstruct, structure.name, structure.fields) def _read(self, stream): r = OrderedDict() sizes = {{}} bitreader = BitBuffer(stream, self.cstruct.endian) {read_code} return Instance(self, r, sizes) def add_fields(self, name, type_, offset=None): raise NotImplementedError("Can't add fields to a compiled structure") def __repr__(self): return '' """ class Error(Exception): pass class ParserError(Error): pass class CompilerError(Error): pass class ResolveError(Error): pass class NullPointerDereference(Error): pass def log(line, *args, **kwargs): if not DEBUG: return print(line.format(*args, **kwargs), file=sys.stderr) class cstruct(object): """Main class of cstruct. All types are registered in here. Args: endian: The endianness to use when parsing. pointer: The pointer type to use for Pointers. """ DEF_CSTYLE = 1 def __init__(self, endian='<', pointer='uint64'): self.endian = endian self.consts = {} self.lookups = {} self.typedefs = { 'byte': 'int8', 'ubyte': 'uint8', 'uchar': 'uint8', 'short': 'int16', 'ushort': 'uint16', 'long': 'int32', 'ulong': 'uint32', 'ulong64': 'uint64', 'u1': 'uint8', 'u2': 'uint16', 'u4': 'uint32', 'u8': 'uint64', 'word': 'uint16', 'dword': 'uint32', 'longlong': 'int64', 'ulonglong': 'uint64', 'int': 'int32', 'unsigned int': 'uint32', 'int8': PackedType(self, 'int8', 1, 'b'), 'uint8': PackedType(self, 'uint8', 1, 'B'), 'int16': PackedType(self, 'int16', 2, 'h'), 'uint16': PackedType(self, 'uint16', 2, 'H'), 'int32': PackedType(self, 'int32', 4, 'i'), 'uint32': PackedType(self, 'uint32', 4, 'I'), 'int64': PackedType(self, 'int64', 8, 'q'), 'uint64': PackedType(self, 'uint64', 8, 'Q'), 'float': PackedType(self, 'float', 4, 'f'), 'double': PackedType(self, 'double', 8, 'd'), 'char': CharType(self), 'wchar': WcharType(self), 'int24': BytesInteger(self, 'int24', 3, True), 'uint24': BytesInteger(self, 'uint24', 3, False), 'int48': BytesInteger(self, 'int48', 6, True), 'uint48': BytesInteger(self, 'uint48', 6, False), 'void': VoidType(), } self.pointer = self.resolve(pointer) def addtype(self, name, t, replace=False): """Add a type or type reference. Args: name: Name of the type to be added. t: The type to be added. Can be a str reference to another type or a compatible type class. Raises: ValueError: If the type already exists. """ name = name.lower() if not replace and name.lower() in self.typedefs: raise ValueError("Duplicate type: %s" % name) self.typedefs[name] = t def load(self, s, deftype=None, **kwargs): """Parse structures from the given definitions using the given definition type. Definitions can be parsed using different parsers. Currently, there's only one supported parser - DEF_CSTYLE. Parsers can add types and modify this cstruct instance. Arguments can be passed to parsers using kwargs. Args: s: The definition to parse. deftype: The definition type to parse the definitions with. **kwargs: Keyword arguments for parsers. """ deftype = deftype or cstruct.DEF_CSTYLE if deftype == cstruct.DEF_CSTYLE: parser = CStyleParser(self, **kwargs) parser.parse(s) def loadfile(self, s, deftype=None, **kwargs): """Load structure definitions from a file. The given path will be read and parsed using the .load() function. Args: s: The path to load definitions from. deftype: The definition type to parse the definitions with. **kwargs: Keyword arguments for parsers. """ with open(s, 'r') as fh: self.load(fh.read(), deftype, **kwargs) def read(self, name, s): """Parse data using a given type. Args: name: Type name to read. s: File-like object or byte string to parse. Returns: The parsed data. """ return self.resolve(name).read(s) def resolve(self, name): """Resolve a type name to get the actual type object. Types can be referenced using different names. When we want the actual type object, we need to resolve these references. Args: name: Type name to resolve. Returns: The resolved type object. Raises: ResolveError: If the type can't be resolved. """ t = name if not isinstance(t, str): return t for i in xrange(10): if t.lower() not in self.typedefs: raise ResolveError("Unknown type %s" % name) t = self.typedefs[t.lower()] if not isinstance(t, str): return t raise ResolveError("Recursion limit exceeded while resolving type %s" % name) def __getattr__(self, attr): if attr.lower() in self.typedefs: return self.typedefs[attr.lower()] if attr in self.consts: return self.consts[attr] raise AttributeError("Invalid Attribute: %s" % attr) class Parser(object): """Base class for definition parsers. Args: cstruct: An instance of cstruct. """ def __init__(self, cstruct): self.cstruct = cstruct def parse(self, data): """This function should parse definitions to cstruct types. Args: data: Data to parse definitions from, usually a string. """ raise NotImplementedError() class CStyleParser(Parser): """Definition parser for C-like structure syntax. Args: cstruct: An instance of cstruct compiled: Whether structs should be compiled or not. """ def __init__(self, cstruct, compiled=True): self.compiled = compiled super(CStyleParser, self).__init__(cstruct) # TODO: Implement proper parsing def parse(self, data): self._constants(data) self._enums(data) self._structs(data) self._lookups(data, self.cstruct.consts) def _constants(self, data): r = re.finditer(r'#define\s+(?P[^\s]+)\s+(?P[^\r\n]+)\s*\n', data) for t in r: d = t.groupdict() v = d['value'].rsplit('//')[0] try: v = ast.literal_eval(v) except (ValueError, SyntaxError): pass self.cstruct.consts[d['name']] = v def _enums(self, data): r = re.finditer( r'enum\s+(?P[^\s:{]+)\s*(:\s*(?P[^\s]+)\s*)?\{(?P[^}]+)\}\s*;', data, ) for t in r: d = t.groupdict() nextval = 0 values = {} for line in d['values'].split('\n'): line, sep, comment = line.partition("//") for v in line.split(","): key, sep, val = v.partition("=") key = key.strip() val = val.strip() if not key: continue if not val: val = nextval else: val = Expression(self.cstruct, val).evaluate({}) nextval = val + 1 values[key] = val if not d['type']: d['type'] = 'uint32' enum = Enum( self.cstruct, d['name'], self.cstruct.resolve(d['type']), values ) self.cstruct.addtype(enum.name, enum) def _structs(self, data): compiler = Compiler(self.cstruct) r = re.finditer( r'(#(?P(?:compile))\s+)?((?Ptypedef)\s+)?(?P[^\s]+)\s+(?P[^\s]+)?(?P\s*\{[^}]+\}(?P\s+[^;\n]+)?)?\s*;', data, ) for t in r: d = t.groupdict() if d['name']: name = d['name'] elif d['defs']: name = d['defs'].strip().split(',')[0].strip() else: raise ParserError("No name for struct") if d['type'] == 'struct': data = self._parse_fields(d['fields'][1:-1].strip()) st = Structure(self.cstruct, name, data) if d['flags'] == 'compile' or self.compiled: st = compiler.compile(st) elif d['typedef'] == 'typedef': st = d['type'] else: continue if d['name']: self.cstruct.addtype(d['name'], st) if d['defs']: for td in d['defs'].strip().split(','): td = td.strip() self.cstruct.addtype(td, st) def _parse_fields(self, s): fields = re.finditer( r'(?P[^\s]+)\s+(?P[^\s\[:]+)(\s*:\s*(?P\d+))?(\[(?P[^;\n]*)\])?;', s, ) r = [] for f in fields: d = f.groupdict() if d['type'].startswith('//'): continue type_ = self.cstruct.resolve(d['type']) d['name'] = d['name'].replace('(', '').replace(')', '') # Maybe reimplement lazy type references later # _type = TypeReference(self, d['type']) if d['count'] is not None: if d['count'] == '': count = None else: count = Expression(self.cstruct, d['count']) try: count = count.evaluate() except Exception: pass type_ = Array(self.cstruct, type_, count) if d['name'].startswith('*'): d['name'] = d['name'][1:] type_ = Pointer(self.cstruct, type_) field = Field(d['name'], type_, int(d['bits']) if d['bits'] else None) r.append(field) return r def _lookups(self, data, consts): r = re.finditer(r'\$(?P[^\s]+) = ({[^}]+})\w*\n', data) for t in r: d = ast.literal_eval(t.group(2)) self.cstruct.lookups[t.group(1)] = dict( [(self.cstruct.consts[k], v) for k, v in d.items()] ) class Instance(object): """Holds parsed structure data.""" def __init__(self, type_, values, sizes=None): object.__setattr__(self, '_type', type_) object.__setattr__(self, '_values', values) object.__setattr__(self, '_sizes', sizes) def write(self, fh): """Write this structure to a writable file-like object. Args: fh: File-like objects that supports writing. Returns: The amount of bytes written. """ return self.__dict__['_type'].write(fh, self) def dumps(self): """Dump this structure to a byte string. Returns: The raw bytes of this structure. """ s = BytesIO() self.write(s) return s.getvalue() def __getattr__(self, attr): if attr not in self.__dict__['_type'].lookup: raise AttributeError("Invalid attribute: %r" % attr) return self.__dict__['_values'][attr] def __setattr__(self, attr, value): if attr not in self.__dict__['_type'].lookup: raise AttributeError("Invalid attribute: %r" % attr) self.__dict__['_values'][attr] = value def __getitem__(self, item): return self.__dict__['_values'][item] def __contains__(self, attr): return attr in self.__dict__['_values'] def __repr__(self): return '<%s %s>' % ( self.__dict__['_type'].name, ', '.join( [ '%s=%s' % (k, hex(v) if isinstance(v, (int, long)) else repr(v)) for k, v in self.__dict__['_values'].items() ] ), ) def __len__(self): return len(self.dumps()) def _size(self, field): return self.__dict__['_sizes'][field] class PointerInstance(object): """Like the Instance class, but for structures referenced by a pointer.""" def __init__(self, t, stream, addr, ctx): self._stream = stream self._type = t self._addr = addr self._ctx = ctx self._value = None def _get(self): log("Dereferencing pointer -> 0x{:016x} [{!r}]", self._addr, self._stream) if self._addr == 0: raise NullPointerDereference() if self._value is None: pos = self._stream.tell() self._stream.seek(self._addr) if isinstance(self._type, Array): r = self._type._read(self._stream, self._ctx) else: r = self._type._read(self._stream) self._stream.seek(pos) self._value = r return self._value def __getattr__(self, attr): return getattr(self._get(), attr) def __str__(self): return str(self._get()) def __nonzero__(self): return self._addr != 0 def __repr__(self): return "".format(self._type, self._addr) class Expression(object): """Expression parser for simple calculations in definitions.""" operators = [ ('+', lambda a, b: a + b), ('-', lambda a, b: a - b), ('*', lambda a, b: a * b), ('/', lambda a, b: a / b), ('&', lambda a, b: a & b), ('|', lambda a, b: a | b), ('>>', lambda a, b: a >> b), ('<<', lambda a, b: a << b), ] def __init__(self, cstruct, expr): self.cstruct = cstruct self.expr = expr def evaluate(self, context=None): context = context if context else {} level = 0 levels = [] buf = '' for i in xrange(len(self.expr)): if self.expr[i] == '(': level += 1 levels.append(buf) buf = '' continue if self.expr[i] == ')': level -= 1 val = self.evaluate_part(buf, context) buf = levels.pop() buf += str(val) continue buf += self.expr[i] return self.evaluate_part(buf, context) def evaluate_part(self, e, v): e = e.strip() for o in self.operators: if o[0] in e: a, b = e.rsplit(o[0], 1) return o[1](self.evaluate_part(a, v), self.evaluate_part(b, v)) if e in v: return v[e] if e.startswith('0x'): return int(e, 16) if e in self.cstruct.consts: return self.cstruct.consts[e] return int(e) def __repr__(self): return self.expr class BaseType(object): """Base class for cstruct type classes.""" def __init__(self, cstruct): self.cstruct = cstruct def reads(self, data): """Parse the given data according to the type that implements this class. Args: data: Byte string to parse. Returns: The parsed value of this type. """ data = BytesIO(data) return self._read(data) def dumps(self, data): """Dump the given data according to the type that implements this class. Args: data: Data to dump. Returns: The resulting bytes. """ out = BytesIO() self._write(out, data) return out.getvalue() def read(self, obj, *args, **kwargs): """Parse the given data according to the type that implements this class. Args: obj: Data to parse. Can be a (byte) string or a file-like object. Returns: The parsed value of this type. """ if isinstance(obj, (str, bytes, newbytes)): return self.reads(obj) return self._read(obj) def write(self, stream, data): """Write the given data to a writable file-like object according to the type that implements this class. Args: stream: Writable file-like object to write to. data: Data to write. Returns: The amount of bytes written. """ return self._write(stream, data) def _read(self, stream): raise NotImplementedError() def _read_array(self, stream, count): return [self._read(stream) for i in xrange(count)] def _read_0(self, stream): raise NotImplementedError() def _write(self, stream, data): raise NotImplementedError() def _write_array(self, stream, data): num = 0 for i in data: num += self._write(stream, i) return num def _write_0(self, stream, data): raise NotImplementedError() def default(self): """Return a default value of this type.""" raise NotImplementedError() def default_array(self): """Return a default array of this type.""" raise NotImplementedError() def __getitem__(self, count): return Array(self.cstruct, self, count) def __call__(self, *args, **kwargs): if len(args) > 0: return self.read(*args, **kwargs) r = self.default() if kwargs: for k, v in kwargs.items(): setattr(r, k, v) return r class RawType(BaseType): """Base class for raw types that have a name and size.""" def __init__(self, cstruct, name=None, size=0): self.name = name self.size = size super(RawType, self).__init__(cstruct) def __len__(self): return self.size def __repr__(self): if self.name: return self.name return BaseType.__repr__(self) class Structure(BaseType): """Type class for structures.""" def __init__(self, cstruct, name, fields=None): self.name = name self.size = None self.lookup = OrderedDict() self.fields = fields if fields else [] for f in self.fields: self.lookup[f.name] = f self._calc_offsets() super(Structure, self).__init__(cstruct) def _calc_offsets(self): offset = 0 bitstype = None bitsremaining = 0 for field in self.fields: if field.bits: if bitsremaining == 0 or field.type != bitstype: bitstype = field.type bitsremaining = bitstype.size * 8 if offset is not None: field.offset = offset offset += bitstype.size else: field.offset = None bitsremaining -= field.bits continue field.offset = offset if offset is not None: try: offset += len(field.type) except TypeError: offset = None def _calc_size(self): size = 0 bitstype = None bitsremaining = 0 for field in self.fields: if field.bits: if bitsremaining == 0 or field.type != bitstype: bitstype = field.type bitsremaining = bitstype.size * 8 size += bitstype.size bitsremaining -= field.bits continue fieldlen = len(field.type) size += fieldlen if field.offset is not None: size = max(size, field.offset + fieldlen) return size def _read(self, stream, *args, **kwargs): log("[Structure::read] {} {}", self.name, self.size) bitbuffer = BitBuffer(stream, self.cstruct.endian) struct_start = stream.tell() r = OrderedDict() sizes = {} for field in self.fields: start = stream.tell() ft = self.cstruct.resolve(field.type) if field.offset: if start != struct_start + field.offset: log( "+ seeking to 0x{:x}+0x{:x} for {}".format( struct_start, field.offset, field.name ) ) stream.seek(struct_start + field.offset) start = struct_start + field.offset if field.bits: r[field.name] = bitbuffer.read(ft, field.bits) continue else: bitbuffer.reset() if isinstance(ft, (Array, Pointer)): v = ft._read(stream, r) else: v = ft._read(stream) sizes[field.name] = stream.tell() - start r[field.name] = v return Instance(self, r, sizes) def _write(self, stream, data): bitbuffer = BitBuffer(stream, self.cstruct.endian) num = 0 for field in self.fields: if field.bits: bitbuffer.write(field.type, getattr(data, field.name), field.bits) continue if bitbuffer._type: bitbuffer.flush() num += field.type._write(stream, getattr(data, field.name)) # Flush bitbuffer if bitbuffer._type: bitbuffer.flush() return num def add_field(self, name, type_, offset=None): """Add a field to this structure. Args: name: The field name. type_: The field type. offset: The field offset. """ field = Field(name, type_, offset=offset) self.fields.append(field) self.lookup[name] = field self.size = None setattr(self, name, field) def default(self): """Create and return an empty Instance from this structure. Returns: An empty Instance from this structure. """ r = OrderedDict() for field in self.fields: r[field.name] = field.type.default() return Instance(self, r) def __len__(self): if self.size is None: self.size = self._calc_size() return self.size def __repr__(self): return ''.format(self.name) def show(self, indent=0): """Pretty print this structure.""" if indent == 0: print("struct {}".format(self.name)) for field in self.fields: if field.offset is None: offset = '0x??' else: offset = '0x{:02x}'.format(field.offset) print("{}+{} {} {}".format(' ' * indent, offset, field.name, field.type)) if isinstance(field.type, Structure): field.type.show(indent + 1) class BitBuffer(object): """Implements a bit buffer that can read and write bit fields.""" def __init__(self, stream, endian): self.stream = stream self.endian = endian self._type = None self._buffer = 0 self._remaining = 0 def read(self, field_type, bits): if self._remaining < 1 or self._type != field_type: self._type = field_type self._remaining = field_type.size * 8 self._buffer = field_type._read(self.stream) if self.endian != '>': v = self._buffer & ((1 << bits) - 1) self._buffer >>= bits self._remaining -= bits else: v = self._buffer & ( ((1 << (self._remaining - bits)) - 1) ^ ((1 << self._remaining) - 1) ) v >>= self._remaining - bits self._remaining -= bits return v def write(self, field_type, data, bits): if self._remaining == 0: self._remaining = field_type.size * 8 self._type = field_type if self.endian != '>': self._buffer |= data << (self._type.size * 8 - self._remaining) else: self._buffer |= data << (self._remaining - bits) self._remaining -= bits def flush(self): self._type._write(self.stream, self._buffer) self._type = None self._remaining = 0 self._buffer = 0 def reset(self): self._type = None self._buffer = 0 self._remaining = 0 class Field(object): """Holds a structure field.""" def __init__(self, name, type_, bits=None, offset=None): self.name = name self.type = type_ self.bits = bits self.offset = offset def __repr__(self): return ''.format(self.name, self.type) class Array(BaseType): """Implements a fixed or dynamically sized array type. Example: When using the default C-style parser, the following syntax is supported: x[3] -> 3 -> static length. x[] -> None -> null-terminated. x[expr] -> expr -> dynamic length. """ def __init__(self, cstruct, type_, count): self.type = type_ self.count = count self.dynamic = isinstance(self.count, Expression) or self.count is None super(Array, self).__init__(cstruct) def _read(self, stream, context=None): if self.count is None: return self.type._read_0(stream) if self.dynamic: count = self.count.evaluate(context) else: count = self.count return self.type._read_array(stream, max(0, count)) def _write(self, f, data): if self.count is None: return self.type._write_0(f, data) return self.type._write_array(f, data) def default(self): if self.dynamic or self.count is None: return [] return [self.type.default() for i in xrange(self.count)] def __repr__(self): if self.count is None: return '{0!r}[]'.format(self.type) return '{0!r}[{1}]'.format(self.type, self.count) def __len__(self): if self.dynamic: raise TypeError("Dynamic size") return len(self.type) * self.count class PackedType(RawType): """Implements a packed type that uses Python struct packing characters.""" def __init__(self, cstruct, name, size, packchar): self.packchar = packchar super(PackedType, self).__init__(cstruct, name, size) def _read(self, stream): return self._read_array(stream, 1)[0] def _read_array(self, stream, count): length = self.size * count data = stream.read(length) fmt = self.cstruct.endian + str(count) + self.packchar if len(data) != length: raise EOFError("Read %d bytes, but expected %d" % (len(data), length)) return list(struct.unpack(fmt, data)) def _read_0(self, stream): r = [] while True: d = stream.read(self.size) v = struct.unpack(self.cstruct.endian + self.packchar, d)[0] if v == 0: break r.append(v) return r def _write(self, stream, data): return self._write_array(stream, [data]) def _write_array(self, stream, data): fmt = self.cstruct.endian + str(len(data)) + self.packchar return stream.write(struct.pack(fmt, *data)) def _write_0(self, stream, data): return self._write_array(stream, data + [0]) def default(self): return 0 def default_array(self, count): return [0] * count class CharType(RawType): """Implements a character type that can properly handle strings.""" def __init__(self, cstruct): super(CharType, self).__init__(cstruct, 'char', 1) def _read(self, stream): return stream.read(1) def _read_array(self, stream, count): if count == 0: return b'' return stream.read(count) def _read_0(self, stream): r = [] while True: c = stream.read(1) if c == b'': raise EOFError() if c == b'\x00': break r.append(c) return b''.join(r) def _write(self, stream, data): if isinstance(data, int): data = chr(data) if PY3 and isinstance(data, str): data = data.encode('latin-1') return stream.write(data) def _write_array(self, stream, data): return self._write(stream, data) def _write_0(self, stream, data): return self._write(stream, data + b'\x00') def default(self): return b'\x00' def default_array(self, count): return b'\x00' * count class WcharType(RawType): """Implements a wide-character type.""" def __init__(self, cstruct): super(WcharType, self).__init__(cstruct, 'wchar', 2) @property def encoding(self): if self.cstruct.endian == '<': return 'utf-16-le' elif self.cstruct.endian == '>': return 'utf-16-be' def _read(self, stream): return stream.read(2).decode(self.encoding) def _read_array(self, stream, count): if count == 0: return u'' data = stream.read(2 * count) return data.decode(self.encoding) def _read_0(self, stream): r = b'' while True: c = stream.read(2) if len(c) != 2: raise EOFError() if c == b'\x00\x00': break r += c return r.decode(self.encoding) def _write(self, stream, data): return stream.write(data.encode(self.encoding)) def _write_array(self, stream, data): return self._write(stream, data) def _write_0(self, stream, data): return self._write(stream, data + u'\x00') def default(self): return u'\x00' def default_array(self, count): return u'\x00' * count class BytesInteger(RawType): """Implements an integer type that can span an arbitrary amount of bytes.""" def __init__(self, cstruct, name, size, signed): self.signed = signed super(BytesInteger, self).__init__(cstruct, name, size) @staticmethod def parse(buf, size, count, signed, endian): nums = [] for c in xrange(count): num = 0 data = buf[c * size:(c + 1) * size] if endian == '<': data = b''.join(data[i:i + 1] for i in reversed(xrange(len(data)))) ints = list(data) if PY3 else map(ord, data) for i in ints: num = (num << 8) | i if signed and num & 1 << (size * 8 - 1): bias = 1 << (size * 8 - 1) num -= bias * 2 nums.append(num) return nums @staticmethod def pack(data, size, endian): buf = [] for i in data: num = int(i) if num < 0: num += 1 << (size * 8) d = [b'\x00'] * size i = size - 1 while i >= 0: b = num & 255 d[i] = bytes((b,)) if PY3 else chr(b) num >>= 8 i -= 1 if endian == '<': d = b''.join(d[i:i + 1][0] for i in reversed(xrange(len(d)))) else: d = b''.join(d) buf.append(d) return b''.join(buf) def _read(self, stream): return self.parse(stream.read(self.size * 1), self.size, 1, self.signed, self.cstruct.endian)[0] def _read_array(self, stream, count): return self.parse(stream.read(self.size * count), self.size, count, self.signed, self.cstruct.endian) def _read_0(self, stream): r = [] while True: v = self._read(stream) if v == 0: break r.append(v) return r def _write(self, stream, data): return stream.write(self.pack([data], self.size, self.cstruct.endian)) def _write_array(self, stream, data): return stream.write(self.pack(data, self.size, self.cstruct.endian)) def _write_0(self, stream, data): return self._write_array(stream, data + [0]) def default(self): return 0 def default_array(self, count): return [0] * count class Enum(RawType): """Implements an Enum type. Enums can be made using any type. The API for accessing enums and their values is very similar to Python 3 native enums. Example: When using the default C-style parser, the following syntax is supported: enum [: ] { }; For example, an enum that has A=1, B=5 and C=6 could be written like so: enum Test : uint16 { A, B=5, C }; """ def __init__(self, cstruct, name, type_, values): self.type = type_ self.values = values self.reverse = {} for k, v in values.items(): self.reverse[v] = k super(Enum, self).__init__(cstruct, name, len(self.type)) def __call__(self, value): return EnumInstance(self, value) def _read(self, stream): v = self.type._read(stream) return self(v) def _read_array(self, stream, count): return list(map(self, self.type._read_array(stream, count))) def _read_0(self, stream): return list(map(self, self.type._read_0(stream))) def _write(self, stream, data): data = data.value if isinstance(data, EnumInstance) else data return self.type._write(stream, data) def _write_array(self, stream, data): data = [d.value if isinstance(d, EnumInstance) else d for d in data] return self.type._write_array(stream, data) def _write_0(self, stream, data): data = [d.value if isinstance(d, EnumInstance) else d for d in data] return self.type._write_0(stream, data) def default(self): return self(0) def __getitem__(self, attr): if attr in self.values: return self(self.values[attr]) raise KeyError(attr) def __getattr__(self, attr): if attr in self.values: return self(self.values[attr]) raise AttributeError(attr) def __contains__(self, attr): return attr in self.values class EnumInstance(object): """Implements a value instance of an Enum""" def __init__(self, enum, value): self.enum = enum self.value = value @property def name(self): if self.value not in self.enum.reverse: return '{}_{}'.format(self.enum.name, self.value) return self.enum.reverse[self.value] def __eq__(self, value): if isinstance(value, EnumInstance) and value.enum is not self.enum: return False if hasattr(value, 'value'): value = value.value return self.value == value def __ne__(self, value): return self.__eq__(value) is False def __hash__(self): return hash((self.enum, self.value)) def __str__(self): return '{}.{}'.format(self.enum.name, self.name) def __repr__(self): return '<{}.{}: {}>'.format(self.enum.name, self.name, self.value) class Union(RawType): def __init__(self, cstruct): self.cstruct = cstruct super(Union, self).__init__(cstruct) def _read(self, stream): raise NotImplementedError() class Pointer(RawType): """Implements a pointer to some other type.""" def __init__(self, cstruct, target): self.cstruct = cstruct self.type = target super(Pointer, self).__init__(cstruct) def _read(self, stream, ctx): addr = self.cstruct.pointer(stream) return PointerInstance(self.type, stream, addr, ctx) def __len__(self): return len(self.cstruct.pointer) def __repr__(self): return ''.format(self.type) class VoidType(RawType): """Implements a void type.""" def __init__(self): super(VoidType, self).__init__(None, 'void', 0) def _read(self, stream): return None def ctypes(structure): """Create ctypes structures from cstruct structures.""" fields = [] for field in structure.fields: t = ctypes_type(field.type) fields.append((field.name, t)) tt = type(structure.name, (_ctypes.Structure, ), {"_fields_": fields}) return tt def ctypes_type(t): mapping = { "I": _ctypes.c_ulong, "i": _ctypes.c_long, "b": _ctypes.c_int8, } if isinstance(t, PackedType): return mapping[t.packchar] if isinstance(t, CharType): return _ctypes.c_char if isinstance(t, Array): subtype = ctypes_type(t._type) return subtype * t.count if isinstance(t, Pointer): subtype = ctypes_type(t._target) return ctypes.POINTER(subtype) raise NotImplementedError("Type not implemented: %s" % t.__class__.__name__) class Compiler(object): """Compiler for cstruct structures. Creates somewhat optimized parsing code.""" def __init__(self, cstruct): self.cstruct = cstruct def compile(self, structure): source = self.gen_struct_class(structure) c = compile(source, '', 'exec') env = { 'OrderedDict': OrderedDict, 'Structure': Structure, 'Instance': Instance, 'Expression': Expression, 'EnumInstance': EnumInstance, 'PointerInstance': PointerInstance, 'BytesInteger': BytesInteger, 'BitBuffer': BitBuffer, 'struct': struct, 'xrange': xrange, } exec(c, env) sc = env[structure.name](self.cstruct, structure, source) return sc def gen_struct_class(self, structure): blocks = [] classes = [] cur_block = [] read_size = 0 prev_was_bits = False for field in structure.fields: ft = self.cstruct.resolve(field.type) if not isinstance( ft, ( Structure, Pointer, Enum, Array, PackedType, CharType, WcharType, BytesInteger, ), ): raise CompilerError("Unsupported type for compiler: {}".format(ft)) if isinstance(ft, Structure) or ( isinstance(ft, Array) and isinstance(ft.type, Structure) ): if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) struct_read = 's = stream.tell()\n' if isinstance(ft, Array): num = ft.count if isinstance(num, Expression): num = 'max(0, Expression(self.cstruct, "{expr}").evaluate(r))'.format( expr=num.expr ) struct_read += ( 'r["{name}"] = []\n' 'for _ in xrange({num}):\n' ' r["{name}"].append(self.cstruct.{struct_name}._read(stream))\n'.format( name=field.name, num=num, struct_name=ft.type.name ) ) else: struct_read += 'r["{name}"] = self.cstruct.{struct_name}._read(stream)\n'.format( name=field.name, struct_name=ft.name ) struct_read += 'sizes["{name}"] = stream.tell() - s'.format( name=field.name ) blocks.append(struct_read) read_size = 0 cur_block = [] continue if field.bits: if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) blocks.append( 'r["{name}"] = bitreader.read(self.cstruct.{type_name}, {bits})'.format( name=field.name, type_name=field.type.name, bits=field.bits ) ) read_size = 0 cur_block = [] prev_was_bits = True continue elif prev_was_bits: blocks.append('bitreader.reset()') prev_was_bits = False try: count = len(ft) read_size += count cur_block.append(field) except Exception: if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) blocks.append(self.gen_dynamic_block(field)) read_size = 0 cur_block = [] if len(cur_block): blocks.append(self.gen_read_block(read_size, cur_block)) read_code = '\n\n'.join(blocks) read_code = '\n'.join([' ' * 2 + line for line in read_code.split('\n')]) classes.append(COMPILE_TEMPL.format(name=structure.name, read_code=read_code)) return '\n\n'.join(classes) def gen_read_block(self, size, block): templ = ( 'buf = stream.read({size})\n' 'if len(buf) != {size}: raise EOFError()\n' 'data = struct.unpack(self.cstruct.endian + "{{}}", buf)\n' '{{}}'.format(size=size) ) readcode = [] fmt = [] curtype = None curcount = 0 buf_offset = 0 data_offset = 0 for field in block: ft = self.cstruct.resolve(field.type) t = ft count = 1 data_count = 1 read_slice = '' if isinstance(t, Enum): t = t.type elif isinstance(t, Pointer): t = self.cstruct.pointer if isinstance(ft, Array): count = t.count data_count = count t = t.type if isinstance(t, Enum): t = t.type elif isinstance(t, Pointer): t = self.cstruct.pointer if isinstance(t, (CharType, WcharType, BytesInteger)): read_slice = '{}:{}'.format( buf_offset, buf_offset + (count * t.size) ) else: read_slice = '{}:{}'.format(data_offset, data_offset + count) elif isinstance(t, CharType): read_slice = str(buf_offset) elif isinstance(t, (WcharType, BytesInteger)): read_slice = '{}:{}'.format(buf_offset, buf_offset + t.size) else: read_slice = str(data_offset) if not curtype: if isinstance(t, PackedType): curtype = t.packchar else: curtype = 'x' if isinstance(t, (PackedType, CharType, WcharType, BytesInteger, Enum)): charcount = count if isinstance(t, (CharType, WcharType, BytesInteger)): data_count = 0 packchar = 'x' charcount *= t.size else: packchar = t.packchar if curtype != packchar: fmt.append('{}{}'.format(curcount, curtype)) curcount = 0 curcount += charcount curtype = packchar getter = '' if isinstance(t, BytesInteger): getter = 'BytesInteger.parse(buf[{slice}], {size}, {count}, {signed}, self.cstruct.endian){data_slice}'.format( slice=read_slice, size=t.size, count=count, signed=t.signed, data_slice='[0]' if count == 1 else '', ) elif isinstance(t, (CharType, WcharType)): getter = 'buf[{}]'.format(read_slice) if isinstance(t, WcharType): getter += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" else: getter = 'data[{}]'.format(read_slice) if isinstance(ft, Enum): getter = 'EnumInstance(self.cstruct.{type_name}, {getter})'.format( type_name=ft.name, getter=getter ) elif isinstance(ft, Array) and isinstance(ft.type, Enum): getter = '[EnumInstance(self.cstruct.{type_name}, d) for d in {getter}]'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Pointer): getter = 'PointerInstance(self.cstruct.{type_name}, stream, {getter}, r)'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Array) and isinstance(ft.type, Pointer): getter = '[PointerInstance(self.cstruct.{type_name}, stream, d, r) for d in {getter}]'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Array) and isinstance(t, PackedType): getter = 'list({})'.format(getter) readcode.append( 'r["{name}"] = {getter}'.format(name=field.name, getter=getter) ) readcode.append( 'sizes["{name}"] = {size}'.format(name=field.name, size=count * t.size) ) data_offset += data_count buf_offset += count * t.size if curcount: fmt.append('{}{}'.format(curcount, curtype)) return templ.format(''.join(fmt), '\n'.join(readcode)) def gen_dynamic_block(self, field): if not isinstance(field.type, Array): raise CompilerError( "Only Array can be dynamic, got {!r}".format(field.type) ) t = field.type.type reader = None if not field.type.count: # Null terminated if isinstance(t, PackedType): reader = ( 't = []\nwhile True:\n' ' d = stream.read({size})\n' ' if len(d) != {size}: raise EOFError()\n' ' v = struct.unpack(self.cstruct.endian + "{packchar}", d)[0]\n' ' if v == 0: break\n' ' t.append(v)'.format(size=t.size, packchar=t.packchar) ) elif isinstance(t, (CharType, WcharType)): reader = ( 't = []\n' 'while True:\n' ' c = stream.read({size})\n' ' if len(c) != {size}: raise EOFError()\n' ' if c == b"{null}": break\n' ' t.append(c)\nt = b"".join(t)'.format( size=t.size, null='\\x00' * t.size ) ) if isinstance(t, WcharType): reader += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" elif isinstance(t, BytesInteger): reader = ( 't = []\n' 'while True:\n' ' d = stream.read({size})\n' ' if len(d) != {size}: raise EOFError()\n' ' v = BytesInteger.parse(d, {size}, 1, {signed}, self.cstruct.endian)\n' ' if v == 0: break\n' ' t.append(v)'.format(size=t.size, signed=t.signed) ) return '{reader}\nr["{name}"] = t\nsizes["{name}"] = len(t)'.format( reader=reader, name=field.name ) else: expr = field.type.count.expr expr_read = ( 'dynsize = max(0, Expression(self.cstruct, "{expr}").evaluate(r))\n' 'buf = stream.read(dynsize * {type_size})\n' 'if len(buf) != dynsize * {type_size}: raise EOFError()\n' 'r["{name}"] = {{reader}}\n' 'sizes["{name}"] = dynsize * {type_size}'.format( expr=expr, name=field.name, type_size=t.size ) ) if isinstance(t, PackedType): reader = 'list(struct.unpack(self.cstruct.endian + "{{:d}}{packchar}".format(dynsize), buf))'.format( packchar=t.packchar, type_size=t.size ) elif isinstance(t, (CharType, WcharType)): reader = 'buf' if isinstance(t, WcharType): reader += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" elif isinstance(t, BytesInteger): reader = 'BytesInteger.parse(buf, {size}, dynsize, {signed}, self.cstruct.endian)'.format( size=t.size, signed=t.signed ) return expr_read.format(reader=reader, size=None) def hexdump(s, palette=None, offset=0, prefix=""): """Hexdump some data. Args: s: Bytes to hexdump. palette: Colorize the hexdump using this color pattern. offset: Byte offset of the hexdump. prefix: Optional prefix. """ if palette: palette = palette[::-1] remaining = 0 active = None for i in xrange(0, len(s), 16): vals = "" chars = [] for j in xrange(16): if not active and palette: remaining, active = palette.pop() vals += active elif active and j == 0: vals += active if i + j >= len(s): vals += " " else: c = s[i + j] c = chr(c) if PY3 else c p = c if c in PRINTABLE else "." if active: vals += "{:02x}".format(ord(c)) chars.append(active + p + COLOR_NORMAL) else: vals += "{:02x}".format(ord(c)) chars.append(p) remaining -= 1 if remaining == 0: active = None if palette is not None: vals += COLOR_NORMAL if j == 15: if palette is not None: vals += COLOR_NORMAL vals += " " if j == 7: vals += " " chars = "".join(chars) print("{}{:08x} {:48s} {}".format(prefix, offset + i, vals, chars)) def dumpstruct(t, data=None, offset=0): """Dump a structure or parsed structure instance. Prints a colorized hexdump and parsed structure output. Args: t: Structure or Instance to dump. data: Bytes to parse the Structure on, if t is not a parsed Instance. offset: Byte offset of the hexdump. """ colors = [ (COLOR_RED, COLOR_BG_RED), (COLOR_GREEN, COLOR_BG_GREEN), (COLOR_YELLOW, COLOR_BG_YELLOW), (COLOR_BLUE, COLOR_BG_BLUE), (COLOR_PURPLE, COLOR_BG_PURPLE), (COLOR_CYAN, COLOR_BG_CYAN), (COLOR_WHITE, COLOR_BG_WHITE), ] if isinstance(t, Instance): g = t t = t._type data = g.dumps() elif isinstance(t, Structure) and data: g = t(data) else: raise ValueError("Invalid arguments") palette = [] ci = 0 out = "struct {}".format(t.name) + ":\n" for field in g._type.fields: fg, bg = colors[ci % len(colors)] palette.append((g._size(field.name), bg)) ci += 1 v = getattr(g, field.name) if isinstance(v, str): v = repr(v) elif isinstance(v, int): v = hex(v) elif isinstance(v, list): v = pprint.pformat(v) if '\n' in v: v = v.replace('\n', '\n{}'.format(' ' * (len(field.name) + 4))) out += "- {}{}{}: {}\n".format(fg, field.name, COLOR_NORMAL, v) print() hexdump(data, palette, offset=offset) print() print(out) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701937323.0 msldap-0.5.9/msldap/external/bloodhoundpy/resolver.py0000664000175000017500000001425614534300253022413 0ustar00webdevwebdevfrom msldap import logger WELLKNOWN_SIDS = { "S-1-0": ("Null Authority", "USER"), "S-1-0-0": ("Nobody", "USER"), "S-1-1": ("World Authority", "USER"), "S-1-1-0": ("Everyone", "GROUP"), "S-1-2": ("Local Authority", "USER"), "S-1-2-0": ("Local", "GROUP"), "S-1-2-1": ("Console Logon", "GROUP"), "S-1-3": ("Creator Authority", "USER"), "S-1-3-0": ("Creator Owner", "USER"), "S-1-3-1": ("Creator Group", "GROUP"), "S-1-3-2": ("Creator Owner Server", "COMPUTER"), "S-1-3-3": ("Creator Group Server", "COMPUTER"), "S-1-3-4": ("Owner Rights", "GROUP"), "S-1-4": ("Non-unique Authority", "USER"), "S-1-5": ("NT Authority", "USER"), "S-1-5-1": ("Dialup", "GROUP"), "S-1-5-2": ("Network", "GROUP"), "S-1-5-3": ("Batch", "GROUP"), "S-1-5-4": ("Interactive", "GROUP"), "S-1-5-6": ("Service", "GROUP"), "S-1-5-7": ("Anonymous", "GROUP"), "S-1-5-8": ("Proxy", "GROUP"), "S-1-5-9": ("Enterprise Domain Controllers", "GROUP"), "S-1-5-10": ("Principal Self", "USER"), "S-1-5-11": ("Authenticated Users", "GROUP"), "S-1-5-12": ("Restricted Code", "GROUP"), "S-1-5-13": ("Terminal Server Users", "GROUP"), "S-1-5-14": ("Remote Interactive Logon", "GROUP"), "S-1-5-15": ("This Organization", "GROUP"), "S-1-5-17": ("IUSR", "USER"), "S-1-5-18": ("Local System", "USER"), "S-1-5-19": ("NT Authority", "USER"), "S-1-5-20": ("Network Service", "USER"), "S-1-5-80-0": ("All Services ", "GROUP"), "S-1-5-32-544": ("Administrators", "GROUP"), "S-1-5-32-545": ("Users", "GROUP"), "S-1-5-32-546": ("Guests", "GROUP"), "S-1-5-32-547": ("Power Users", "GROUP"), "S-1-5-32-548": ("Account Operators", "GROUP"), "S-1-5-32-549": ("Server Operators", "GROUP"), "S-1-5-32-550": ("Print Operators", "GROUP"), "S-1-5-32-551": ("Backup Operators", "GROUP"), "S-1-5-32-552": ("Replicators", "GROUP"), "S-1-5-32-554": ("Pre-Windows 2000 Compatible Access", "GROUP"), "S-1-5-32-555": ("Remote Desktop Users", "GROUP"), "S-1-5-32-556": ("Network Configuration Operators", "GROUP"), "S-1-5-32-557": ("Incoming Forest Trust Builders", "GROUP"), "S-1-5-32-558": ("Performance Monitor Users", "GROUP"), "S-1-5-32-559": ("Performance Log Users", "GROUP"), "S-1-5-32-560": ("Windows Authorization Access Group", "GROUP"), "S-1-5-32-561": ("Terminal Server License Servers", "GROUP"), "S-1-5-32-562": ("Distributed COM Users", "GROUP"), "S-1-5-32-568": ("IIS_IUSRS", "GROUP"), "S-1-5-32-569": ("Cryptographic Operators", "GROUP"), "S-1-5-32-573": ("Event Log Readers", "GROUP"), "S-1-5-32-574": ("Certificate Service DCOM Access", "GROUP"), "S-1-5-32-575": ("RDS Remote Access Servers", "GROUP"), "S-1-5-32-576": ("RDS Endpoint Servers", "GROUP"), "S-1-5-32-577": ("RDS Management Servers", "GROUP"), "S-1-5-32-578": ("Hyper-V Administrators", "GROUP"), "S-1-5-32-579": ("Access Control Assistance Operators", "GROUP"), "S-1-5-32-580": ("Access Control Assistance Operators", "GROUP"), "S-1-5-32-582": ("Storage Replica Administrators", "GROUP") } def resolve_aces(aces, domainname, domainsid, sidcache): aces_out = [] for ace in aces: out = { 'RightName': ace['rightname'], 'IsInherited': ace['inherited'] } # Is it a well-known sid? if ace['sid'] in WELLKNOWN_SIDS: out['PrincipalSID'] = u'%s-%s' % (domainname.upper(), ace['sid']) out['PrincipalType'] = WELLKNOWN_SIDS[ace['sid']][1].capitalize() else: linkitem = sidcache.get(ace['sid']) if linkitem is None: logger.debug('[EXT-BH] Cache miss for %s' % ace['sid']) entry = { 'type': 'Base', 'objectid': ace['sid'] } linkitem = { "ObjectIdentifier": entry['objectid'], "ObjectType": entry['type'].capitalize() } sidcache[ace['sid']] = linkitem out['PrincipalSID'] = ace['sid'] out['PrincipalType'] = linkitem['ObjectType'].capitalize() for tace in aces_out: if out['PrincipalSID'] == tace['PrincipalSID'] and out['PrincipalType'] == tace['PrincipalType'] and out['RightName'] == tace['RightName'] and out['IsInherited'] == tace['IsInherited']: break else: aces_out.append(out) return aces_out def resolve_sid(sid, domainname, domainsid, sidcache): # Resolve SIDs for SID history purposes out = {} # Is it a well-known sid? if sid in WELLKNOWN_SIDS: out['ObjectIdentifier'] = u'%s-%s' % (domainname.upper(), sid) out['ObjectType'] = WELLKNOWN_SIDS[sid][1].capitalize() else: try: linkitem = sidcache.get(sid) except KeyError: # Look it up instead # Is this SID part of the current domain? If not, use GC #use_gc = not sid.startswith(domainsid) #ldapentry = self.resolver.resolve_sid(sid, use_gc) # Couldn't resolve... #if not ldapentry: # logger.debug('Could not resolve SID: %s', sid) # # Fake it # entry = { # 'type': 'Base', # 'objectid':sid # } #else: # entry = ADUtils.resolve_ad_entry(ldapentry) entry = { 'type': 'Base', 'objectid':sid } linkitem = { "ObjectIdentifier": entry['objectid'], "ObjectType": entry['type'].capitalize() } # Entries are cached regardless of validity - unresolvable sids # are not likely to be resolved the second time and this saves traffic sidcache.put(sid, linkitem) out['ObjectIdentifier'] = sid out['ObjectType'] = linkitem['ObjectType'] return out ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701469925.0 msldap-0.5.9/msldap/external/bloodhoundpy/utils.py0000664000175000017500000000210414532457345021714 0ustar00webdevwebdev def reverse_dn_components(dn:str): rdns = ','.join(reversed(dn.split(','))) return rdns.upper() def explode_dn(dn): parts = [] esc = False part = '' for char in dn: if esc: part += char esc = False elif char == '\\': esc = True part += char elif char == ',': if part: parts.append(part) part = '' else: part += char if part: parts.append(part) return parts def parse_gplink_string(linkstr): if not linkstr: return for links in linkstr.split('[LDAP://')[1:]: dn, options = links.rstrip('][').split(';') yield dn, int(options) #taken from bloodhound.py def is_filtered_container(containerdn): if "CN=DOMAINUPDATES,CN=SYSTEM,DC=" in containerdn.upper(): return True if "CN=POLICIES,CN=SYSTEM,DC=" in containerdn.upper() and (containerdn.upper().startswith('CN=USER') or containerdn.upper().startswith('CN=MACHINE')): return True return False def is_filtered_container_child(containerdn): if "CN=PROGRAM DATA,DC=" in containerdn.upper(): return True if "CN=SYSTEM,DC=" in containerdn.upper(): return True return False././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0114086 msldap-0.5.9/msldap/ldap_objects/0000775000175000017500000000000014535076203016277 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/__init__.py0000664000175000017500000000361414531630505020411 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from msldap.ldap_objects.adinfo import MSADInfo, MSADInfo_ATTRS from msldap.ldap_objects.aduser import MSADUser, MSADUser_ATTRS, MSADUser_TSV_ATTRS from msldap.ldap_objects.adcomp import MSADMachine, MSADMachine_ATTRS, MSADMachine_TSV_ATTRS from msldap.ldap_objects.adsec import MSADSecurityInfo, MSADTokenGroup from msldap.ldap_objects.common import MSLDAP_UAC from msldap.ldap_objects.adgroup import MSADGroup, MSADGroup_ATTRS from msldap.ldap_objects.adou import MSADOU, MSADOU_ATTRS from msldap.ldap_objects.adgpo import MSADGPO, MSADGPO_ATTRS from msldap.ldap_objects.adtrust import MSADDomainTrust, MSADDomainTrust_ATTRS from msldap.ldap_objects.adschemaentry import MSADSCHEMAENTRY_ATTRS, MSADSchemaEntry from msldap.ldap_objects.adca import MSADCA, MSADCA_ATTRS from msldap.ldap_objects.adenrollmentservice import MSADEnrollmentService_ATTRS, MSADEnrollmentService from msldap.ldap_objects.adcertificatetemplate import MSADCertificateTemplate, MSADCertificateTemplate_ATTRS from msldap.ldap_objects.adgmsa import MSADGMSAUser, MSADGMSAUser_ATTRS from msldap.ldap_objects.adcontainer import MSADContainer, MSADContainer_ATTRS __all__ = [ 'MSADUser', 'MSADUser_ATTRS', 'MSADUser_TSV_ATTRS', 'MSADInfo', 'MSADInfo_ATTRS', 'MSLDAP_UAC', 'MSADMachine', 'MSADMachine_ATTRS', 'MSADMachine_TSV_ATTRS', 'MSADSecurityInfo', 'MSADTokenGroup', 'MSADGroup', 'MSADOU', 'MSADGPO', 'MSADGPO_ATTRS', 'MSADDomainTrust', 'MSADDomainTrust_ATTRS', 'MSADGroup_ATTRS', 'MSADOU_ATTRS', 'MSADSCHEMAENTRY_ATTRS', 'MSADSchemaEntry', 'MSADCA', 'MSADCA_ATTRS', 'MSADEnrollmentService_ATTRS', 'MSADEnrollmentService', 'MSADCertificateTemplate', 'MSADCertificateTemplate_ATTRS', 'MSADGMSAUser', 'MSADGMSAUser_ATTRS', 'MSADContainer', 'MSADContainer_ATTRS', ]././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adca.py0000664000175000017500000000211514531630505017535 0ustar00webdevwebdev from asn1crypto.x509 import Certificate MSADCA_ATTRS = ['cACertificate', 'cn', 'sn', 'distinguishedName', 'whenChanged', 'whenCreated', 'name'] class MSADCA: def __init__(self): self.location = None self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.whenChanged = None self.whenCreated = None self.cACertificate = None self.name = None @staticmethod def from_ldap(entry, location): adi = MSADCA() adi.location = location adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.whenChanged = entry['attributes'].get('whenChanged') adi.whenCreated = entry['attributes'].get('whenCreated') adi.cACertificate = entry['attributes'].get('cACertificate') if adi.cACertificate is not None: adi.cACertificate = Certificate.load(adi.cACertificate) adi.name = entry['attributes'].get('name') return adi def __str__(self): t = '== MSADCA ==\r\n' for k in self.__dict__: t += '%s: %s\r\n' % (k, self.__dict__[k]) return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adcertificatetemplate.py0000664000175000017500000004274514531630505023205 0ustar00webdevwebdevimport enum from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR from winacl.dtyp.ace import ACEType, ACE_OBJECT_PRESENCE, ACCESS_MASK, ADS_ACCESS_MASK EX_RIGHT_CERTIFICATE_ENROLLMENT = "0e10c968-78fb-11d2-90d4-00c04f79dc55" EX_RIGHT_CERTIFICATE_AUTOENROLLMENT = "a05b8cc2-17bc-4802-a710-e7c15ab866a2" class CertificateNameFlag(enum.IntFlag): ENROLLEE_SUPPLIES_SUBJECT = 0x00000001 ENROLLEE_SUPPLIES_SUBJECT_ALT_NAME = 0x00010000 SUBJECT_ALT_REQUIRE_DOMAIN_DNS = 0x00400000 SUBJECT_ALT_REQUIRE_SPN = 0x00800000 SUBJECT_ALT_REQUIRE_DIRECTORY_GUID = 0x01000000 SUBJECT_ALT_REQUIRE_UPN = 0x02000000 SUBJECT_ALT_REQUIRE_EMAIL = 0x04000000 SUBJECT_ALT_REQUIRE_DNS = 0x08000000 SUBJECT_REQUIRE_DNS_AS_CN = 0x10000000 SUBJECT_REQUIRE_EMAIL = 0x20000000 SUBJECT_REQUIRE_COMMON_NAME = 0x40000000 SUBJECT_REQUIRE_DIRECTORY_PATH = 0x80000000 OLD_CERT_SUPPLIES_SUBJECT_AND_ALT_NAME = 0x00000008 class EnrollmentFlag(enum.IntFlag): INCLUDE_SYMMETRIC_ALGORITHMS = 0x00000001 PEND_ALL_REQUESTS = 0x00000002 PUBLISH_TO_KRA_CONTAINER = 0x00000004 PUBLISH_TO_DS = 0x00000008 AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE = 0x00000010 AUTO_ENROLLMENT = 0x00000020 PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT = 0x00000040 USER_INTERACTION_REQUIRED = 0x00000100 REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE = 0x00000400 ALLOW_ENROLL_ON_BEHALF_OF = 0x00000800 ADD_OCSP_NOCHECK = 0x00001000 ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL = 0x00002000 NOREVOCATIONINFOINISSUEDCERTS = 0x00004000 INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS = 0x00008000 ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT = 0x00010000 ISSUANCE_POLICIES_FROM_REQUEST = 0x00020000 SKIP_AUTO_RENEWAL = 0x00040000 class PrivateKeyFlag(enum.IntFlag): REQUIRE_PRIVATE_KEY_ARCHIVAL = 0x00000001 EXPORTABLE_KEY = 0x00000010 STRONG_KEY_PROTECTION_REQUIRED = 0x00000020 REQUIRE_ALTERNATE_SIGNATURE_ALGORITHM = 0x00000040 REQUIRE_SAME_KEY_RENEWAL = 0x00000080 USE_LEGACY_PROVIDER = 0x00000100 ATTEST_REQUIRED = 0x000002000 ATTEST_PREFERRED = 0x000001000 HELLO_LOGON_KEY = 0x00200000 EKU_CLIENT_AUTHENTICATION_OID = "1.3.6.1.5.5.7.3.2" EKU_PKINIT_CLIENT_AUTHENTICATION_OID = "1.3.6.1.5.2.3.4" EKU_SMART_CARD_LOGON_OID = "1.3.6.1.4.1.311.20.2.2" EKU_ANY_PURPOSE_OID = "2.5.29.37.0" EKU_CERTIFICATE_REQUEST_AGENT_OID = "1.3.6.1.4.1.311.20.2.1" EKUS_NAMES = { "1.3.6.1.4.1.311.2.6.1": "SpcRelaxedPEMarkerCheck", "1.3.6.1.4.1.311.2.6.2": "SpcEncryptedDigestRetryCount", "1.3.6.1.4.1.311.10.3.6": "Windows System Component Verification", "1.3.6.1.4.1.311.10.3.22": "Protected Process Light Verification", "1.3.6.1.4.1.311.10.3.27": "Preview Build Signing", "1.3.6.1.4.1.311.10.3.1": "Microsoft Trust List Signing", "1.3.6.1.4.1.311.10.3.2": "Microsoft Time Stamping", "1.3.6.1.4.1.311.10.3.7": "OEM Windows System Component Verification", "1.3.6.1.4.1.311.10.3.13": "Lifetime Signing", "1.3.6.1.4.1.311.10.3.11": "Key Recovery", "1.3.6.1.4.1.311.10.3.23": "Windows TCB Component", "1.3.6.1.4.1.311.10.3.25": "Windows Third Party Application Component", "1.3.6.1.4.1.311.10.3.26": "Windows Software Extension Verification", "1.3.6.1.4.1.311.10.3.8": "Embedded Windows System Component Verification", "1.3.6.1.4.1.311.10.3.20": "Windows Kits Component", "1.3.6.1.4.1.311.10.3.5": "Windows Hardware Driver Verification", "1.3.6.1.4.1.311.10.3.39": "Windows Hardware Driver Extended Verification", "1.3.6.1.4.1.311.10.3.5.1": "Windows Hardware Driver Attested Verification", "1.3.6.1.4.1.311.10.3.4.1": "File Recovery", "1.3.6.1.4.1.311.10.3.30": "Disallowed List", "1.3.6.1.4.1.311.10.3.19": "Revoked List Signer", "1.3.6.1.4.1.311.10.3.21": "Windows RT Verification", "1.3.6.1.4.1.311.10.3.10": "Qualified Subordination", "1.3.6.1.4.1.311.10.3.12": "Document Signing", "1.3.6.1.4.1.311.10.3.24": "Protected Process Verification", "1.3.6.1.4.1.311.10.3.4": "Encrypting File System", "1.3.6.1.4.1.311.10.3.9": "Root List Signer", "1.3.6.1.4.1.311.10.5.1": "Digital Rights", "1.3.6.1.4.1.311.10.6.2": "License Server Verification", "1.3.6.1.4.1.311.10.6.1": "Key Pack Licenses", EKU_SMART_CARD_LOGON_OID: "Smart Card Logon", EKU_CERTIFICATE_REQUEST_AGENT_OID: "Certificate Request Agent", "1.3.6.1.4.1.311.20.1": "CTL Usage", "1.3.6.1.4.1.311.21.6": "Key Recovery Agent", "1.3.6.1.4.1.311.21.19": "Directory Service Email Replication", "1.3.6.1.4.1.311.21.5": "Private Key Archival", "1.3.6.1.4.1.311.61.1.1": "Kernel Mode Code Signing", "1.3.6.1.4.1.311.61.4.1": "Early Launch Antimalware Driver", "1.3.6.1.4.1.311.61.5.1": "HAL Extension", "1.3.6.1.4.1.311.64.1.1": "Domain Name System (DNS) Server Trust", "1.3.6.1.4.1.311.76.6.1": "Windows Update", "1.3.6.1.4.1.311.76.3.1": "Windows Store", "1.3.6.1.4.1.311.76.5.1": "Dynamic Code Generator", "1.3.6.1.4.1.311.76.8.1": "Microsoft Publisher", "1.3.6.1.4.1.311.80.1": "Document Encryption", EKU_PKINIT_CLIENT_AUTHENTICATION_OID: "PKINIT Client Authentication", "1.3.6.1.5.2.3.5": "KDC Authentication", "1.3.6.1.5.5.7.3.7": "IP security user", EKU_CLIENT_AUTHENTICATION_OID: "Client Authentication", "1.3.6.1.5.5.7.3.9": "OCSP Signing", "1.3.6.1.5.5.7.3.3": "Code Signing", "1.3.6.1.5.5.7.3.4": "Secure Email", "1.3.6.1.5.5.7.3.5": "IP security end system", "1.3.6.1.5.5.7.3.6": "IP security tunnel termination", "1.3.6.1.5.5.8.2.2": "IP security IKE intermediate", "1.3.6.1.5.5.7.3.8": "Time Stamping", "1.3.6.1.5.5.7.3.1": "Server Authentication", EKU_ANY_PURPOSE_OID: "Any Purpose", "2.23.133.8.1": "Endorsement Key Certificate", "2.23.133.8.2": "Platform Certificate", "2.23.133.8.3": "Attestation Identity Key Certificate", } ENROLLMENT_FLAGS_NAMES = { EnrollmentFlag.INCLUDE_SYMMETRIC_ALGORITHMS: "INCLUDE_SYMMETRIC_ALGORITHMS", EnrollmentFlag.PEND_ALL_REQUESTS: "PEND_ALL_REQUESTS", EnrollmentFlag.PUBLISH_TO_KRA_CONTAINER: "PUBLISH_TO_KRA_CONTAINER", EnrollmentFlag.PUBLISH_TO_DS: "PUBLISH_TO_DS", EnrollmentFlag.AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE: "AUTO_ENROLLMENT_CHECK_USER_DS_CERTIFICATE", EnrollmentFlag.AUTO_ENROLLMENT: "AUTO_ENROLLMENT", EnrollmentFlag.PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT: "PREVIOUS_APPROVAL_VALIDATE_REENROLLMENT", EnrollmentFlag.USER_INTERACTION_REQUIRED: "USER_INTERACTION_REQUIRED", EnrollmentFlag.REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE: "REMOVE_INVALID_CERTIFICATE_FROM_PERSONAL_STORE", EnrollmentFlag.ALLOW_ENROLL_ON_BEHALF_OF: "ALLOW_ENROLL_ON_BEHALF_OF", EnrollmentFlag.ADD_OCSP_NOCHECK: "ADD_OCSP_NOCHECK", EnrollmentFlag.ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL: "ENABLE_KEY_REUSE_ON_NT_TOKEN_KEYSET_STORAGE_FULL", EnrollmentFlag.NOREVOCATIONINFOINISSUEDCERTS: "NOREVOCATIONINFOINISSUEDCERTS", EnrollmentFlag.INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS: "INCLUDE_BASIC_CONSTRAINTS_FOR_EE_CERTS", EnrollmentFlag.ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT: "ALLOW_PREVIOUS_APPROVAL_KEYBASEDRENEWAL_VALIDATE_REENROLLMENT", EnrollmentFlag.ISSUANCE_POLICIES_FROM_REQUEST: "ISSUANCE_POLICIES_FROM_REQUEST", EnrollmentFlag.SKIP_AUTO_RENEWAL: "SKIP_AUTO_RENEWAL", } MSADCertificateTemplate_ATTRS = [ 'cn', 'sn', 'distinguishedName', 'name', 'msPKI-RA-Application-Policies', 'msPKI-Certificate-Application-Policy', 'msPKI-Template-Schema-Version', 'msPKI-Certificate-Name-Flag', 'msPKI-Enrollment-Flag', 'msPKI-RA-Signature', 'msPKI-Private-Key-Flag', 'pKIExtendedKeyUsage', 'nTSecurityDescriptor' ] class MSADCertificateTemplate: def __init__(self): self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.name = None self.RA_Application_Policies = None self.Certificate_Application_Policy = None self.Template_Schema_Version = None self.Certificate_Name_Flag = None self.Enrollment_Flag = None self.RA_Signature = None self.Private_Key_Flag = None self.pKIExtendedKeyUsage = None self.nTSecurityDescriptor:SECURITY_DESCRIPTOR = None self.vulns = [] self.enroll_sids = set() self.autoenroll_sids = set() self.write_owner_sids = set() self.write_dacl_sids = set() self.write_property_sids = set() self.fullcontrol_sids = set() self.allextendedrights_sids = set() self.sid_lookup_table = None self.enroll_services = [] @staticmethod def from_ldap(entry): adi = MSADCertificateTemplate() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.name = entry['attributes'].get('name') adi.RA_Application_Policies = entry['attributes'].get('msPKI-RA-Application-Policies') adi.Certificate_Application_Policy = entry['attributes'].get('msPKI-Certificate-Application-Policy') adi.Template_Schema_Version = entry['attributes'].get('msPKI-Template-Schema-Version') adi.Certificate_Name_Flag = entry['attributes'].get('msPKI-Certificate-Name-Flag') adi.Enrollment_Flag = entry['attributes'].get('msPKI-Enrollment-Flag') adi.RA_Signature = entry['attributes'].get('msPKI-RA-Signature') adi.Private_Key_Flag = entry['attributes'].get('msPKI-Private-Key-Flag') adi.pKIExtendedKeyUsage = entry['attributes'].get('pKIExtendedKeyUsage', []) adi.nTSecurityDescriptor = entry['attributes'].get('nTSecurityDescriptor') if adi.nTSecurityDescriptor is not None: adi.nTSecurityDescriptor = SECURITY_DESCRIPTOR.from_bytes(adi.nTSecurityDescriptor) adi.calc_aces() return adi def allows_authentication(self): return self.can_be_used_for_any_purpose() or len(set([EKU_CLIENT_AUTHENTICATION_OID, EKU_SMART_CARD_LOGON_OID, EKU_PKINIT_CLIENT_AUTHENTICATION_OID]).intersection(set(self.pKIExtendedKeyUsage))) > 0 def can_be_used_for_any_purpose(self): return len(self.pKIExtendedKeyUsage) == 0 or EKU_ANY_PURPOSE_OID in self.pKIExtendedKeyUsage def requires_manager_approval(self): return EnrollmentFlag.PEND_ALL_REQUESTS in EnrollmentFlag(self.Enrollment_Flag) def requires_authorized_signatures(self): return self.RA_Signature != None and self.RA_Signature > 0 def allows_to_specify_san(self): return CertificateNameFlag(self.Certificate_Name_Flag) & CertificateNameFlag.ENROLLEE_SUPPLIES_SUBJECT > 0 def allows_to_request_agent_certificate(self): return EKU_CERTIFICATE_REQUEST_AGENT_OID in self.pKIExtendedKeyUsage def allows_to_use_agent_certificate(self): return self.Template_Schema_Version == 1 \ or ( self.Template_Schema_Version > 1 \ and self.RA_Signature == 1 \ and EKU_CERTIFICATE_REQUEST_AGENT_OID in self.RA_Application_Policies ) def is_vulnerable(self, tokengroups = None): def isLowPrivSid(sid): sid = str(sid) if sid in ['S-1-1-0', 'S-1-5-11']: return True if sid.startswith('S-1-5-21-') is True and sid.rsplit('-',1)[1] in ['513','515','545']: return True return False if tokengroups is None: if isLowPrivSid(str(self.nTSecurityDescriptor.Owner)) is True: return True, 'Owner is low priv user' else: if str(self.nTSecurityDescriptor.Owner) in tokengroups: return True, 'Owner can be controlled by current user' lowprivcanenroll = False if tokengroups is None: if any(isLowPrivSid(str(sid)) for sid in self.fullcontrol_sids) is True: return True, 'Lowpriv SID has full control' if any(isLowPrivSid(str(sid)) for sid in self.write_dacl_sids) is True: return True, 'Lowpriv SID can write DACLs' if any(isLowPrivSid(str(sid)) for sid in self.write_owner_sids) is True: return True, 'Lowpriv SID can change Owner' if any(isLowPrivSid(str(sid)) for sid in self.write_property_sids) is True: return True, 'Lowpriv SID can write property' if any(isLowPrivSid(str(sid)) for sid in self.enroll_sids) is True: lowprivcanenroll = True if any(isLowPrivSid(str(sid)) for sid in self.allextendedrights_sids) is True: lowprivcanenroll = True else: if len(self.enroll_sids.intersection(set(tokengroups))) > 0 or len(self.allextendedrights_sids.intersection(set(tokengroups))) > 0: lowprivcanenroll = True if len(self.write_dacl_sids.intersection(set(tokengroups))) > 0: return True, 'Current user can write DACLs' if len(self.write_owner_sids.intersection(set(tokengroups))) > 0: return True, 'Current user can change Owner' if len(self.write_property_sids.intersection(set(tokengroups))) > 0: return True, 'Current user can write property' if len(self.fullcontrol_sids.intersection(set(tokengroups))) > 0: return True, 'Current user has full control' if self.requires_manager_approval() is True: return False, 'Needs manager approval' if self.requires_authorized_signatures() is True: return False, 'Needs authorized signature' if self.allows_authentication() and lowprivcanenroll and self.allows_to_specify_san(): return True, 'Enrollee supplies subject' if lowprivcanenroll and self.allows_to_use_agent_certificate() and self.allows_to_request_agent_certificate(): return True, 'Certificate request agent' return False, 'No match found' def calc_aces(self): if self.nTSecurityDescriptor is None: return for ace in self.nTSecurityDescriptor.Dacl.aces: if ace.AceType != ACEType.ACCESS_ALLOWED_OBJECT_ACE_TYPE and ace.AceType != ACEType.ACCESS_ALLOWED_ACE_TYPE: continue if ace.AceType == ACEType.ACCESS_ALLOWED_OBJECT_ACE_TYPE: if str(ace.ObjectType) == EX_RIGHT_CERTIFICATE_ENROLLMENT: self.enroll_sids.add(str(ace.Sid)) elif str(ace.ObjectType) == EX_RIGHT_CERTIFICATE_AUTOENROLLMENT: self.autoenroll_sids.add(str(ace.Sid)) elif ADS_ACCESS_MASK.CONTROL_ACCESS in ADS_ACCESS_MASK(ace.Mask) and ace.ObjectType is None: self.allextendedrights_sids.add(str(ace.Sid)) continue if ADS_ACCESS_MASK.GENERIC_ALL in ADS_ACCESS_MASK(ace.Mask): self.fullcontrol_sids.add(str(ace.Sid)) if ADS_ACCESS_MASK.WRITE_DACL in ADS_ACCESS_MASK(ace.Mask): self.write_dacl_sids.add(str(ace.Sid)) if ADS_ACCESS_MASK.WRITE_OWNER in ADS_ACCESS_MASK(ace.Mask): self.write_owner_sids.add(str(ace.Sid)) if ADS_ACCESS_MASK.WRITE_PROP in ADS_ACCESS_MASK(ace.Mask): self.write_property_sids.add(str(ace.Sid)) if ADS_ACCESS_MASK.CONTROL_ACCESS in ADS_ACCESS_MASK(ace.Mask): self.allextendedrights_sids.add(str(ace.Sid)) @property def is_enabled(self): return len(self.enroll_services) > 0 def __str__(self): t = '== MSADCertificateTemplate ==\r\n' for k in self.__dict__: t += '%s: %s\r\n' % (k, self.__dict__[k]) return t def prettyprint(self): def print_sids(buffer, sidlist, offset = 6): for sid in sidlist: if self.sid_lookup_table is not None and sid in self.sid_lookup_table: buffer += '%s%s\\%s [%s]\r\n' % (offset*' ', self.sid_lookup_table[sid][0], self.sid_lookup_table[sid][1], sid) else: buffer += '%s%s\r\n' % (offset*' ', sid) return buffer t = '== MSADCertificateTemplate ==\r\n' t += "Name: %s\r\n" % self.name t += 'distinguishedName: %s\r\n' % self.distinguishedName t += "Schema Version: %s\r\n" % self.Template_Schema_Version if self.enroll_services: t += "Enroll Services: %s\r\n" % ", ".join(self.enroll_services) if len(self.vulns) > 0: t += "Vulnerabilities: %s\r\n" % ", ".join(self.vulns) if self.Certificate_Name_Flag is not None: x = str(CertificateNameFlag(self.Certificate_Name_Flag)).split('.',1) if len(x) >= 2: x = x[1].replace('|',', ') else: x = str(self.Certificate_Name_Flag).replace('|',', ') t += "msPKI-Certificate-Name-Flag: %s\r\n" % x if self.Enrollment_Flag is not None: x = str(EnrollmentFlag(self.Enrollment_Flag)).split('.',1) if len(x) >= 2: x = x[1].replace('|',', ') else: x = str(self.Enrollment_Flag).replace('|',', ') t += "msPKI-Enrollment-Flag: %s\r\n" % x if self.RA_Signature is not None: t += "msPKI-RA-Signature: %s\r\n" % self.RA_Signature if self.pKIExtendedKeyUsage is not None: t += "pKIExtendedKeyUsage: %s\r\n" % ", ".join([EKUS_NAMES.get(oid, oid) for oid in self.pKIExtendedKeyUsage]) if self.Certificate_Application_Policy is not None: t += "msPKI-Certificate-Application-Policy: %s\r\n" % ", ".join([EKUS_NAMES.get(oid, oid) for oid in self.Certificate_Application_Policy]) if self.RA_Application_Policies is not None: t += "msPKI-RA-Application-Policy: %s\r\n" % ", ".join([EKUS_NAMES.get(oid, oid) for oid in self.RA_Application_Policies]) t += "Permissions\r\n" t += " Enrollment Permissions\r\n" if len(self.enroll_sids) > 0: t += " Enrollment Rights\r\n" t = print_sids(t, self.enroll_sids) if len(self.autoenroll_sids) > 0: t += " AutoEnrollment Rights\r\n" t = print_sids(t, self.autoenroll_sids) if len(self.allextendedrights_sids) > 0: t += " All Extended Rights\r\n" t = print_sids(t, self.allextendedrights_sids) t+= " Object Control Permissions\r\n" t+= ' Owner\r\n' sid = str(self.nTSecurityDescriptor.Owner) if self.sid_lookup_table is not None and sid in self.sid_lookup_table: t += ' %s\\%s [%s]\r\n' % (self.sid_lookup_table[sid][0], self.sid_lookup_table[sid][1], sid) else: t += " %s\r\n" % sid if len(self.fullcontrol_sids) > 0: t+= " Full Control\r\n" t = print_sids(t, self.fullcontrol_sids) t += " Write Owner\r\n" t = print_sids(t, self.write_owner_sids) t += " Write DACL\r\n" t = print_sids(t, self.write_dacl_sids) t += " Write Property\r\n" t = print_sids(t, self.write_property_sids) t += " SDDL\r\n" t += self.nTSecurityDescriptor.to_sddl() t += '\r\n' return t def __str__(self): return self.prettyprint() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702131765.0 msldap-0.5.9/msldap/ldap_objects/adcomp.py0000664000175000017500000003161414535074065020125 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import datetime import base64 from msldap.ldap_objects.common import MSLDAP_UAC, vn from msldap.commons.utils import bh_dt_convert MSADMachine_ATTRS = [ 'accountExpires', 'badPasswordTime', 'badPwdCount', 'cn', 'description', 'codePage', 'countryCode', 'displayName', 'distinguishedName', 'dNSHostName', 'instanceType', 'isCriticalSystemObject','lastLogoff', 'lastLogon', 'lastLogonTimestamp', 'logonCount', 'localPolicyFlags', 'msDS-SupportedEncryptionTypes', 'name', 'objectCategory', 'objectClass', 'objectGUID', 'objectSid', 'operatingSystem', 'operatingSystemVersion','primaryGroupID', 'pwdLastSet', 'sAMAccountName', 'sAMAccountType', 'sn', 'userAccountControl', 'whenChanged', 'whenCreated', 'servicePrincipalName','msDS-AllowedToDelegateTo', 'msDS-AllowedToActOnBehalfOfOtherIdentity', 'operatingSystemServicePack', 'isDeleted', 'ms-Mcs-AdmPwdExpirationTime', 'sIDHistory' ] MSADMachine_TSV_ATTRS = [ 'sAMAccountName', 'dNSHostName', 'operatingSystem', 'operatingSystemVersion','operatingSystemServicePack', 'badPasswordTime', 'badPwdCount', 'pwdLastSet', 'lastLogonTimestamp', 'whenCreated', 'whenChanged', 'servicePrincipalName', 'objectSid', 'cn', 'description', 'UAC_SCRIPT', 'UAC_ACCOUNTDISABLE', 'UAC_LOCKOUT', 'UAC_PASSWD_NOTREQD', 'UAC_PASSWD_CANT_CHANGE', 'UAC_ENCRYPTED_TEXT_PASSWORD_ALLOWED', 'UAC_DONT_EXPIRE_PASSWD', 'UAC_USE_DES_KEY_ONLY', 'UAC_DONT_REQUIRE_PREAUTH', 'UAC_PASSWORD_EXPIRED' ] class MSADMachine: def __init__(self): self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.accountExpires = None self.badPasswordTime = None self.badPwdCount = None self.codePage = None self.countryCode = None self.displayName = None self.dNSHostName = None self.description = None self.instanceType = None self.isCriticalSystemObject = None self.lastLogoff = None self.lastLogon = None self.lastLogonTimestamp = None self.logonCount = None self.localPolicyFlags = None self.supported_enc_types = None self.name = None self.nTSecurityDescriptor = None self.objectCategory = None self.objectClass = None self.objectGUID = None self.objectSid = None self.operatingSystem = None self.operatingSystemVersion = None self.primaryGroupID = None self.pwdLastSet = None self.sAMAccountName = None self.sAMAccountType = None self.userAccountControl = None self.whenChanged = None self.whenCreated = None self.servicePrincipalName = None self.allowedtodelegateto = None self.allowedtoactonbehalfofotheridentity = None self.operatingSystemServicePack = None self.isDeleted = None self.ms_Mcs_AdmPwdExpirationTime = None self.sIDHistory = None ## calculated properties self.when_pw_change = None #datetime self.when_pw_expires = None #datetime self.must_change_pw = None #datetime self.canLogon = None #bool # https://msdn.microsoft.com/en-us/library/cc245739.aspx def calc_PasswordMustChange(self, adinfo): # Crtieria 1 flags = [MSLDAP_UAC.DONT_EXPIRE_PASSWD, MSLDAP_UAC.SMARTCARD_REQUIRED, MSLDAP_UAC.INTERDOMAIN_TRUST_ACCOUNT, MSLDAP_UAC.WORKSTATION_TRUST_ACCOUNT, MSLDAP_UAC.SERVER_TRUST_ACCOUNT] for flag in flags: if flag & self.userAccountControl: return datetime.datetime.max #never #criteria 2 if self.pwdLastSet == datetime.timedelta(): return datetime.datetime.min if adinfo.maxPwdAge == datetime.timedelta(): #empty timedelta return datetime.datetime.max #never if adinfo.maxPwdAge.days < -3650: #this is needed, because some ADs have mawPwdAge set for a huge number BUT not to the minimum return datetime.datetime.max #never return (self.pwdLastSet - adinfo.maxPwdAge).replace(tzinfo=None) # https://msdn.microsoft.com/en-us/library/cc223991.aspx def calc_CanLogon(self): flags = [MSLDAP_UAC.ACCOUNTDISABLE, MSLDAP_UAC.LOCKOUT, MSLDAP_UAC.SMARTCARD_REQUIRED, MSLDAP_UAC.INTERDOMAIN_TRUST_ACCOUNT, MSLDAP_UAC.WORKSTATION_TRUST_ACCOUNT, MSLDAP_UAC.SERVER_TRUST_ACCOUNT] for flag in flags: if flag & self.userAccountControl: return False if (not (MSLDAP_UAC.DONT_EXPIRE_PASSWD & self.userAccountControl)) and (self.accountExpires.replace(tzinfo=None) - datetime.datetime.now()).total_seconds() < 0: return False # # TODO: logonHours check! # if self.must_change_pw == datetime.datetime.min: #can logon, but must change the password! return True if (self.must_change_pw - datetime.datetime.now()).total_seconds() < 0: return False return True @staticmethod def from_ldap(entry, adinfo = None): adi = MSADMachine() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.accountExpires = entry['attributes'].get('accountExpires') adi.badPasswordTime = entry['attributes'].get('badPasswordTime') adi.badPwdCount = entry['attributes'].get('badPwdCount') adi.codePage = entry['attributes'].get('codePage') adi.countryCode = entry['attributes'].get('countryCode') adi.description = entry['attributes'].get('description') adi.displayName = entry['attributes'].get('displayName') adi.dNSHostName = entry['attributes'].get('dNSHostName') adi.instanceType = entry['attributes'].get('instanceType') adi.isCriticalSystemObject = entry['attributes'].get('isCriticalSystemObject') adi.lastLogoff = entry['attributes'].get('lastLogoff') adi.lastLogon = entry['attributes'].get('lastLogon') adi.lastLogonTimestamp = entry['attributes'].get('lastLogonTimestamp') adi.logonCount = entry['attributes'].get('logonCount') adi.localPolicyFlags = entry['attributes'].get('localPolicyFlags') adi.supported_enc_types = entry['attributes'].get('msDS-SupportedEncryptionTypes') adi.name = entry['attributes'].get('name') adi.objectCategory = entry['attributes'].get('objectCategory') adi.objectClass = entry['attributes'].get('objectClass') adi.objectGUID = entry['attributes'].get('objectGUID') adi.objectSid = entry['attributes'].get('objectSid') adi.operatingSystem = entry['attributes'].get('operatingSystem') adi.operatingSystemVersion = entry['attributes'].get('operatingSystemVersion') adi.primaryGroupID = entry['attributes'].get('primaryGroupID') adi.pwdLastSet = entry['attributes'].get('pwdLastSet') adi.sAMAccountName = entry['attributes'].get('sAMAccountName') adi.sAMAccountType = entry['attributes'].get('sAMAccountType') adi.whenChanged = entry['attributes'].get('whenChanged') adi.whenCreated = entry['attributes'].get('whenCreated') adi.servicePrincipalName = entry['attributes'].get('servicePrincipalName') adi.operatingSystemServicePack = entry['attributes'].get('operatingSystemServicePack') adi.isDeleted = entry['attributes'].get('isDeleted') adi.ms_Mcs_AdmPwdExpirationTime = entry['attributes'].get('ms-Mcs-AdmPwdExpirationTime') adi.sIDHistory = entry['attributes'].get('sIDHistory') adi.allowedtodelegateto = entry['attributes'].get('msDS-AllowedToDelegateTo') adi.allowedtoactonbehalfofotheridentity = entry['attributes'].get('msDS-AllowedToActOnBehalfOfOtherIdentity') temp = entry['attributes'].get('userAccountControl') if temp: adi.userAccountControl = MSLDAP_UAC(temp) if adinfo: adi.when_pw_change = (adi.pwdLastSet - adinfo.minPwdAge).replace(tzinfo=None) if adinfo.maxPwdAge.days < -3650: #this is needed, because some ADs have mawPwdAge set for a huge number BUT not to the minimum adi.when_pw_expires = datetime.datetime.max else: adi.when_pw_expires = (adi.pwdLastSet - adinfo.maxPwdAge).replace(tzinfo=None) if adinfo.maxPwdAge != 0 else adi.pwdLastSet adi.must_change_pw = adi.calc_PasswordMustChange(adinfo) #datetime adi.canLogon = adi.calc_CanLogon() #bool return adi def to_dict(self): t = {} t['sn'] = vn(self.sn) t['cn'] = vn(self.cn) t['distinguishedName'] = vn(self.distinguishedName) t['accountExpires'] = vn(self.accountExpires) t['badPasswordTime'] = vn(self.badPasswordTime) t['badPwdCount'] = vn(self.badPwdCount) t['codePage'] = vn(self.codePage) t['countryCode'] = vn(self.countryCode) t['description'] = vn(self.description) t['displayName'] = vn(self.displayName) t['dNSHostName'] = vn(self.dNSHostName) t['instanceType'] = vn(self.instanceType) t['isCriticalSystemObject'] = vn(self.isCriticalSystemObject) t['lastLogoff'] = vn(self.lastLogoff) t['lastLogon'] = vn(self.lastLogon) t['lastLogonTimestamp'] = vn(self.lastLogonTimestamp) t['logonCount'] = vn(self.logonCount) t['localPolicyFlags'] = vn(self.localPolicyFlags) t['supported_enc_types'] = vn(self.supported_enc_types) t['name'] = vn(self.name) t['objectCategory'] = vn(self.objectCategory) t['objectClass'] = vn(self.objectClass) t['objectGUID'] = vn(self.objectGUID) t['objectSid'] = vn(self.objectSid) t['operatingSystem'] = vn(self.operatingSystem) t['operatingSystemVersion'] = vn(self.operatingSystemVersion) t['primaryGroupID'] = vn(self.primaryGroupID) t['pwdLastSet'] = vn(self.pwdLastSet) t['sAMAccountName'] = vn(self.sAMAccountName) t['sAMAccountType'] = vn(self.sAMAccountType) t['whenChanged'] = vn(self.whenChanged) t['whenCreated'] = vn(self.whenCreated) t['servicePrincipalName'] = vn(self.servicePrincipalName) t['userAccountControl'] = vn(self.userAccountControl) t['operatingSystemServicePack'] = vn(self.operatingSystemServicePack) return t def uac_to_textflag(self, attr_s): if self.userAccountControl is None or self.userAccountControl == '': return 'N/A' attr = getattr(MSLDAP_UAC, attr_s[4:]) if self.userAccountControl & attr: return True return False def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) if x[:4]!='UAC_' else str(self.uac_to_textflag(x)) for x in attrs] def __str__(self): t = '' for k in self.__dict__: t += '%s : %s\r\n' % (k, self.__dict__[k]) return t def to_bh(self, domain): uac = self.userAccountControl if uac is None: uac = MSLDAP_UAC(0) op = self.operatingSystem if self.operatingSystem is not None: if self.operatingSystemServicePack is not None: op = self.operatingSystem + ' ' + self.operatingSystemServicePack sidhistory = [] if self.sIDHistory is not None: for sid in self.sIDHistory: sidhistory.append(str(sid)) actonbehalf = self.allowedtoactonbehalfofotheridentity if actonbehalf is not None: actonbehalf = base64.b64encode(actonbehalf).decode() alloweddeleg = self.allowedtodelegateto if alloweddeleg is None: alloweddeleg = [] return { '_allowedtoactonbehalfofotheridentity' : actonbehalf, '_dns' : self.dNSHostName, 'Aces' : [], #Post processing 'AllowedToDelegate' : [], #Post processing 'AllowedToAct' : [], #Post processing 'ObjectIdentifier' : self.objectSid, 'PrimaryGroupSID' : str(self.objectSid).rsplit('-',1)[0] + '-' + str(self.primaryGroupID), "SPNTargets": [], #this seems to be always empty "HasSIDHistory": [], #this seems to be always empty "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing "Status": None, # no idea what this is "DumpSMSAPassword" : [], 'Properties' : { 'name' : '%s@%s' % (self.sAMAccountName.upper(), domain.upper()), 'domain' : domain, 'domainsid' : str(self.objectSid).rsplit('-',1)[0] , 'distinguishedname' : str(self.distinguishedName).upper(), 'unconstraineddelegation' : self.uac_to_textflag('UAC_TRUSTED_FOR_DELEGATION'), 'enabled' : MSLDAP_UAC.ACCOUNTDISABLE not in uac, 'trustedtoauth' : MSLDAP_UAC.TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION in uac, 'samaccountname' : self.sAMAccountName , 'haslaps' : self.ms_Mcs_AdmPwdExpirationTime is not None, 'lastlogon' : bh_dt_convert(self.lastLogon), 'lastlogontimestamp' : bh_dt_convert(self.lastLogonTimestamp), 'whencreated' : bh_dt_convert(self.whenCreated), 'serviceprincipalnames' : self.servicePrincipalName, 'description' : self.description , 'operatingsystem' : op, 'sidhistory' : sidhistory, 'allowedtodelegate' : alloweddeleg, }, 'LocalAdmins': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'PSRemoteUsers': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'RemoteDesktopUsers': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'DcomUsers': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'Sessions': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'PrivilegedSessions': { 'Collected': False, 'FailureReason': None, 'Results': [], }, 'RegistrySessions': { 'Collected': False, 'FailureReason': None, 'Results': [], }, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701467817.0 msldap-0.5.9/msldap/ldap_objects/adcontainer.py0000664000175000017500000000520514532453251021141 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import base64 from msldap.commons.utils import bh_dt_convert MSADContainer_ATTRS = [ 'distinguishedName', 'name', 'objectGUID', 'isCriticalSystemObject','objectClass', 'objectCategory', 'isDeleted', 'description', 'whenCreated' ] class MSADContainer: def __init__(self): self.distinguishedName = None #datetime self.isCriticalSystemObject = None #int self.name = None #int self.objectCategory = None #int self.objectClass = None #str self.objectGUID = None #int self.isDeleted = None #str self.description = None self.whenCreated = None #datetime @staticmethod def from_ldap(entry): adi = MSADContainer() adi.distinguishedName = entry['attributes'].get('distinguishedName') #datetime adi.isCriticalSystemObject = entry['attributes'].get('isCriticalSystemObject') #int adi.name = entry['attributes'].get('name') #str adi.objectCategory = entry['attributes'].get('objectCategory') #str adi.objectClass = entry['attributes'].get('objectClass') #str adi.objectGUID = entry['attributes'].get('objectGUID') #str adi.isDeleted = entry['attributes'].get('isDeleted') adi.description = entry['attributes'].get('description') adi.whenCreated = entry['attributes'].get('whenCreated') return adi def to_dict(self): d = {} d['distinguishedName'] = self.distinguishedName d['isCriticalSystemObject'] = self.isCriticalSystemObject d['name'] = self.name d['objectCategory'] = self.objectCategory d['objectClass'] = self.objectClass d['objectGUID'] = self.objectGUID d['isDeleted'] = self.isDeleted d['description'] = self.description d['whenCreated'] = self.whenCreated return d def get_row(self, attrs): t = self.to_dict() if 'nTSecurityDescriptor' in attrs: if t['nTSecurityDescriptor'] is not None: t['nTSecurityDescriptor'] = base64.b64encode(t['nTSecurityDescriptor']).decode() else: t['nTSecurityDescriptor'] = b'' return [str(t.get(x)) for x in attrs] def __str__(self): t = 'MSADContainer\r\n' d = self.to_dict() for k in d: t += '%s: %s\r\n' % (k, d[k]) return t def to_bh(self, domain, domainsid): return { 'Aces' : [], 'ObjectIdentifier' : self.objectGUID.upper(), "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing "ChildObjects" : [], #Post processing 'Properties' : { 'name' : self.name, 'domain' : domain, 'domainsid' : domainsid, 'distinguishedname' : str(self.distinguishedName).upper(), 'highvalue' : False, # TODO but seems always false 'whencreated' : bh_dt_convert(self.whenCreated), 'description' : self.description , }, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adenrollmentservice.py0000664000175000017500000000351614531630505022720 0ustar00webdevwebdev from msldap.commons.utils import print_cert from asn1crypto.x509 import Certificate MSADEnrollmentService_ATTRS = ['cACertificate', 'msPKI-Enrollment-Servers', 'dNSHostName', 'cn', 'sn', 'distinguishedName', 'whenChanged', 'whenCreated', 'name', 'displayName', 'cACertificateDN', 'certificateTemplates'] class MSADEnrollmentService: def __init__(self): self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.name = None self.displayName = None self.cACertificate = None self.cACertificateDN = None self.dNSHostName = None self.certificateTemplates = [] self.enrollmentServers = [] @staticmethod def from_ldap(entry): adi = MSADEnrollmentService() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.cACertificate = entry['attributes'].get('cACertificate') if adi.cACertificate is not None: adi.cACertificate = Certificate.load(adi.cACertificate) adi.name = entry['attributes'].get('name') adi.displayName = entry['attributes'].get('displayName') adi.dNSHostName = entry['attributes'].get('dNSHostName') adi.cACertificateDN = entry['attributes'].get('cACertificateDN') adi.certificateTemplates = entry['attributes'].get('certificateTemplates') for serverdef in entry['attributes'].get('msPKI-Enrollment-Servers', []): adi.enrollmentServers.append(serverdef.split('\n')[3]) return adi def __str__(self): t = '== MSADEnrollmentService ==\r\n' t += "Name: %s\r\n" % self.name t += "DNS name: %s\r\n" % self.dNSHostName t += "Templates: %s\r\n" % ', '.join(self.certificateTemplates) if len(self.enrollmentServers) > 0: t += "Web services: %s\r\n" % ", ".join(self.enrollmentServers) t += "Certificate: \r\n%s\r\n" % print_cert(self.cACertificate.native, 2) return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adgmsa.py0000664000175000017500000001642014531630505020105 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import datetime #, timedelta, timezone from msldap.ldap_objects.common import MSLDAP_UAC, vn MSADGMSAUser_ATTRS = [ 'accountExpires', 'badPasswordTime', 'badPwdCount', 'cn', 'codePage', 'distinguishedName', 'lastLogoff', 'lastLogon', 'lastLogonTimestamp', 'logonCount', 'name', 'objectCategory', 'objectClass', 'objectGUID', 'objectSid', 'primaryGroupID', 'pwdLastSet', 'sAMAccountName', 'sAMAccountType', 'sn', 'userAccountControl', 'whenChanged', 'whenCreated', 'dNSHostName', 'msDS-SupportedEncryptionTypes', 'msDS-ManagedPasswordId', 'msDS-ManagedPasswordInterval', 'msDS-GroupMSAMembership', 'msDS-ManagedPassword' ] MSADGMSAUser_TSV_ATTRS = [ 'sAMAccountName', 'badPasswordTime', 'badPwdCount', 'pwdLastSet', 'lastLogonTimestamp', 'whenCreated', 'whenChanged', 'objectSid', 'cn', 'UAC_SCRIPT', 'UAC_ACCOUNTDISABLE', 'UAC_LOCKOUT', 'UAC_PASSWD_NOTREQD', 'UAC_PASSWD_CANT_CHANGE', 'UAC_ENCRYPTED_TEXT_PASSWORD_ALLOWED', 'UAC_DONT_EXPIRE_PASSWD', 'UAC_USE_DES_KEY_ONLY', 'UAC_DONT_REQUIRE_PREAUTH', 'UAC_PASSWORD_EXPIRED' ] class MSADGMSAUser: def __init__(self): ## ID self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.displayName = None #str self.name = None #str self.objectCategory = None #dn self.objectClass = None #str self.objectGUID = None #uid self.objectSid = None #str self.primaryGroupID = None #uid self.sAMAccountName = None #str self.dNSHostName = None #str self.msDS_SupportedEncryptionTypes = None #int self.msDS_ManagedPasswordId = None #bytes self.msDS_ManagedPasswordInterval = None #str self.msDS_GroupMSAMembership = None #SD self.msDS_ManagedPassword = None #str ## times self.accountExpires = None #datetime self.badPasswordTime = None #datetime self.lastLogoff = None #datetime self.lastLogon = None #datetime self.lastLogonTimestamp = None #datetime self.pwdLastSet = None #datetime self.whenChanged = None #datetime self.whenCreated = None #datetime ## security self.badPwdCount = None #int self.logonCount = None #int self.sAMAccountType = None #int self.userAccountControl = None #UserAccountControl intflag ## calculated properties self.when_pw_change = None #datetime self.when_pw_expires = None #datetime self.must_change_pw = None #datetime @staticmethod def from_ldap(entry, adinfo = None): adi = MSADGMSAUser() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.name = entry['attributes'].get('name') adi.objectCategory = entry['attributes'].get('objectCategory') adi.objectClass = entry['attributes'].get('objectClass') adi.objectGUID = entry['attributes'].get('objectGUID') adi.objectSid = entry['attributes'].get('objectSid') adi.primaryGroupID = entry['attributes'].get('primaryGroupID') adi.sAMAccountName = entry['attributes'].get('sAMAccountName') adi.accountExpires = entry['attributes'].get('accountExpires') adi.badPasswordTime = entry['attributes'].get('badPasswordTime') adi.lastLogoff = entry['attributes'].get('lastLogoff') adi.lastLogon = entry['attributes'].get('lastLogon') adi.lastLogonTimestamp = entry['attributes'].get('lastLogonTimestamp') adi.pwdLastSet = entry['attributes'].get('pwdLastSet') adi.whenChanged = entry['attributes'].get('whenChanged') adi.whenCreated = entry['attributes'].get('whenCreated') adi.badPwdCount = entry['attributes'].get('badPwdCount') adi.logonCount = entry['attributes'].get('logonCount') adi.sAMAccountType = entry['attributes'].get('sAMAccountType') adi.dNSHostName = entry['attributes'].get('dNSHostName') adi.msDS_SupportedEncryptionTypes = entry['attributes'].get('msDS-SupportedEncryptionTypes') adi.msDS_ManagedPasswordId = entry['attributes'].get('msDS-ManagedPasswordId') adi.msDS_ManagedPasswordInterval = entry['attributes'].get('msDS-ManagedPasswordInterval') adi.msDS_GroupMSAMembership = entry['attributes'].get('msDS-GroupMSAMembership') adi.msDS_ManagedPassword = entry['attributes'].get('msDS-ManagedPassword') temp = entry['attributes'].get('userAccountControl') if temp: adi.userAccountControl = MSLDAP_UAC(temp) return adi def to_dict(self): t = {} t['sn'] = vn(self.sn) t['cn'] = vn(self.cn) t['distinguishedName'] = vn(self.distinguishedName) t['name'] = vn(self.name) t['objectCategory'] = vn(self.objectCategory) t['objectClass'] = vn(self.objectClass) t['objectGUID'] = vn(self.objectGUID) t['objectSid'] = vn(self.objectSid) t['primaryGroupID'] = vn(self.primaryGroupID) t['sAMAccountName'] = vn(self.sAMAccountName) t['accountExpires'] = vn(self.accountExpires) t['badPasswordTime'] = vn(self.badPasswordTime) t['lastLogoff'] = vn(self.lastLogoff) t['lastLogon'] = vn(self.lastLogon) t['lastLogonTimestamp'] = vn(self.lastLogonTimestamp) t['pwdLastSet'] = vn(self.pwdLastSet) t['whenChanged'] = vn(self.whenChanged) t['whenCreated'] = vn(self.whenCreated) t['badPwdCount'] = vn(self.badPwdCount) t['logonCount'] = vn(self.logonCount) t['sAMAccountType'] = vn(self.sAMAccountType) t['userAccountControl'] = vn(self.userAccountControl) t['dNSHostName'] = vn(self.dNSHostName) t['msDS_SupportedEncryptionTypes'] = vn(self.msDS_SupportedEncryptionTypes) t['msDS_ManagedPasswordInterval'] = vn(self.msDS_ManagedPasswordInterval) t['msDS_GroupMSAMembership'] = vn(self.msDS_GroupMSAMembership) t['msDS_ManagedPassword'] = vn(self.msDS_ManagedPassword) t['msDS_ManagedPasswordId'] = vn(self.msDS_ManagedPasswordId) return t def uac_to_textflag(self, attr_s): if self.userAccountControl is None or self.userAccountControl == '': return 'N/A' attr = getattr(MSLDAP_UAC, attr_s[4:]) if self.userAccountControl & attr: return True return False def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) if x[:4]!='UAC_' else str(self.uac_to_textflag(x)) for x in attrs] def __str__(self): t = 'MSADGMSAUser\n' t += 'sn: %s\n' % self.sn t += 'cn: %s\n' % self.cn t += 'distinguishedName: %s\n' % self.distinguishedName t += 'name: %s\n' % self.name t += 'primaryGroupID: %s\n' % self.primaryGroupID t += 'sAMAccountName: %s\n' % self.sAMAccountName t += 'accountExpires: %s\n' % self.accountExpires t += 'badPasswordTime: %s\n' % self.badPasswordTime t += 'lastLogoff: %s\n' % self.lastLogoff t += 'lastLogon: %s\n' % self.lastLogon t += 'lastLogonTimestamp: %s\n' % self.lastLogonTimestamp t += 'pwdLastSet: %s\n' % self.pwdLastSet t += 'whenChanged: %s\n' % self.whenChanged t += 'whenCreated: %s\n' % self.whenCreated t += 'objectGUID: %s\n' % self.objectGUID t += 'objectSid: %s\n' % self.objectSid t += 'badPwdCount: %s\n' % self.badPwdCount t += 'logonCount: %s\n' % self.logonCount t += 'sAMAccountType: %s\n' % self.sAMAccountType t += 'userAccountControl: %s\n' % self.userAccountControl t += 'dNSHostName %s\n' % self.dNSHostName t += 'msDS-SupportedEncryptionTypes: %s\n' % self.msDS_SupportedEncryptionTypes t += 'msDS-ManagedPasswordId: %s\n' % self.msDS_ManagedPasswordId t += 'msDS-ManagedPasswordInterval: %s\n' % self.msDS_ManagedPasswordInterval t += 'msDS-GroupMSAMembership: %s\n' % self.msDS_GroupMSAMembership t += 'msDS-ManagedPassword: %s\n' % self.msDS_ManagedPassword return t ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adgpo.py0000664000175000017500000000733114531630505017744 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from msldap.ldap_objects.common import MSLDAP_UAC, vn from msldap.commons.utils import bh_dt_convert MSADGPO_ATTRS = [ 'cn', 'displayName', 'distinguishedName', 'flags', 'gPCFileSysPath', 'gPCFunctionalityVersion', 'gPCMachineExtensionNames', 'gPCUserExtensionNames', 'objectClass', 'objectGUID', 'systemFlags', 'versionNumber', 'whenChanged', 'whenCreated', 'isDeleted', 'description' ] class MSADGPO: def __init__(self): self.cn = None self.displayName = None self.distinguishedName = None self.flags = None self.gPCFileSysPath = None #str self.gPCFunctionalityVersion = None #str self.gPCMachineExtensionNames = None self.gPCUserExtensionNames = None self.objectClass = None #str self.objectGUID = None #uid self.systemFlags = None #str self.whenChanged = None #uid self.whenCreated = None #str self.versionNumber = None self.isDeleted = None self.description = None @staticmethod def from_ldap(entry, adinfo = None): adi = MSADGPO() adi.cn = entry['attributes'].get('cn') adi.displayName = entry['attributes'].get('displayName') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.flags = entry['attributes'].get('flags') adi.gPCFileSysPath = entry['attributes'].get('gPCFileSysPath') adi.gPCFunctionalityVersion = entry['attributes'].get('gPCFunctionalityVersion') adi.gPCMachineExtensionNames = entry['attributes'].get('gPCMachineExtensionNames') adi.gPCUserExtensionNames = entry['attributes'].get('gPCUserExtensionNames') adi.objectClass = entry['attributes'].get('objectClass') adi.objectGUID = entry['attributes'].get('objectGUID') adi.systemFlags = entry['attributes'].get('systemFlags') adi.whenChanged = entry['attributes'].get('whenChanged') adi.whenCreated = entry['attributes'].get('whenCreated') adi.versionNumber = entry['attributes'].get('versionNumber') adi.isDeleted = entry['attributes'].get('isDeleted') adi.description = entry['attributes'].get('description') return adi def to_dict(self): t = {} t['cn'] = vn(self.cn) t['displayName'] = vn(self.displayName) t['distinguishedName'] = vn(self.distinguishedName) t['flags'] = vn(self.flags) t['gPCFileSysPath'] = vn(self.gPCFileSysPath) t['gPCFunctionalityVersion'] = vn(self.gPCFunctionalityVersion) t['gPCMachineExtensionNames'] = vn(self.gPCMachineExtensionNames) t['gPCUserExtensionNames'] = vn(self.gPCUserExtensionNames) t['systemFlags'] = vn(self.systemFlags) t['objectClass'] = vn(self.objectClass) t['objectGUID'] = vn(self.objectGUID) t['whenChanged'] = vn(self.whenChanged) t['whenCreated'] = vn(self.whenCreated) t['versionNumber'] = vn(self.versionNumber) t['isDeleted'] = vn(self.isDeleted) t['description'] = vn(self.description) return t def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) if x[:4]!='UAC_' else str(self.uac_to_textflag(x)) for x in attrs] def __str__(self): t = 'MSADUser\n' t += 'cn: %s\n' % self.cn t += 'distinguishedName: %s\n' % self.distinguishedName t += 'path: %s\n' % self.gPCFileSysPath t += 'displayName: %s\n' % self.displayName return t def to_bh(self, domain, domainsid): return { 'Aces' : [], 'ObjectIdentifier' : self.objectGUID.upper(), "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing 'Properties' : { 'name' : '%s@%s' % (self.displayName.upper(), domain.upper()), 'domain' : domain, 'domainsid' : domainsid, 'distinguishedname' : str(self.distinguishedName).upper(), 'highvalue' : False, # TODO seems always false 'whencreated' : bh_dt_convert(self.whenCreated), 'description' : self.description, 'gpcpath' : self.gPCFileSysPath.upper(), }, } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702131765.0 msldap-0.5.9/msldap/ldap_objects/adgroup.py0000664000175000017500000001017314535074065020320 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from msldap.wintypes import * from msldap.ldap_objects.common import MSLDAP_UAC, vn from winacl.dtyp.sid import SID from msldap.commons.utils import bh_dt_convert MSADGroup_ATTRS = [ 'cn', 'distinguishedName', 'objectGUID', 'objectSid', 'groupType', 'instanceType', 'name', 'member', 'sAMAccountName', 'systemFlags', 'whenChanged', 'whenCreated', 'description', 'nTSecurityDescriptor', 'sAMAccountType', 'adminCount', 'isDeleted' ] MSADGroup_highvalue = ["S-1-5-32-544", "S-1-5-32-550", "S-1-5-32-549", "S-1-5-32-551", "S-1-5-32-548"] class MSADGroup: def __init__(self): self.cn = None #str self.distinguishedName = None #dn self.objectGUID = None self.objectSid = None self.description = None self.groupType = None self.instanceType = None self.name = None self.member = None self.nTSecurityDescriptor = None self.sAMAccountName = None self.sAMAccountType = None self.systemFlags = None self.whenChanged = None self.whenCreated = None self.adminCount = None self.isDeleted = None def to_dict(self): d = {} d['cn'] = self.cn d['distinguishedName'] = self.distinguishedName d['objectGUID'] = self.objectGUID d['objectSid'] = self.objectSid d['description'] = self.description d['groupType'] = self.groupType d['instanceType'] = self.instanceType d['name'] = self.name d['member'] = self.member d['nTSecurityDescriptor'] = self.nTSecurityDescriptor d['sAMAccountName'] = self.sAMAccountName d['sAMAccountType'] = self.sAMAccountType d['systemFlags'] = self.systemFlags d['whenChanged'] = self.whenChanged d['whenCreated'] = self.whenCreated d['adminCount'] = self.adminCount d['isDeleted'] = self.isDeleted return d @staticmethod def from_ldap(entry): t = MSADGroup() t.cn = entry['attributes'].get('cn') t.distinguishedName = entry['attributes'].get('distinguishedName') t.objectGUID = entry['attributes'].get('objectGUID') t.objectSid = entry['attributes'].get('objectSid') t.groupType = entry['attributes'].get('groupType') t.instanceType = entry['attributes'].get('instanceType') t.name = entry['attributes'].get('name') t.member = entry['attributes'].get('member') t.sAMAccountName = entry['attributes'].get('sAMAccountName') t.systemFlags = entry['attributes'].get('systemFlags') t.whenChanged = entry['attributes'].get('whenChanged') t.whenCreated = entry['attributes'].get('whenCreated') t.adminCount = entry['attributes'].get('adminCount') t.isDeleted = entry['attributes'].get('isDeleted') t.description = entry['attributes'].get('description') if isinstance(t.description, list): if len(t.description) == 1: t.description = t.description[0] else: t.description = ', '.join(t.description) #temp = entry['attributes'].get('nTSecurityDescriptor') #if temp: # t.nTSecurityDescriptor = SID.from_bytes(temp) return t def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) if x[:4]!='UAC_' else str(self.uac_to_textflag(x)) for x in attrs] def __str__(self): t = 'MSADGroup\r\n' for x in self.__dict__: if not isinstance(self.__dict__[x], (list, dict)): t += '%s: %s\r\n' % (x, str(self.__dict__[x])) else: t += '%s: %s\r\n' % (x, self.__dict__[x]) return t def to_bh(self, domain): # Thx Dirk-jan def is_highvalue(sid:str): if sid.endswith("-512") or sid.endswith("-516") or sid.endswith("-519") or sid.endswith("-520"): return True if sid in MSADGroup_highvalue: return True return False return { 'Aces' : [], 'Members': [], 'ObjectIdentifier' : self.objectSid, "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing 'Properties' : { 'name' : '%s@%s' % (self.name.upper(), domain.upper()), 'domain' : domain, 'domainsid' : str(self.objectSid).rsplit('-',1)[0] , 'distinguishedname' : str(self.distinguishedName).upper(), 'highvalue' : is_highvalue(str(self.objectSid)), 'admincount' : bool(self.adminCount), 'description' : self.description , 'samaccountname' : self.sAMAccountName , 'whencreated' : bh_dt_convert(self.whenCreated), }, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adinfo.py0000664000175000017500000001772014531630505020115 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from msldap.commons.utils import bh_dt_convert from msldap.commons.utils import FUNCTIONAL_LEVELS MSADInfo_ATTRS = [ 'auditingPolicy', 'creationTime', 'dc', 'distinguishedName', 'forceLogoff', 'instanceType', 'lockoutDuration', 'lockOutObservationWindow', 'lockoutThreshold', 'masteredBy', 'maxPwdAge', 'minPwdAge', 'minPwdLength', 'name', 'nextRid', 'nTSecurityDescriptor', 'objectCategory', 'objectClass', 'objectGUID', 'objectSid', 'pwdHistoryLength', 'pwdProperties', 'serverState', 'systemFlags', 'uASCompat', 'uSNChanged', 'uSNCreated', 'whenChanged', 'whenCreated', 'rIDManagerReference', 'msDS-Behavior-Version', 'description', 'isDeleted', 'gPLink' ] class MSADInfo: def __init__(self): self.auditingPolicy = None #dunno self.creationTime = None #datetime self.dc = None #str self.distinguishedName = None #string self.forceLogoff = None #int self.instanceType = None #int self.lockoutDuration = None #int self.lockOutObservationWindow = None #int self.lockoutThreshold = None #int self.masteredBy = None #str self.maxPwdAge = None #int self.minPwdAge = None #int self.minPwdLength = None #int self.name = None #str self.nextRid = None #int self.nTSecurityDescriptor = None #str self.objectCategory = None #str self.objectClass = None #str self.objectGUID = None #str self.objectSid = None #str self.pwdHistoryLength = None #int self.pwdProperties = None #int self.serverState = None #int self.systemFlags = None #int self.uASCompat = None #int self.uSNChanged = None #int self.uSNCreated = None #int self.whenChanged = None #datetime self.whenCreated = None #datetime self.rIDManagerReference = None #str self.domainmodelevel = None self.description = None self.isDeleted = None self.gPLink = None @staticmethod def from_ldap(entry): adi = MSADInfo() adi.auditingPolicy = entry['attributes'].get('auditingPolicy') #dunno adi.creationTime = entry['attributes'].get('creationTime') #datetime adi.dc = entry['attributes'].get('dc') #str adi.distinguishedName = entry['attributes'].get('distinguishedName') #string adi.forceLogoff = entry['attributes'].get('forceLogoff') #int adi.instanceType = entry['attributes'].get('instanceType') #int adi.lockoutDuration = entry['attributes'].get('lockoutDuration') #int adi.lockOutObservationWindow = entry['attributes'].get('lockOutObservationWindow') #int adi.lockoutThreshold = entry['attributes'].get('lockoutThreshold') #int adi.masteredBy = entry['attributes'].get('masteredBy') #str adi.maxPwdAge = entry['attributes'].get('maxPwdAge') #int adi.minPwdAge = entry['attributes'].get('minPwdAge') #int adi.minPwdLength = entry['attributes'].get('minPwdLength') #int adi.name = entry['attributes'].get('name') #str adi.nextRid = entry['attributes'].get('nextRid') #int adi.nTSecurityDescriptor = entry['attributes'].get('nTSecurityDescriptor') #str adi.objectCategory = entry['attributes'].get('objectCategory') #str adi.objectClass = entry['attributes'].get('objectClass') #str adi.objectGUID = entry['attributes'].get('objectGUID') #str adi.objectSid = entry['attributes'].get('objectSid') #str adi.pwdHistoryLength = entry['attributes'].get('pwdHistoryLength') #int adi.pwdProperties = entry['attributes'].get('pwdProperties') #int adi.serverState = entry['attributes'].get('serverState') #int adi.systemFlags = entry['attributes'].get('systemFlags') #int adi.uASCompat = entry['attributes'].get('uASCompat') #int adi.uSNChanged = entry['attributes'].get('uSNChanged') #int adi.uSNCreated = entry['attributes'].get('uSNCreated') #int adi.whenChanged = entry['attributes'].get('whenChanged') #datetime adi.whenCreated = entry['attributes'].get('whenCreated') #datetime adi.rIDManagerReference = entry['attributes'].get('rIDManagerReference') adi.description = entry['attributes'].get('description') adi.isDeleted = entry['attributes'].get('isDeleted') adi.gPLink = entry['attributes'].get('gPLink') #https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/564dc969-6db3-49b3-891a-f2f8d0a68a7f adi.domainmodelevel = entry['attributes'].get('msDS-Behavior-Version') return adi def to_dict(self): d = {} d['auditingPolicy'] = self.auditingPolicy d['creationTime'] = self.creationTime d['dc'] = self.dc d['distinguishedName'] = self.distinguishedName d['forceLogoff'] = self.forceLogoff d['instanceType'] = self.instanceType d['lockoutDuration'] = self.lockoutDuration d['lockOutObservationWindow'] = self.lockOutObservationWindow d['lockoutThreshold'] = self.lockoutThreshold d['masteredBy'] = self.masteredBy d['maxPwdAge'] = self.maxPwdAge d['minPwdAge'] = self.minPwdAge d['minPwdLength'] = self.minPwdLength d['name'] = self.name d['nextRid'] = self.nextRid d['nTSecurityDescriptor'] = self.nTSecurityDescriptor d['objectCategory'] = self.objectCategory d['objectClass'] = self.objectClass d['objectGUID'] = self.objectGUID d['objectSid'] = self.objectSid d['pwdHistoryLength'] = self.pwdHistoryLength d['pwdProperties'] = self.pwdProperties d['serverState'] = self.serverState d['systemFlags'] = self.systemFlags d['uASCompat'] = self.uASCompat d['uSNChanged'] = self.uSNChanged d['uSNCreated'] = self.uSNCreated d['whenChanged'] = self.whenChanged d['whenCreated'] = self.whenCreated d['domainmodelevel'] = self.domainmodelevel d['description'] = self.description return d def __str__(self): t = 'MSADInfo\n' t += 'auditingPolicy: %s\n' % self.auditingPolicy t += 'creationTime: %s\n' % self.creationTime t += 'dc: %s\n' % self.dc t += 'distinguishedName: %s\n' % self.distinguishedName t += 'forceLogoff: %s\n' % self.forceLogoff t += 'instanceType: %s\n' % self.instanceType t += 'lockoutDuration: %s\n' % self.lockoutDuration t += 'lockOutObservationWindow: %s\n' % self.lockOutObservationWindow t += 'lockoutThreshold: %s\n' % self.lockoutThreshold t += 'masteredBy: %s\n' % self.masteredBy t += 'maxPwdAge: %s\n' % self.maxPwdAge t += 'minPwdAge: %s\n' % self.minPwdAge t += 'minPwdLength: %s\n' % self.minPwdLength t += 'name: %s\n' % self.name t += 'nextRid: %s\n' % self.nextRid t += 'nTSecurityDescriptor: %s\n' % self.nTSecurityDescriptor t += 'objectCategory: %s\n' % self.objectCategory t += 'objectClass: %s\n' % self.objectClass t += 'objectGUID: %s\n' % self.objectGUID t += 'objectSid: %s\n' % self.objectSid t += 'pwdHistoryLength: %s\n' % self.pwdHistoryLength t += 'pwdProperties: %s\n' % self.pwdProperties t += 'serverState: %s\n' % self.serverState t += 'systemFlags: %s\n' % self.systemFlags t += 'uASCompat: %s\n' % self.uASCompat t += 'uSNChanged: %s\n' % self.uSNChanged t += 'uSNCreated: %s\n' % self.uSNCreated t += 'whenChanged: %s\n' % self.whenChanged t += 'whenCreated: %s\n' % self.whenCreated t += 'domainmodelevel: %s\n' % self.domainmodelevel t += 'description: %s\n' % self.description return t def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) for x in attrs] def to_bh(self, domain): try: functional_level = FUNCTIONAL_LEVELS[int(self.domainmodelevel)] except KeyError: functional_level = 'Unknown' return { '_gPLink' : self.gPLink, #always empty 'Aces' : [], 'ObjectIdentifier' : str(self.objectSid), "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing "Trusts" : [], #Post processing "ChildObjects": [], #Post processing "GPOChanges" : { "LocalAdmins": [], "RemoteDesktopUsers": [], "DcomUsers": [], "PSRemoteUsers": [], "AffectedComputers": [] }, "Links": [], # Post processing 'Properties' : { 'name' : domain, 'domain' : domain, 'domainsid' : str(self.objectSid).rsplit('-',1)[0] , 'distinguishedname' : str(self.distinguishedName).upper(), 'description' : self.description, 'functionallevel' : functional_level, 'highvalue' : True, 'whencreated' : bh_dt_convert(self.whenCreated), } }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702131765.0 msldap-0.5.9/msldap/ldap_objects/adou.py0000664000175000017500000001074614535074065017615 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import base64 from msldap.commons.utils import bh_dt_convert MSADOU_ATTRS = [ 'description', 'distinguishedName', 'dSCorePropagationData', 'gPLink', 'instanceType', 'isCriticalSystemObject', 'name', 'nTSecurityDescriptor', 'objectCategory', 'objectClass', 'objectGUID', 'ou', 'showInAdvancedViewOnly', 'systemFlags', 'uSNChanged', 'uSNCreated', 'whenChanged', 'whenCreated', 'isDeleted' ] class MSADOU: def __init__(self): self.description = None #dunno self.distinguishedName = None #datetime self.dSCorePropagationData = None #str self.gPLink = None #list self.instanceType = None #int self.isCriticalSystemObject = None #int self.name = None #int self.nTSecurityDescriptor = None #int self.objectCategory = None #int self.objectClass = None #str self.objectGUID = None #int self.ou = None #int self.showInAdvancedViewOnly = None #int self.systemFlags = None #str self.uSNChanged = None #int self.uSNCreated = None #str self.whenChanged = None #str self.whenCreated = None #str self.isDeleted = None #str @staticmethod def from_ldap(entry): adi = MSADOU() adi.description = entry['attributes'].get('description') #dunno adi.distinguishedName = entry['attributes'].get('distinguishedName') #datetime adi.dSCorePropagationData = entry['attributes'].get('dSCorePropagationData') #str adi.gPLink = entry['attributes'].get('gPLink') #list adi.instanceType = entry['attributes'].get('instanceType') #int adi.isCriticalSystemObject = entry['attributes'].get('isCriticalSystemObject') #int adi.name = entry['attributes'].get('name') #str adi.nTSecurityDescriptor = entry['attributes'].get('nTSecurityDescriptor') #str adi.objectCategory = entry['attributes'].get('objectCategory') #str adi.objectClass = entry['attributes'].get('objectClass') #str adi.objectGUID = entry['attributes'].get('objectGUID') #str adi.ou = entry['attributes'].get('ou') #str adi.showInAdvancedViewOnly = entry['attributes'].get('showInAdvancedViewOnly') #int adi.systemFlags = entry['attributes'].get('systemFlags') #int adi.uSNChanged = entry['attributes'].get('uSNChanged') #int adi.uSNCreated = entry['attributes'].get('uSNCreated') #int adi.whenChanged = entry['attributes'].get('whenChanged') #datetime adi.whenCreated = entry['attributes'].get('whenCreated') #datetime adi.isDeleted = entry['attributes'].get('isDeleted') #datetime return adi def to_dict(self): d = {} d['description'] = self.description d['distinguishedName'] = self.distinguishedName d['dSCorePropagationData'] = self.dSCorePropagationData d['gPLink'] = self.gPLink d['instanceType'] = self.instanceType d['isCriticalSystemObject'] = self.isCriticalSystemObject d['name'] = self.name d['nTSecurityDescriptor'] = self.nTSecurityDescriptor d['objectCategory'] = self.objectCategory d['objectClass'] = self.objectClass d['objectGUID'] = self.objectGUID d['ou'] = self.ou d['showInAdvancedViewOnly'] = self.showInAdvancedViewOnly d['systemFlags'] = self.systemFlags d['uSNChanged'] = self.uSNChanged d['uSNCreated'] = self.uSNCreated d['whenChanged'] = self.whenChanged d['whenCreated'] = self.whenCreated d['isDeleted'] = self.isDeleted return d def get_row(self, attrs): t = self.to_dict() if 'nTSecurityDescriptor' in attrs: if t['nTSecurityDescriptor'] is not None: t['nTSecurityDescriptor'] = base64.b64encode(t['nTSecurityDescriptor']).decode() else: t['nTSecurityDescriptor'] = b'' return [str(t.get(x)) for x in attrs] def __str__(self): t = 'MSADOU\r\n' d = self.to_dict() for k in d: t += '%s: %s\r\n' % (k, d[k]) return t def to_bh(self, domain, domainsid): return { 'Aces' : [], 'Links' : [], 'ObjectIdentifier' : self.objectGUID.upper(), "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing 'Properties' : { 'name' : '%s@%s' % (self.name.upper(), domain.upper()), 'domain' : domain, 'domainsid' : domainsid, 'distinguishedname' : str(self.distinguishedName).upper(), 'highvalue' : False, # seems always false 'whencreated' : bh_dt_convert(self.whenCreated), 'description' : self.description , 'blocksinheritance' : False, # seems always false }, "GPOChanges": { "LocalAdmins": [], "RemoteDesktopUsers": [], "DcomUsers": [], "PSRemoteUsers": [], "AffectedComputers": [] }, '_gPLink' : self.gPLink, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adschemaentry.py0000664000175000017500000000535614531630505021506 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # MSAD_SYNTAX_TYPE = { '2.5.5.1': 'str', '2.5.5.2': 'str', '2.5.5.3': 'str', '2.5.5.4': 'str', '2.5.5.5': 'str', '2.5.5.6': 'str', '2.5.5.7': 'str', '2.5.5.8': 'bool', '2.5.5.9': 'int', '2.5.5.10': 'bytes', '2.5.5.11': 'date', '2.5.5.12': 'str', '2.5.5.13': 'bstr', '2.5.5.14': 'str', '2.5.5.15': 'sd', '2.5.5.16': 'int', '2.5.5.17': 'sid', } MSADSCHEMAENTRY_ATTRS = [ 'cn', 'distinguishedName', 'adminDescription', 'adminDisplayName', 'objectGUID', 'schemaIDGUID', 'lDAPDisplayName', 'name', 'attributeID', 'attributeSyntax', 'isSingleValued', 'isMemberOfPartialAttributeSet' ] class MSADSchemaEntry: def __init__(self): self.cn = None #str self.distinguishedName = None #dn self.adminDescription = None #dunno self.adminDisplayName = None #datetime self.objectGUID = None #int self.schemaIDGUID = None self.lDAPDisplayName = None self.name = None #int self.attributeID = None self.attributeSyntax = None self.isSingleValued = None #str self.isMemberOfPartialAttributeSet = None @staticmethod def from_ldap(entry): adi = MSADSchemaEntry() adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.adminDescription = entry['attributes'].get('adminDescription') adi.adminDisplayName = entry['attributes'].get('adminDisplayName') adi.objectGUID = entry['attributes'].get('objectGUID') #str adi.schemaIDGUID = entry['attributes'].get('schemaIDGUID') #list adi.lDAPDisplayName = entry['attributes'].get('lDAPDisplayName') #int adi.name = entry['attributes'].get('name') #int adi.attributeID = entry['attributes'].get('attributeID') adi.attributeSyntax = entry['attributes'].get('attributeSyntax') adi.isSingleValued = entry['attributes'].get('isSingleValued') adi.isMemberOfPartialAttributeSet = entry['attributes'].get('isMemberOfPartialAttributeSet') return adi def to_dict(self): d = {} d['cn'] = self.cn d['distinguishedName'] = self.distinguishedName d['adminDescription'] = self.adminDescription d['adminDisplayName'] = self.adminDisplayName d['objectGUID'] = self.objectGUID d['schemaIDGUID'] = self.schemaIDGUID d['lDAPDisplayName'] = self.lDAPDisplayName d['name'] = self.name d['attributeID'] = self.attributeID d['attributeSyntax'] = self.attributeSyntax d['isSingleValued'] = self.isSingleValued d['isMemberOfPartialAttributeSet'] = self.isMemberOfPartialAttributeSet return d def __str__(self): t = 'MSADSchemaEntry\r\n' d = self.to_dict() for k in d: t += '%s: %s\r\n' % (k, d[k]) return t def get_type(self): im = 'single' if self.isSingleValued is True else 'multi' return '%s_%s' % (im, MSAD_SYNTAX_TYPE[self.attributeSyntax])././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adsec.py0000664000175000017500000000424514531630505017732 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from winacl.dtyp.sid import SID from msldap.ldap_objects.common import MSLDAP_UAC, vn class MSADTokenGroup: def __init__(self): self.cn = None #str self.distinguishedName = None #dn self.objectGUID = None self.objectSid = None self.tokengroups = [] @staticmethod def from_ldap(entry): t = MSADTokenGroup() t.cn = entry['attributes'].get('cn') t.distinguishedName = entry['attributes'].get('distinguishedName') t.objectGUID = entry['attributes'].get('objectGUID') t.objectSid = entry['attributes'].get('objectSid') for sid_data in entry['attributes']['tokenGroups']: t.tokengroups.append(SID.from_bytes(sid_data)) return t def __str__(self): t = '== MSADTokenGroup ==\r\n' t+= 'cn : %s\r\n' % self.cn t+= 'distinguishedName : %s\r\n' % self.distinguishedName t+= 'objectGUID : %s\r\n' % self.objectGUID t+= 'objectSid : %s\r\n' % self.objectSid t+= 'tokengroups : %s\r\n' % [str(x) for x in self.tokengroups] return t class MSADSecurityInfo: ATTRS = [ 'sn', 'cn', 'objectClass','distinguishedName', 'nTSecurityDescriptor', 'objectGUID', 'objectSid'] def __init__(self): self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.nTSecurityDescriptor = None self.objectGUID = None self.objectSid = None self.objectClass = None @staticmethod def from_ldap(entry): adi = MSADSecurityInfo() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.objectGUID = entry['attributes'].get('objectGUID') adi.objectSid = entry['attributes'].get('objectSid') adi.objectClass = entry['attributes'].get('objectClass') adi.nTSecurityDescriptor = entry['attributes'].get('nTSecurityDescriptor') return adi def __str__(self): t = '== MSADSecurityInfo ==\r\n' t+= 'sn : %s\r\n' % self.sn t+= 'cn : %s\r\n' % self.cn t+= 'distinguishedName : %s\r\n' % self.distinguishedName t+= 'objectGUID : %s\r\n' % self.objectGUID t+= 'objectSid : %s\r\n' % self.objectSid t+= 'nTSecurityDescriptor : %s\r\n' % self.nTSecurityDescriptor return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/adtrust.py0000664000175000017500000002512414531630505020340 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum from winacl.dtyp.sid import SID from msldap.ldap_objects.common import MSLDAP_UAC, vn MSADDomainTrust_ATTRS = [ 'sn', 'cn', 'objectClass', 'distinguishedName', 'nTSecurityDescriptor', 'objectGUID', 'instanceType', 'whenCreated', 'whenChanged', 'name', 'securityIdentifier', 'trustDirection', 'trustPartner', 'trustPosixOffset', 'trustType', 'trustAttributes', 'flatName', 'dSCorePropagationData', ] class TrustType(enum.Enum): DOWNLEVEL = 0x00000001 #): The trusted domain is a Windows domain not running Active Directory. UPLEVEL = 0x00000002 #): The trusted domain is a Windows domain running Active Directory. MIT = 0x00000003 #): The trusted domain is running a non-Windows, RFC4120-compliant Kerberos distribution. This type of trust is distinguished in that (1) a SID is not required for the TDO, and (2) the default key types include the DES-CBC and DES-CRC encryption types (see [RFC4120] section 8.1). DCE = 0x00000004 #): Historical reference; this value is not used in Windows. # From: https://msdn.microsoft.com/en-us/library/cc223768.aspx class TrustDirection(enum.Enum): #enum.IntFlag << the actual type is intflag, but noone cares DISABLED = 0x00000000 #: Absence of any flags. The trust relationship exists but has been disabled. INBOUND = 0x00000001 #): The trusted domain trusts the primary domain to perform operations such as name lookups and authentication. If this flag is set, then the trustAuthIncoming attribute is present on this object. OUTBOUND = 0x00000002 #: The primary domain trusts the trusted domain to perform operations such as name lookups and authentication. If this flag is set, then the trustAuthOutgoing attribute is present on this object. BIDIRECTIONAL = 0x00000003 #: OR'ing of the preceding flags and behaviors representing that both domains trust one another for operations such as name lookups and authentication. # https://msdn.microsoft.com/en-us/library/cc223779.aspx class TrustAttributes(enum.IntFlag): NON_TRANSITIVE = 0x00000001 #If this bit is set, then the trust cannot be used transitively. For example, if domain A trusts domain B, which in turn trusts domain C, and the A<-->B trust has this attribute set, then a client in domain A cannot authenticate to a server in domain C over the A<-->B<-->C trust linkage UPLEVEL_ONLY = 0x00000002 #If this bit is set in the attribute, then only Windows 2000 operating system and newer clients can use the trust link. Netlogon does not consume trust objects that have this flag set. QUARANTINED_DOMAIN = 0x00000004 #If this bit is set, the trusted domain is quarantined and is subject to the rules of SID Filtering as described in [MS-PAC] section 4.1.2.2. FOREST_TRANSITIVE = 0x00000008 #If this bit is set, the trust link is a cross-forest trust [MS-KILE] between the root domains of two forests, both of which are running in a forest functional level of DS_BEHAVIOR_WIN2003 or greater. Only evaluated on Windows Server 2003 operating system and later. Can only be set if forest and trusted forest are running in a forest functional level of DS_BEHAVIOR_WIN2003 or greater. CROSS_ORGANIZATION = 0x00000010 # If this bit is set, then the trust is to a domain or forest that is not part of the organization. The behavior controlled by this bit is explained in [MS-KILE] section 3.3.5.7.5 and [MS-APDS] section 3.1.5. Only evaluated on Windows Server 2003 and later. Can only be set if forest and trusted forest are running in a forest functional level of DS_BEHAVIOR_WIN2003 or greater. WITHIN_FOREST = 0x00000020 #If this bit is set, then the trusted domain is within the same forest. Only evaluated on Windows Server 2003 and later. TREAT_AS_EXTERNAL = 0x00000040 #If this bit is set, then a cross-forest trust to a domain is to be treated as an external trust for the purposes of SID Filtering. Cross-forest trusts are more stringently filtered than external trusts. This attribute relaxes those cross-forest trusts to be equivalent to external trusts. For more information on how each trust type is filtered, see [MS-PAC] section 4.1.2.2. Only evaluated on Windows Server 2003 and later. Only evaluated if SID Filtering is used. Only evaluated on cross-forest trusts having TRUST_ATTRIBUTE_FOREST_TRANSITIVE. Can only be set if forest and trusted forest are running in a forest functional level of DS_BEHAVIOR_WIN2003 or greater. USES_RC4_ENCRYPTION = 0x00000080 #This bit is set on trusts with the trustType set to TRUST_TYPE_MIT, which are capable of using RC4 keys. Historically, MIT Kerberos distributions supported only DES and 3DES keys ([RFC4120], [RFC3961]). MIT 1.4.1 adopted the RC4HMAC encryption type common to Windows 2000 [MS-KILE], so trusted domains deploying later versions of the MIT distribution required this bit. For more information, see "Keys and Trusts", section 6.1.6.9.1. Only evaluated on TRUST_TYPE_MIT CROSS_ORGANIZATION_NO_TGT_DELEGATION = 0x00000200 #If this bit is set, tickets granted under this trust MUST NOT be trusted for delegation. The behavior controlled by this bit is as specified in [MS-KILE] section 3.3.5.7.5. Initially supported on Windows Server 2008 operating system and later. After [MSKB-4490425] is installed, this bit is superseded by the TRUST_ATTRIBUTE_CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION bit. CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION = 0x00000800 # If this bit is set, tickets granted under this trust MUST be trusted for delegation. The behavior controlled by this bit is as specified in [MS-KILE] section 3.3.5.7.5. Only supported on Windows Server 2008 and later after [MSKB-4490425] updates are installed. PIM_TRUST = 0x00000400 # If this bit and the TATE bit are set, then a cross-forest trust to a domain is to be treated as Privileged Identity Management trust for the purposes of SID Filtering. For more information on how each trust type is filtered, see [MS-PAC] section 4.1.2.2. Evaluated on Windows Server 2012 R2 operating system only with [MSKB-3155495] installed. Also evaluated on Windows Server 2016 operating system and later. Evaluated only if SID Filtering is used. Evaluated only on cross-forest trusts having TRUST_ATTRIBUTE_FOREST_TRANSITIVE. BH_TRUST_DIR_NAMING = { TrustDirection.DISABLED: 'Disabled', TrustDirection.INBOUND: 'Inbound', TrustDirection.OUTBOUND: 'Outbound', TrustDirection.BIDIRECTIONAL: 'Bidirectional' } class MSADDomainTrust: def __init__(self): self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.objectGUID = None self.instanceType = None self.whenCreated = None self.whenChanged = None self.name = None self.securityIdentifier = None self.trustDirection = None self.trustPartner = None self.trustPosixOffset = None self.trustType = None self.trustAttributes = None self.flatName = None self.dSCorePropagationData = None @staticmethod def from_ldap(entry): adi = MSADDomainTrust() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.objectGUID = entry['attributes'].get('objectGUID') adi.instanceType = entry['attributes'].get('instanceType') adi.whenCreated = entry['attributes'].get('whenCreated') adi.whenChanged = entry['attributes'].get('whenChanged') adi.name = entry['attributes'].get('name') adi.securityIdentifier = entry['attributes'].get('securityIdentifier') adi.trustDirection = entry['attributes'].get('trustDirection') adi.trustPartner = entry['attributes'].get('trustPartner') adi.trustPosixOffset = entry['attributes'].get('trustPosixOffset') adi.trustType = entry['attributes'].get('trustType') adi.trustAttributes = entry['attributes'].get('trustAttributes') adi.flatName = entry['attributes'].get('flatName') adi.dSCorePropagationData = entry['attributes'].get('dSCorePropagationData') if adi.securityIdentifier is not None: adi.securityIdentifier = SID.from_bytes(adi.securityIdentifier) if adi.trustType is not None: adi.trustType = TrustType(adi.trustType) if adi.trustDirection is not None: adi.trustDirection = TrustDirection(adi.trustDirection) return adi def to_dict(self): return { 'sn' : self.sn, 'cn' : self.cn, 'distinguishedName' : self.distinguishedName, 'objectGUID' : self.objectGUID, 'instanceType' : self.instanceType, 'whenCreated' : self.whenCreated, 'whenChanged' : self.whenChanged, 'name' : self.name, 'securityIdentifier' : self.securityIdentifier, 'trustDirection' : self.trustDirection, 'trustPartner' : self.trustPartner, 'trustPosixOffset' : self.trustPosixOffset, 'trustType' : self.trustType, 'trustAttributes' : self.trustAttributes, 'flatName' : self.flatName, 'dSCorePropagationData' : self.dSCorePropagationData, } def get_line(self): return '%s %s %s %s' % (self.name, self.trustType, self.trustDirection, self.securityIdentifier) def __str__(self): t = '== MSADDomainTrust ==\r\n' t+= 'sn : %s\r\n' % self.sn t+= 'cn : %s\r\n' % self.cn t+= 'distinguishedName : %s\r\n' % self.distinguishedName t+= 'objectGUID : %s\r\n' % self.objectGUID t+= 'instanceType : %s\r\n' % self.instanceType t+= 'whenCreated : %s\r\n' % self.whenCreated t+= 'whenChanged : %s\r\n' % self.whenChanged t+= 'name : %s\r\n' % self.name t+= 'securityIdentifier : %s\r\n' % str(self.securityIdentifier) t+= 'trustDirection : %s\r\n' % self.trustDirection t+= 'trustPartner : %s\r\n' % self.trustPartner t+= 'trustPosixOffset : %s\r\n' % self.trustPosixOffset t+= 'trustType : %s\r\n' % self.trustType t+= 'trustAttributes : %s\r\n' % self.trustAttributes t+= 'flatName : %s\r\n' % self.flatName t+= 'dSCorePropagationData : %s\r\n' % self.dSCorePropagationData return t def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) for x in attrs] def to_bh(self): tat = TrustAttributes(self.trustAttributes) if TrustAttributes.WITHIN_FOREST in tat: is_transitive = True sid_filtering = TrustAttributes.QUARANTINED_DOMAIN in tat elif TrustAttributes.FOREST_TRANSITIVE in tat: is_transitive = True sid_filtering = True elif TrustAttributes.CROSS_ORGANIZATION in tat or TrustAttributes.TREAT_AS_EXTERNAL in tat: is_transitive = False sid_filtering = True else: is_transitive = TrustAttributes.NON_TRANSITIVE not in tat sid_filtering = True dname = self.name if self.name is None: dname = '' dname = dname.upper() return { "TargetDomainName": dname, "TargetDomainSid": str(self.securityIdentifier), "IsTransitive": is_transitive, "TrustDirection": self.trustDirection.value, "TrustType": self.trustType.value, "SidFilteringEnabled": sid_filtering } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/aduser.py0000664000175000017500000003434514531630505020142 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import datetime #, timedelta, timezone from msldap.ldap_objects.common import MSLDAP_UAC, vn from msldap.commons.utils import bh_dt_convert MSADUser_ATTRS = [ 'accountExpires', 'badPasswordTime', 'badPwdCount', 'cn', 'codePage', 'countryCode', 'displayName', 'distinguishedName', 'givenName', 'initials', 'lastLogoff', 'lastLogon', 'lastLogonTimestamp', 'logonCount', 'name', 'description', 'objectCategory', 'objectClass', 'objectGUID', 'objectSid', 'primaryGroupID', 'pwdLastSet', 'sAMAccountName', 'sAMAccountType', 'sn', 'userAccountControl', 'userPrincipalName', 'whenChanged', 'whenCreated','memberOf','member', 'servicePrincipalName', 'msDS-AllowedToDelegateTo', 'adminCount', 'isDeleted', 'mail', 'title', 'homeDirectory', 'unixUserPassword', 'userPassword', 'unicodePwd', 'scriptPath', 'sIDHistory' ] MSADUser_TSV_ATTRS = [ 'sAMAccountName', 'userPrincipalName' ,'canLogon', 'badPasswordTime', 'description', 'badPwdCount', 'when_pw_change', 'when_pw_expires', 'pwdLastSet', 'lastLogonTimestamp', 'whenCreated', 'whenChanged', 'member', 'memberOf', 'servicePrincipalName', 'objectSid', 'cn', 'UAC_SCRIPT', 'UAC_ACCOUNTDISABLE', 'UAC_LOCKOUT', 'UAC_PASSWD_NOTREQD', 'UAC_PASSWD_CANT_CHANGE', 'UAC_ENCRYPTED_TEXT_PASSWORD_ALLOWED', 'UAC_DONT_EXPIRE_PASSWD', 'UAC_USE_DES_KEY_ONLY', 'UAC_DONT_REQUIRE_PREAUTH', 'UAC_PASSWORD_EXPIRED', 'adminCount', 'isDeleted', 'mail', 'title', 'homeDirectory', 'userPassword', 'unixUserPassword', 'unicodePwd', 'scriptPath', ] class MSADUser: def __init__(self): ## ID self.sn = None #str self.cn = None #str self.distinguishedName = None #dn self.initials = None #str self.givenName = None #str self.displayName = None #str self.name = None #str self.description = None self.objectCategory = None #dn self.objectClass = None #str self.objectGUID = None #uid self.objectSid = None #str self.primaryGroupID = None #uid self.sAMAccountName = None #str self.userPrincipalName = None #str self.servicePrincipalName = None #str self.mail = None #str self.title = None #str self.homeDirectory = None #str self.userPassword = None #str self.unixUserPassword = None #str self.unicodePwd = None #str self.scriptPath = None #str self.sIDHistory = None #list ## groups self.memberOf = None #list self.member = None #list ## times self.accountExpires = None #datetime self.badPasswordTime = None #datetime self.lastLogoff = None #datetime self.lastLogon = None #datetime self.lastLogonTimestamp = None #datetime self.pwdLastSet = None #datetime self.whenChanged = None #datetime self.whenCreated = None #datetime ## security self.badPwdCount = None #int self.logonCount = None #int self.sAMAccountType = None #int self.userAccountControl = None #UserAccountControl intflag self.allowedtodelegateto = None self.admincount = None self.isDeleted = None ## other self.codePage = None #int self.countryCode = None #int ## calculated properties self.when_pw_change = None #datetime self.when_pw_expires = None #datetime self.must_change_pw = None #datetime self.canLogon = None #bool # https://msdn.microsoft.com/en-us/library/cc245739.aspx def calc_PasswordMustChange(self, adinfo): # Crtieria 1 flags = [MSLDAP_UAC.DONT_EXPIRE_PASSWD, MSLDAP_UAC.SMARTCARD_REQUIRED, MSLDAP_UAC.INTERDOMAIN_TRUST_ACCOUNT, MSLDAP_UAC.WORKSTATION_TRUST_ACCOUNT, MSLDAP_UAC.SERVER_TRUST_ACCOUNT] for flag in flags: if flag & self.userAccountControl: return datetime.datetime.max #never #criteria 2 if self.pwdLastSet == datetime.timedelta(): return datetime.datetime.min if adinfo.maxPwdAge == datetime.timedelta(): #empty timedelta return datetime.datetime.max #never if adinfo.maxPwdAge.days < -3650: #this is needed, because some ADs have mawPwdAge set for a huge number BUT not to the minimum return datetime.datetime.max #never return (self.pwdLastSet - adinfo.maxPwdAge).replace(tzinfo=None) # https://msdn.microsoft.com/en-us/library/cc223991.aspx def calc_CanLogon(self): flags = [MSLDAP_UAC.ACCOUNTDISABLE, MSLDAP_UAC.LOCKOUT, MSLDAP_UAC.SMARTCARD_REQUIRED, MSLDAP_UAC.INTERDOMAIN_TRUST_ACCOUNT, MSLDAP_UAC.WORKSTATION_TRUST_ACCOUNT, MSLDAP_UAC.SERVER_TRUST_ACCOUNT] for flag in flags: if flag & self.userAccountControl: return False if (not (MSLDAP_UAC.DONT_EXPIRE_PASSWD & self.userAccountControl)) and (self.accountExpires.replace(tzinfo=None) - datetime.datetime.now()).total_seconds() < 0: return False # # TODO: logonHours check! # if self.must_change_pw == datetime.datetime.min: #can logon, but must change the password! return True if (self.must_change_pw - datetime.datetime.now()).total_seconds() < 0: return False return True @staticmethod def from_ldap(entry, adinfo = None): adi = MSADUser() adi.sn = entry['attributes'].get('sn') adi.cn = entry['attributes'].get('cn') adi.distinguishedName = entry['attributes'].get('distinguishedName') adi.description = entry['attributes'].get('description') adi.initials = entry['attributes'].get('initials') adi.givenName = entry['attributes'].get('givenName') adi.displayName = entry['attributes'].get('displayName') adi.name = entry['attributes'].get('name') adi.objectCategory = entry['attributes'].get('objectCategory') adi.objectClass = entry['attributes'].get('objectClass') adi.objectGUID = entry['attributes'].get('objectGUID') adi.objectSid = entry['attributes'].get('objectSid') adi.primaryGroupID = entry['attributes'].get('primaryGroupID') adi.sAMAccountName = entry['attributes'].get('sAMAccountName') adi.userPrincipalName = entry['attributes'].get('userPrincipalName') adi.servicePrincipalName = entry['attributes'].get('servicePrincipalName') adi.memberOf = entry['attributes'].get('memberOf') adi.member = entry['attributes'].get('member') adi.accountExpires = entry['attributes'].get('accountExpires') adi.badPasswordTime = entry['attributes'].get('badPasswordTime') adi.lastLogoff = entry['attributes'].get('lastLogoff') adi.lastLogon = entry['attributes'].get('lastLogon') adi.lastLogonTimestamp = entry['attributes'].get('lastLogonTimestamp') adi.pwdLastSet = entry['attributes'].get('pwdLastSet') adi.whenChanged = entry['attributes'].get('whenChanged') adi.whenCreated = entry['attributes'].get('whenCreated') adi.badPwdCount = entry['attributes'].get('badPwdCount') adi.logonCount = entry['attributes'].get('logonCount') adi.sAMAccountType = entry['attributes'].get('sAMAccountType') adi.codePage = entry['attributes'].get('codePage') adi.countryCode = entry['attributes'].get('countryCode') adi.isDeleted = entry['attributes'].get('isDeleted') adi.mail = entry['attributes'].get('mail') adi.title = entry['attributes'].get('title') adi.userPassword = entry['attributes'].get('userPassword') adi.unixUserPassword = entry['attributes'].get('unixuserpassword') adi.unicodePwd = entry['attributes'].get('unicodePwd') adi.scriptPath = entry['attributes'].get('scriptPath') adi.sIDHistory = entry['attributes'].get('sIDHistory') adi.allowedtodelegateto = entry['attributes'].get('msDS-AllowedToDelegateTo') adi.admincount = entry['attributes'].get('adminCount') temp = entry['attributes'].get('userAccountControl') if temp: adi.userAccountControl = MSLDAP_UAC(temp) if adinfo: adi.when_pw_change = (adi.pwdLastSet - adinfo.minPwdAge).replace(tzinfo=None) if adinfo.maxPwdAge.days < -3650: #this is needed, because some ADs have mawPwdAge set for a huge number BUT not to the minimum adi.when_pw_expires = datetime.datetime.max else: adi.when_pw_expires = (adi.pwdLastSet - adinfo.maxPwdAge).replace(tzinfo=None) if adinfo.maxPwdAge != 0 else adi.pwdLastSet adi.must_change_pw = adi.calc_PasswordMustChange(adinfo) #datetime adi.canLogon = adi.calc_CanLogon() #bool return adi def to_dict(self): t = {} t['sn'] = vn(self.sn) t['cn'] = vn(self.cn) t['distinguishedName'] = vn(self.distinguishedName) t['initials'] = vn(self.initials) t['givenName'] = vn(self.givenName) t['displayName'] = vn(self.displayName) t['description'] = vn(self.description) t['name'] = vn(self.name) t['objectCategory'] = vn(self.objectCategory) t['objectClass'] = vn(self.objectClass) t['objectGUID'] = vn(self.objectGUID) t['objectSid'] = vn(self.objectSid) t['primaryGroupID'] = vn(self.primaryGroupID) t['sAMAccountName'] = vn(self.sAMAccountName) t['userPrincipalName'] = vn(self.userPrincipalName) t['servicePrincipalName'] = vn(self.servicePrincipalName) t['memberOf'] = vn(self.memberOf) t['member'] = vn(self.member) t['accountExpires'] = vn(self.accountExpires) t['badPasswordTime'] = vn(self.badPasswordTime) t['lastLogoff'] = vn(self.lastLogoff) t['lastLogon'] = vn(self.lastLogon) t['lastLogonTimestamp'] = vn(self.lastLogonTimestamp) t['pwdLastSet'] = vn(self.pwdLastSet) t['whenChanged'] = vn(self.whenChanged) t['whenCreated'] = vn(self.whenCreated) t['badPwdCount'] = vn(self.badPwdCount) t['logonCount'] = vn(self.logonCount) t['sAMAccountType'] = vn(self.sAMAccountType) t['codePage'] = vn(self.codePage) t['countryCode'] = vn(self.countryCode) t['userAccountControl'] = vn(self.userAccountControl) t['when_pw_change'] = vn(self.when_pw_change) t['when_pw_expires'] = vn(self.when_pw_expires) t['must_change_pw'] = vn(self.must_change_pw) t['admincount'] = self.admincount t['canLogon'] = vn(self.canLogon) t['isDeleted'] = vn(self.isDeleted) t['mail'] = vn(self.mail) t['title'] = vn(self.title) t['homeDirectory'] = vn(self.homeDirectory) t['userPassword'] = vn(self.userPassword) t['unixUserPassword'] = vn(self.unixUserPassword) t['unicodePwd'] = vn(self.unicodePwd) t['scriptPath'] = vn(self.scriptPath) return t def uac_to_textflag(self, attr_s): if self.userAccountControl is None or self.userAccountControl == '': return 'N/A' attr = getattr(MSLDAP_UAC, attr_s[4:]) if self.userAccountControl & attr: return True return False def get_row(self, attrs): t = self.to_dict() return [str(t.get(x)) if x[:4]!='UAC_' else str(self.uac_to_textflag(x)) for x in attrs] def __str__(self): t = 'MSADUser\n' t += 'sn: %s\n' % self.sn t += 'cn: %s\n' % self.cn t += 'distinguishedName: %s\n' % self.distinguishedName t += 'initials: %s\n' % self.initials t += 'displayName: %s\n' % self.displayName t += 'name: %s\n' % self.name t += 'primaryGroupID: %s\n' % self.primaryGroupID t += 'sAMAccountName: %s\n' % self.sAMAccountName t += 'userPrincipalName: %s\n' % self.userPrincipalName t += 'servicePrincipalName: %s\n' % self.servicePrincipalName t += 'memberOf: %s\n' % self.memberOf t += 'member: %s\n' % self.member t += 'accountExpires: %s\n' % self.accountExpires t += 'badPasswordTime: %s\n' % self.badPasswordTime t += 'lastLogoff: %s\n' % self.lastLogoff t += 'lastLogon: %s\n' % self.lastLogon t += 'lastLogonTimestamp: %s\n' % self.lastLogonTimestamp t += 'pwdLastSet: %s\n' % self.pwdLastSet t += 'whenChanged: %s\n' % self.whenChanged t += 'whenCreated: %s\n' % self.whenCreated t += 'objectGUID: %s\n' % self.objectGUID t += 'objectSid: %s\n' % self.objectSid t += 'badPwdCount: %s\n' % self.badPwdCount t += 'logonCount: %s\n' % self.logonCount t += 'sAMAccountType: %s\n' % self.sAMAccountType t += 'codePage: %s\n' % self.codePage t += 'countryCode: %s\n' % self.countryCode t += 'userAccountControl: %s\n' % self.userAccountControl t += 'when_pw_change: %s\n' % self.when_pw_change t += 'when_pw_expires: %s\n' % self.when_pw_expires t += 'must_change_pw: %s\n' % self.must_change_pw t += 'admincount: %s\n' % self.admincount t += 'canLogon: %s\n' % self.canLogon t += 'isDeleted: %s\n' % self.isDeleted t += 'mail: %s\n' % self.mail t += 'title: %s\n' % self.title t += 'homeDirectory: %s\n' % self.homeDirectory t += 'userPassword: %s\n' % self.userPassword t += 'unixUserPassword: %s\n' % self.unixUserPassword t += 'unicodePwd: %s\n' % self.unicodePwd t += 'scriptPath: %s\n' % self.scriptPath return t def to_bh(self, domain): uac = self.userAccountControl if uac is None: uac = MSLDAP_UAC(0) sidhistory = [] if self.sIDHistory is not None: for sid in self.sIDHistory: sidhistory.append(str(sid)) return { '_allowerdtodelegateto' : self.allowedtodelegateto, 'Aces' : [], #Post processing 'AllowedToDelegate' : [], #Post processing 'ObjectIdentifier' : str(self.objectSid), 'PrimaryGroupSID' : str(self.objectSid).rsplit('-',1)[0] + '-' + str(self.primaryGroupID), "SPNTargets": [], #TODO "HasSIDHistory": [], #TODO "IsDeleted": bool(self.isDeleted), "IsACLProtected": False , # Post processing 'Properties' : { 'name' : '%s@%s' % (self.sAMAccountName.upper(), domain.upper()), 'domain' : domain, 'domainsid' : str(self.objectSid).rsplit('-',1)[0] , 'distinguishedname' : str(self.distinguishedName).upper(), 'unconstraineddelegation' : self.uac_to_textflag('UAC_TRUSTED_FOR_DELEGATION'), 'trustedtoauth' : MSLDAP_UAC.TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION in uac, 'passwordnotreqd' : MSLDAP_UAC.PASSWD_NOTREQD in uac, 'enabled' : MSLDAP_UAC.ACCOUNTDISABLE not in uac, 'lastlogon' : bh_dt_convert(self.lastLogon), 'lastlogontimestamp' : bh_dt_convert(self.lastLogonTimestamp), 'pwdlastset' : bh_dt_convert(self.pwdLastSet), 'dontreqpreauth' : MSLDAP_UAC.DONT_REQUIRE_PREAUTH in uac, 'pwdneverexpires' : MSLDAP_UAC.DONT_EXPIRE_PASSWD in uac, 'sensitive' : MSLDAP_UAC.NOT_DELEGATED in uac, 'serviceprincipalnames' : self.servicePrincipalName if self.servicePrincipalName is not None else [], 'hasspn' : bool(self.servicePrincipalName), 'displayname' : self.displayName , 'email' : self.mail, 'title' : self.title , 'homedirectory' : self.homeDirectory , 'description' : self.description , 'userpassword' : self.userPassword , 'admincount': bool(self.admincount), 'sidhistory' : sidhistory, 'whencreated' : bh_dt_convert(self.whenCreated), 'unixpassword' : self.unixUserPassword , 'unicodepassword' : self.unicodePwd , 'logonscript' : self.scriptPath, 'samaccountname' : self.sAMAccountName, 'highvalue': False, #TODO 'sfupassword' : None , #TODO have no idea what this is } } ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/ldap_objects/common.py0000664000175000017500000001073114531630505020140 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum from datetime import datetime def vn(x): """ value or none, returns none if x is an empty list """ if x == []: return None if isinstance(x, list): return '|'.join(x) if isinstance(x, datetime): return x.isoformat() return x class MSLDAP_UAC(enum.IntFlag): SCRIPT = 0x00000001 #[ADS_UF_SCRIPT](https://msdn.microsoft.com/library/aa772300) The logon script is executed. ACCOUNTDISABLE = 0x00000002 #[ADS_UF_ACCOUNTDISABLE](https://msdn.microsoft.com/library/aa772300) The user account is disabled. HOMEDIR_REQUIRED = 0x00000008 #[ADS_UF_HOMEDIR_REQUIRED](https://msdn.microsoft.com/library/aa772300) The home directory is required. LOCKOUT = 0x00000010 #[ADS_UF_LOCKOUT](https://msdn.microsoft.com/library/aa772300) The account is currently locked out. PASSWD_NOTREQD = 0x00000020 #[ADS_UF_PASSWD_NOTREQD](https://msdn.microsoft.com/library/aa772300) No password is required. PASSWD_CANT_CHANGE = 0x00000040 #[ADS_UF_PASSWD_CANT_CHANGE](https://msdn.microsoft.com/library/aa772300) The user cannot change the password. ENCRYPTED_TEXT_PASSWORD_ALLOWED = 0x00000080 #[ADS_UF_ENCRYPTED_TEXT_PASSWORD_ALLOWED](https://msdn.microsoft.com/library/aa772300) The user can send an encrypted password. TEMP_DUPLICATE_ACCOUNT = 0x00000100 #[ADS_UF_TEMP_DUPLICATE_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is an account for users whose primary account is in another domain. This account provides user access to this domain, but not to any domain that trusts this domain. Also known as a local user account. NORMAL_ACCOUNT = 0x00000200 #[ADS_UF_NORMAL_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is a default account type that represe nts a typical user. INTERDOMAIN_TRUST_ACCOUNT = 0x00000800 #[ADS_UF_INTERDOMAIN_TRUST_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is a permit to trust accou nt for a system domain that trusts other do mains. WORKSTATION_TRUST_ACCOUNT = 0x00001000 #[ADS_UF_WORKSTATION_TRUST_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is a computer account for a computer that is a member of this domain. SERVER_TRUST_ACCOUNT = 0x00002000 #[ADS_UF_SERVER_TRUST_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is a computer account for a system backup domain controller that is a member of this domain. NA_1 = 0x00004000 # N/A Not used. NA_2 = 0x00008000 # N/A Not used. DONT_EXPIRE_PASSWD = 0x00010000 #[ADS_UF_DONT_EXPIRE_PASSWD](https://msdn.microsoft.com/library/aa772300) The password for this account will never expire. MNS_LOGON_ACCOUNT = 0x00020000 #[ADS_UF_MNS_LOGON_ACCOUNT](https://msdn.microsoft.com/library/aa772300) This is an MNS logon account. SMARTCARD_REQUIRED = 0x00040000 #[ADS_UF_SMARTCARD_REQUIRED](https://msdn.microsoft.com/library/aa772300) The user must log on using a smart card. TRUSTED_FOR_DELEGATION = 0x00080000 #[ADS_UF_TRUSTED_FOR_DELEGATION](https://msdn.microsoft.com/library/aa772300) The service account (user or computer account), under which a service runs, is trusted for Kerberos delegation. Any such service can impersonate a client requesting the service. NOT_DELEGATED = 0x00100000 #[ADS_UF_NOT_DELEGATED](https://msdn.microsoft.com/library/aa772300) The security c ontext of the user will not be delegated to a service even if the service account is s et as trusted for Kerberos delegation. USE_DES_KEY_ONLY = 0x00200000 #[ADS_UF_USE_DES_KEY_ONLY](https://msdn .microsoft.com/library/aa772300) Restrict this principal to use only Data Encryption Standard (DES) encryption types for keys. DONT_REQUIRE_PREAUTH = 0x00400000 #[ADS_UF_DONT_REQUIRE_PREAUTH](https://msdn.microsoft.com/library/aa772300) This account does not require Kerberos pre-authentication for logon. PASSWORD_EXPIRED = 0x00800000 #[ADS_UF_PASSWORD_EXPIRED](https://msdn.microsoft.com/library/aa772300) The user password has expired. This flag is created by the system using data from the [ Pwd-L ast-Set](a-pwdlastset.md) attribute and the domain policy. TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION = 0x01000000 #[ADS_UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION](https://msdn.microsoft.com/library/aa772300) The account is enabled for delegation. This is a security-sensi tive setting; accounts with this option enabled should be strictly controlled. This setting enables a service running under the account to assume a client identity and authenticate as that user to other remote servers on the network.././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0154088 msldap-0.5.9/msldap/network/0000775000175000017500000000000014535076203015337 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/network/__init__.py0000664000175000017500000000000014531630505017433 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/network/packetizer.py0000664000175000017500000000210214531630505020042 0ustar00webdevwebdevimport asyncio from msldap import logger from msldap.protocol.utils import calcualte_length from asysocks.unicomm.common.packetizers import Packetizer class LDAPPacketizer(Packetizer): def __init__(self): Packetizer.__init__(self, 65535) self.in_buffer = b'' self.is_plain_msg = True def process_buffer(self): preread = 6 remaining_length = -1 while True: if len(self.in_buffer) < preread: break lb = self.in_buffer[:preread] if self.is_plain_msg is True: remaining_length = calcualte_length(lb) - preread else: remaining_length = int.from_bytes(lb[:4], byteorder = 'big', signed = False) remaining_length = (remaining_length + 4) - preread if len(self.in_buffer) >= remaining_length+preread: data = self.in_buffer[:remaining_length+preread] self.in_buffer = self.in_buffer[remaining_length+preread:] yield data continue break async def data_out(self, data): yield data async def data_in(self, data): if data is None: yield data self.in_buffer += data for packet in self.process_buffer(): yield packet././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0154088 msldap-0.5.9/msldap/protocol/0000775000175000017500000000000014535076203015507 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/__init__.py0000664000175000017500000000000014531630505017603 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/constants.py0000664000175000017500000000017114531630505020071 0ustar00webdevwebdev BASE = 0 LEVEL = 1 SUBTREE = 2 DEREF_NEVER = 0 DEREF_SEARCH = 1 DEREF_BASE = 2 DEREF_ALWAYS = 3 ALL_ATTRIBUTES = '*' ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0154088 msldap-0.5.9/msldap/protocol/ldap_filter/0000775000175000017500000000000014535076203017774 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/ldap_filter/__init__.py0000664000175000017500000000007214531630505022101 0ustar00webdevwebdevfrom .filter import Filter from .parser import ParseError ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/ldap_filter/filter.py0000664000175000017500000003034114531630505021631 0ustar00webdevwebdevimport re import platform from msldap.protocol.ldap_filter import parser from msldap.protocol.ldap_filter.soundex import soundex_compare class LDAPBase: indent = 4 collapsed = False filters = None def simplify(self): if self.filters: if len(self.filters) == 1: return self.filters[0].simplify() else: self.filters = list(map(lambda x: x.simplify(), self.filters)) return self def to_string(self, indent, indt_char, level): raise NotImplementedError def match(self, data): raise NotImplementedError @staticmethod def _indent(indent, indt_char=' ', level=0): if type(indent) == bool and indent: indent = LDAPBase.indent else: try: indent = int(indent) except ValueError: return '' try: indt_char = str(indt_char) except ValueError: raise InvalidIndentChar('Indent value must convertible to a string') return indt_char * (level * indent) @staticmethod def parse(filt): filt = _strip_whitespace(filt) return parser.parse(filt, actions=ParserActions()) @staticmethod def escape(data): escaped = data.replace('\\', '\\5c') escaped = escaped.replace('*', '\\2a') escaped = escaped.replace('(', '\\28') escaped = escaped.replace(')', '\\29') escaped = escaped.replace('\x00', '\\00') return escaped @staticmethod def unescape(data): unescaped = data.replace('\\5c', '\\') unescaped = unescaped.replace('\\2a', '*') unescaped = unescaped.replace('\\28', '(') unescaped = unescaped.replace('\\29', ')') unescaped = unescaped.replace('\\00', '\x00') return unescaped @staticmethod def match_string(data, filt): match = _as_list(data) if '*' not in filt: return any(_ms_helper(m, filt) for m in match) return Filter.match_substring(data, filt) @staticmethod def match_substring(data, filt): match = _as_list(data) return any(_ss_helper(m, filt) for m in match) @staticmethod def match_approx(data, filt): match = _as_list(data) return any(_approx_helper(m, filt) for m in match) @staticmethod def match_lte(data, filt): match = _as_list(data) return any(_lte_helper(m, filt) for m in match) @staticmethod def match_gte(data, filt): match = _as_list(data) return any(_gte_helper(m, filt) for m in match) @staticmethod def AND(filt): return GroupAnd(filt) @staticmethod def OR(filt): return GroupOr(filt) @staticmethod def NOT(filt): filt = _as_list(filt) if not len(filt) == 1: # TODO: Error code here. raise Exception return GroupNot(filt) class Filter(LDAPBase): def __init__(self, attr, comp, val): self.type = 'filter' self.attr = attr self.comp = comp self.val = val def __repr__(self): return self.to_string() def __str__(self): return self.to_string() def __add__(self, other): return str(self) + other def __radd__(self, other): return other + str(self) def match(self, data): value = self.val try: attrval = data[self.attr] except KeyError: return False if self.comp == '=': if value == '*' and attrval: return True else: return Filter.match_string(attrval, value) elif self.comp == '<=': return Filter.match_lte(attrval, value) elif self.comp == '>=': return Filter.match_gte(attrval, value) elif self.comp == '~=': return Filter.match_approx(attrval, value) else: pass def to_string(self, indent=False, indt_char=' ', level=0): return ''.join([ self._indent(indent, indt_char, level), '(', self.attr, self.comp, self.val, ')' ]) @staticmethod def attribute(name): return Attribute(name) class Group(LDAPBase): def __init__(self, comp, filters): self.type = 'group' self.comp = comp self.filters = filters def __repr__(self): return self.to_string() def __str__(self): return self.to_string() def __add__(self, other): return str(self) + other def __radd__(self, other): return other + str(self) def match(self, data): raise NotImplementedError def to_string(self, indent=False, indt_char=' ', level=0): id_str = self._indent(indent, indt_char, level) id_str2 = id_str nl = '' # If running on Windows use Windows style newlines, # if anything else default to POSIX style. if platform.system() == 'Windows' and indent: nl = '\r\n' elif indent: nl = '\n' if not Filter.collapsed and self.comp == '!': nl = '' id_str2 = '' indent = 0 return ''.join([ id_str, '(', self.comp, nl, nl.join(list(map(lambda x: x.to_string(indent, indt_char, level + 1), self.filters))), nl, id_str2, ')' ]) class GroupOr(Group): def __init__(self, filters): super().__init__(comp='|', filters=filters) def match(self, data): return any(f.match(data) for f in self.filters) class GroupAnd(Group): def __init__(self, filters): super().__init__(comp='&', filters=filters) def match(self, data): return all(f.match(data) for f in self.filters) class GroupNot(Group): def __init__(self, filters): super().__init__(comp='!', filters=filters) def match(self, data): return not any(_not_helper(f, data) for f in self.filters) def simplify(self): return self class Attribute: def __init__(self, name): self.name = name def present(self): return Filter(self.name, '=', '*') def raw(self, value): return Filter(self.name, '=', _to_string(value)) def equal_to(self, value): return Filter(self.name, '=', self.escape(_to_string(value))) def starts_with(self, value): return Filter(self.name, '=', self.escape(_to_string(value)) + '*') def ends_with(self, value): return Filter(self.name, '=', '*' + self.escape(_to_string(value))) def contains(self, value): return Filter(self.name, '=', '*' + self.escape(_to_string(value)) + '*') def approx(self, value): return Filter(self.name, '~=', self.escape(_to_string(value))) def lte(self, value): return Filter(self.name, '<=', self.escape(_to_string(value))) def gte(self, value): return Filter(self.name, '>=', self.escape(_to_string(value))) @staticmethod def escape(data): escaped = data.replace('\\', '\\5c') escaped = escaped.replace('*', '\\2a') escaped = escaped.replace('(', '\\28') escaped = escaped.replace(')', '\\29') escaped = escaped.replace('\x00', '\\00') return escaped def _as_list(val): if not isinstance(val, (list, tuple)): return [val] return val def _ss_regex(filt): pattern = re.sub(r'\*', '.*', filt) pattern = re.sub(r'(?<=\\)([0-9a-fA-F]{,2})', _ss_regex_escaped, pattern) return re.compile('^' + pattern + '$', re.I) def _ss_regex_escaped(match): s = match.group(0) if match else None if s in ['28', '29', '5c', '2a']: s = 'x{}'.format(match.group(0).upper()) return s def _strip_whitespace(filt): if ' ' or '\n' or '\r\n' in filt: att_val = re.findall(r'(?<=[=])(?<=[~=]|[>=]|[<=])(.*?)(?=\))', filt) filt = filt.replace('\r\n', '') filt = filt.replace('\n', '') filt = filt.replace(' ', '') for s in att_val: key = s.replace('\r\n', '') key = key.replace('\n', '') key = key.replace(' ', '') filt = filt.replace(key, s) att = re.findall(r'(?<=[(])[a-zA-Z0-9 -.]*?(?=[~=]|[>=]|[<=]|[=])', filt) for s in att: if ' ' in s: regex = re.compile('(?<=[(])' + s + '?(?=[~=]|[>=]|[<=]|[=])', re.I) filt = re.sub(regex, s.replace(' ', ''), filt) return filt def _ss_helper(cv, filt): regex = _ss_regex(filt) return regex.match(cv) def _ms_helper(cv, filt): if cv: return cv.lower() == Filter.unescape(filt).lower() def _approx_helper(cv, filt): return soundex_compare(cv, filt) def _lte_helper(cv, filt): try: val = int(cv) <= int(filt) except ValueError: val = str(cv) <= str(filt) return val def _gte_helper(cv, filt): try: val = int(cv) >= int(filt) except ValueError: val = str(cv) >= str(filt) return val def _not_helper(filt, data): try: return filt.match(data) except AttributeError: pass def _to_string(val): try: val = str(val) except ValueError: print('Could not convert data to a string.') raise return val class ParserActions: @staticmethod def elements_to_string(elements=None): if elements: string = '' for e in elements: try: string += e.text if e else '' except AttributeError: string += str(e) if e else '' return string def return_string(self, input, start, end, elements=None): return self.elements_to_string(elements) def return_hex(self, input, start, end, elements=None): string = self.elements_to_string(elements) if string: return int(string, 16) def return_escaped_char(self, input, start, end, elements=None): string = self.elements_to_string(elements) if string: chr_code = int(string.replace('\\', '')) return chr(chr_code) @staticmethod def return_options(input, start, end, attr, opts=None, elements=None): if opts: opts.pop(0) opts = opts.pop(0) opts = opts.split(';') attr[0]['options'] = opts if opts else [] return attr[0] def return_oid_type(self, input, start, end, elements=None): oid = self.elements_to_string(elements) if oid: return { 'type': 'oid', 'attribute': oid } def return_attr_type(self, input, start, end, elements=None): name = self.elements_to_string(elements) if name: return { 'type': 'attribute', 'attribute': name } @staticmethod def return_simple_filter(input, start, end, elements=None): attr = elements[0]['attribute'] comp = getattr(elements[1], 'text') value = elements[2] return Filter(attr, comp, value) @staticmethod def return_present_filter(input, start, end, elements=None): attr = elements[0]['attribute'] return Filter.attribute(attr).present() @staticmethod def return_wildcard(input, start, end, elements=None): attr = elements[0]['attribute'] value = getattr(elements[2], 'text') return Filter(attr, '=', value) @staticmethod def return_filter(input, start, end, filt=None, elements=None): for f in filt: if isinstance(f, (Filter, GroupAnd, GroupOr, GroupNot)): return f @staticmethod def return_and_filter(input, start, end, filters=None, elements=None): for f in filters: if f.elements: return Filter.AND(f.elements) @staticmethod def return_or_filter(input, start, end, filters=None, elements=None): for f in filters: if f.elements: return Filter.OR(f.elements) @staticmethod def return_not_filter(input, start, end, filt=None, elements=None): for f in filt: if isinstance(f, Filter): return Filter.NOT(f) class InvalidIndentChar(Exception): pass ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/ldap_filter/parser.py0000664000175000017500000016430114531630505021644 0ustar00webdevwebdev# -*- coding: utf-8 -*- """LDAP Parser This parser is generated by the canopy library (`canopy.jcoglan.com `__). """ from collections import defaultdict import re class TreeNode(object): def __init__(self, text, offset, elements=None): self.text = text self.offset = offset self.elements = elements or [] def __iter__(self): for el in self.elements: yield el class TreeNode1(TreeNode): def __init__(self, text, offset, elements): super(TreeNode1, self).__init__(text, offset, elements) self.filt = elements[2] self.filtercomp = elements[2] class TreeNode2(TreeNode): def __init__(self, text, offset, elements): super(TreeNode2, self).__init__(text, offset, elements) self.filt = elements[1] self.item = elements[1] class TreeNode3(TreeNode): def __init__(self, text, offset, elements): super(TreeNode3, self).__init__(text, offset, elements) self.filters = elements[2] self.filterlist = elements[2] class TreeNode4(TreeNode): def __init__(self, text, offset, elements): super(TreeNode4, self).__init__(text, offset, elements) self.filters = elements[2] self.filterlist = elements[2] class TreeNode5(TreeNode): def __init__(self, text, offset, elements): super(TreeNode5, self).__init__(text, offset, elements) self.filt = elements[2] self.filter = elements[2] class TreeNode6(TreeNode): def __init__(self, text, offset, elements): super(TreeNode6, self).__init__(text, offset, elements) self.attr = elements[0] self.filtertype = elements[1] self.value = elements[2] class TreeNode7(TreeNode): def __init__(self, text, offset, elements): super(TreeNode7, self).__init__(text, offset, elements) self.attr = elements[0] self.equal = elements[1] self.wildcard_value = elements[2] class TreeNode8(TreeNode): def __init__(self, text, offset, elements): super(TreeNode8, self).__init__(text, offset, elements) self.any = elements[1] class TreeNode9(TreeNode): def __init__(self, text, offset, elements): super(TreeNode9, self).__init__(text, offset, elements) self.value = elements[0] class TreeNode10(TreeNode): def __init__(self, text, offset, elements): super(TreeNode10, self).__init__(text, offset, elements) self.attr = elements[0] self.AttributeType = elements[0] self.opts = elements[1] class TreeNode11(TreeNode): def __init__(self, text, offset, elements): super(TreeNode11, self).__init__(text, offset, elements) self.options = elements[1] class TreeNode12(TreeNode): def __init__(self, text, offset, elements): super(TreeNode12, self).__init__(text, offset, elements) self.options = elements[1] class TreeNode13(TreeNode): def __init__(self, text, offset, elements): super(TreeNode13, self).__init__(text, offset, elements) self.ALPHA = elements[0] class TreeNode14(TreeNode): def __init__(self, text, offset, elements): super(TreeNode14, self).__init__(text, offset, elements) self.option = elements[0] self.options = elements[2] class TreeNode15(TreeNode): def __init__(self, text, offset, elements): super(TreeNode15, self).__init__(text, offset, elements) self.ASCII_VALUE = elements[1] class TreeNode16(TreeNode): def __init__(self, text, offset, elements): super(TreeNode16, self).__init__(text, offset, elements) self.HEX_CHAR = elements[1] class ParseError(SyntaxError): pass FAILURE = object() class Grammar(object): _cache = None _input = None _input_size = None _actions = None REGEX_1 = re.compile('^[^*\\x29]') #re.compile('^[^!*\\x29]') REGEX_2 = re.compile('^[a-fA-F0-9]') REGEX_3 = re.compile('^[\\x20]') REGEX_4 = re.compile('^[\\x09]') REGEX_5 = re.compile('^[0-9]') REGEX_6 = re.compile('^[a-zA-Z:.]') def _read_root(self): address0, index0 = FAILURE, self._offset cached = self._cache['root'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_filter() if address0 is FAILURE: self._offset = index1 address0 = self._read_filter_item() if address0 is FAILURE: self._offset = index1 self._cache['root'][index0] = (address0, self._offset) return address0 def _read_filter(self): address0, index0 = FAILURE, self._offset cached = self._cache['filter'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] remaining0, index2, elements1, address2 = 0, self._offset, [], True while address2 is not FAILURE: address2 = self._read_FILL() if address2 is not FAILURE: elements1.append(address2) remaining0 -= 1 if remaining0 <= 0: address1 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address1 = FAILURE if address1 is not FAILURE: elements0.append(address1) chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '(': address3 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address3 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'(\'') if address3 is not FAILURE: elements0.append(address3) address4 = self._read_filtercomp() if address4 is not FAILURE: elements0.append(address4) chunk1 = None if self._offset < self._input_size: chunk1 = self._input[self._offset:self._offset + 1] if chunk1 == ')': address5 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address5 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\')\'') if address5 is not FAILURE: elements0.append(address5) remaining1, index3, elements2, address7 = 0, self._offset, [], True while address7 is not FAILURE: address7 = self._read_FILL() if address7 is not FAILURE: elements2.append(address7) remaining1 -= 1 if remaining1 <= 0: address6 = TreeNode(self._input[index3:self._offset], index3, elements2) self._offset = self._offset else: address6 = FAILURE if address6 is not FAILURE: elements0.append(address6) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['filter'][index0] = (address0, self._offset) return address0 def _read_filter_item(self): address0, index0 = FAILURE, self._offset cached = self._cache['filter_item'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] remaining0, index2, elements1, address2 = 0, self._offset, [], True while address2 is not FAILURE: address2 = self._read_FILL() if address2 is not FAILURE: elements1.append(address2) remaining0 -= 1 if remaining0 <= 0: address1 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address1 = FAILURE if address1 is not FAILURE: elements0.append(address1) address3 = self._read_item() if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['filter_item'][index0] = (address0, self._offset) return address0 def _read_filtercomp(self): address0, index0 = FAILURE, self._offset cached = self._cache['filtercomp'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_and() if address0 is FAILURE: self._offset = index1 address0 = self._read_or() if address0 is FAILURE: self._offset = index1 address0 = self._read_not() if address0 is FAILURE: self._offset = index1 address0 = self._read_item() if address0 is FAILURE: self._offset = index1 self._cache['filtercomp'][index0] = (address0, self._offset) return address0 def _read_and(self): address0, index0 = FAILURE, self._offset cached = self._cache['and'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '&': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'&\'') if address1 is not FAILURE: elements0.append(address1) remaining0, index2, elements1, address3 = 0, self._offset, [], True while address3 is not FAILURE: address3 = self._read_FILL() if address3 is not FAILURE: elements1.append(address3) remaining0 -= 1 if remaining0 <= 0: address2 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address2 = FAILURE if address2 is not FAILURE: elements0.append(address2) address4 = self._read_filterlist() if address4 is not FAILURE: elements0.append(address4) remaining1, index3, elements2, address6 = 0, self._offset, [], True while address6 is not FAILURE: address6 = self._read_FILL() if address6 is not FAILURE: elements2.append(address6) remaining1 -= 1 if remaining1 <= 0: address5 = TreeNode(self._input[index3:self._offset], index3, elements2) self._offset = self._offset else: address5 = FAILURE if address5 is not FAILURE: elements0.append(address5) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_and_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['and'][index0] = (address0, self._offset) return address0 def _read_or(self): address0, index0 = FAILURE, self._offset cached = self._cache['or'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '|': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'|\'') if address1 is not FAILURE: elements0.append(address1) remaining0, index2, elements1, address3 = 0, self._offset, [], True while address3 is not FAILURE: address3 = self._read_FILL() if address3 is not FAILURE: elements1.append(address3) remaining0 -= 1 if remaining0 <= 0: address2 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address2 = FAILURE if address2 is not FAILURE: elements0.append(address2) address4 = self._read_filterlist() if address4 is not FAILURE: elements0.append(address4) remaining1, index3, elements2, address6 = 0, self._offset, [], True while address6 is not FAILURE: address6 = self._read_FILL() if address6 is not FAILURE: elements2.append(address6) remaining1 -= 1 if remaining1 <= 0: address5 = TreeNode(self._input[index3:self._offset], index3, elements2) self._offset = self._offset else: address5 = FAILURE if address5 is not FAILURE: elements0.append(address5) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_or_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['or'][index0] = (address0, self._offset) return address0 def _read_not(self): address0, index0 = FAILURE, self._offset cached = self._cache['not'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '!': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'!\'') if address1 is not FAILURE: elements0.append(address1) remaining0, index2, elements1, address3 = 0, self._offset, [], True while address3 is not FAILURE: address3 = self._read_FILL() if address3 is not FAILURE: elements1.append(address3) remaining0 -= 1 if remaining0 <= 0: address2 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address2 = FAILURE if address2 is not FAILURE: elements0.append(address2) address4 = self._read_filter() if address4 is not FAILURE: elements0.append(address4) remaining1, index3, elements2, address6 = 0, self._offset, [], True while address6 is not FAILURE: address6 = self._read_FILL() if address6 is not FAILURE: elements2.append(address6) remaining1 -= 1 if remaining1 <= 0: address5 = TreeNode(self._input[index3:self._offset], index3, elements2) self._offset = self._offset else: address5 = FAILURE if address5 is not FAILURE: elements0.append(address5) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_not_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['not'][index0] = (address0, self._offset) return address0 def _read_filterlist(self): address0, index0 = FAILURE, self._offset cached = self._cache['filterlist'].get(index0) if cached: self._offset = cached[1] return cached[0] remaining0, index1, elements0, address1 = 1, self._offset, [], True while address1 is not FAILURE: address1 = self._read_filter() if address1 is not FAILURE: elements0.append(address1) remaining0 -= 1 if remaining0 <= 0: address0 = TreeNode(self._input[index1:self._offset], index1, elements0) self._offset = self._offset else: address0 = FAILURE self._cache['filterlist'][index0] = (address0, self._offset) return address0 def _read_item(self): address0, index0 = FAILURE, self._offset cached = self._cache['item'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_wildcard() if address0 is FAILURE: self._offset = index1 address0 = self._read_simple() if address0 is FAILURE: self._offset = index1 self._cache['item'][index0] = (address0, self._offset) return address0 def _read_simple(self): address0, index0 = FAILURE, self._offset cached = self._cache['simple'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] address1 = self._read_attr() if address1 is not FAILURE: elements0.append(address1) address2 = self._read_filtertype() if address2 is not FAILURE: elements0.append(address2) address3 = self._read_value() if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_simple_filter(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['simple'][index0] = (address0, self._offset) return address0 def _read_filtertype(self): address0, index0 = FAILURE, self._offset cached = self._cache['filtertype'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_equal() if address0 is FAILURE: self._offset = index1 address0 = self._read_approx() if address0 is FAILURE: self._offset = index1 address0 = self._read_greater() if address0 is FAILURE: self._offset = index1 address0 = self._read_less() if address0 is FAILURE: self._offset = index1 self._cache['filtertype'][index0] = (address0, self._offset) return address0 def _read_equal(self): address0, index0 = FAILURE, self._offset cached = self._cache['equal'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '=': address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'=\'') self._cache['equal'][index0] = (address0, self._offset) return address0 def _read_approx(self): address0, index0 = FAILURE, self._offset cached = self._cache['approx'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 2] if chunk0 == '~=': address0 = TreeNode(self._input[self._offset:self._offset + 2], self._offset) self._offset = self._offset + 2 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'~=\'') self._cache['approx'][index0] = (address0, self._offset) return address0 def _read_greater(self): address0, index0 = FAILURE, self._offset cached = self._cache['greater'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 2] if chunk0 == '>=': address0 = TreeNode(self._input[self._offset:self._offset + 2], self._offset) self._offset = self._offset + 2 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'>=\'') self._cache['greater'][index0] = (address0, self._offset) return address0 def _read_less(self): address0, index0 = FAILURE, self._offset cached = self._cache['less'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 2] if chunk0 == '<=': address0 = TreeNode(self._input[self._offset:self._offset + 2], self._offset) self._offset = self._offset + 2 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'<=\'') self._cache['less'][index0] = (address0, self._offset) return address0 def _read_wildcard(self): address0, index0 = FAILURE, self._offset cached = self._cache['wildcard'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] address1 = self._read_attr() if address1 is not FAILURE: elements0.append(address1) address2 = self._read_equal() if address2 is not FAILURE: elements0.append(address2) address3 = self._read_wildcard_value() if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_wildcard(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['wildcard'][index0] = (address0, self._offset) return address0 def _read_wildcard_value(self): address0, index0 = FAILURE, self._offset cached = self._cache['wildcard_value'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] index2 = self._offset address1 = self._read_value() if address1 is FAILURE: address1 = TreeNode(self._input[index2:index2], index2) self._offset = index2 if address1 is not FAILURE: elements0.append(address1) address2 = self._read_any() if address2 is not FAILURE: elements0.append(address2) index3 = self._offset address3 = self._read_value() if address3 is FAILURE: address3 = TreeNode(self._input[index3:index3], index3) self._offset = index3 if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = TreeNode8(self._input[index1:self._offset], index1, elements0) self._offset = self._offset self._cache['wildcard_value'][index0] = (address0, self._offset) return address0 def _read_any(self): address0, index0 = FAILURE, self._offset cached = self._cache['any'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '*': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'*\'') if address1 is not FAILURE: elements0.append(address1) remaining0, index2, elements1, address3 = 0, self._offset, [], True while address3 is not FAILURE: index3, elements2 = self._offset, [] address4 = self._read_value() if address4 is not FAILURE: elements2.append(address4) chunk1 = None if self._offset < self._input_size: chunk1 = self._input[self._offset:self._offset + 1] if chunk1 == '*': address5 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address5 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'*\'') if address5 is not FAILURE: elements2.append(address5) else: elements2 = None self._offset = index3 else: elements2 = None self._offset = index3 if elements2 is None: address3 = FAILURE else: address3 = TreeNode9(self._input[index3:self._offset], index3, elements2) self._offset = self._offset if address3 is not FAILURE: elements1.append(address3) remaining0 -= 1 if remaining0 <= 0: address2 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address2 = FAILURE if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_string(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['any'][index0] = (address0, self._offset) return address0 def _read_attr(self): address0, index0 = FAILURE, self._offset cached = self._cache['attr'].get(index0) if cached: self._offset = cached[1] return cached[0] address0 = self._read_AttributeDescription() self._cache['attr'][index0] = (address0, self._offset) return address0 def _read_value(self): address0, index0 = FAILURE, self._offset cached = self._cache['value'].get(index0) if cached: self._offset = cached[1] return cached[0] remaining0, index1, elements0, address1 = 1, self._offset, [], True while address1 is not FAILURE: address1 = self._read_AttributeValue() if address1 is not FAILURE: elements0.append(address1) remaining0 -= 1 if remaining0 <= 0: address0 = self._actions.return_string(self._input, index1, self._offset, elements0) self._offset = self._offset else: address0 = FAILURE self._cache['value'][index0] = (address0, self._offset) return address0 def _read_AttributeDescription(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttributeDescription'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] address1 = self._read_AttributeType() if address1 is not FAILURE: elements0.append(address1) index2 = self._offset index3, elements1 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == ';': address3 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address3 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('";"') if address3 is not FAILURE: elements1.append(address3) address4 = self._read_options() if address4 is not FAILURE: elements1.append(address4) else: elements1 = None self._offset = index3 else: elements1 = None self._offset = index3 if elements1 is None: address2 = FAILURE else: address2 = TreeNode11(self._input[index3:self._offset], index3, elements1) self._offset = self._offset if address2 is FAILURE: address2 = TreeNode(self._input[index2:index2], index2) self._offset = index2 if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_options(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['AttributeDescription'][index0] = (address0, self._offset) return address0 def _read_AttributeOptions(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttributeOptions'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == ';': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('";"') if address1 is not FAILURE: elements0.append(address1) address2 = self._read_options() if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = TreeNode12(self._input[index1:self._offset], index1, elements0) self._offset = self._offset self._cache['AttributeOptions'][index0] = (address0, self._offset) return address0 def _read_AttributeType(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttributeType'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_LDAP_OID() if address0 is FAILURE: self._offset = index1 address0 = self._read_AttrTypeName() if address0 is FAILURE: self._offset = index1 self._cache['AttributeType'][index0] = (address0, self._offset) return address0 def _read_AttrTypeName(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttrTypeName'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] address1 = self._read_ALPHA() if address1 is not FAILURE: elements0.append(address1) remaining0, index2, elements1, address3 = 0, self._offset, [], True while address3 is not FAILURE: address3 = self._read_AttrTypeChars() if address3 is not FAILURE: elements1.append(address3) remaining0 -= 1 if remaining0 <= 0: address2 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address2 = FAILURE if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_attr_type(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['AttrTypeName'][index0] = (address0, self._offset) return address0 def _read_AttrTypeChars(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttrTypeChars'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_ALPHA() if address0 is FAILURE: self._offset = index1 address0 = self._read_DIGIT() if address0 is FAILURE: self._offset = index1 chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '-': address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('"-"') if address0 is FAILURE: self._offset = index1 self._cache['AttrTypeChars'][index0] = (address0, self._offset) return address0 def _read_LDAP_OID(self): address0, index0 = FAILURE, self._offset cached = self._cache['LDAP_OID'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] remaining0, index2, elements1, address2 = 1, self._offset, [], True while address2 is not FAILURE: address2 = self._read_DIGIT() if address2 is not FAILURE: elements1.append(address2) remaining0 -= 1 if remaining0 <= 0: address1 = TreeNode(self._input[index2:self._offset], index2, elements1) self._offset = self._offset else: address1 = FAILURE if address1 is not FAILURE: elements0.append(address1) remaining1, index3, elements2, address4 = 0, self._offset, [], True while address4 is not FAILURE: index4, elements3 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '.': address5 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address5 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('"."') if address5 is not FAILURE: elements3.append(address5) address6 = FAILURE remaining2, index5, elements4, address7 = 1, self._offset, [], True while address7 is not FAILURE: address7 = self._read_DIGIT() if address7 is not FAILURE: elements4.append(address7) remaining2 -= 1 if remaining2 <= 0: address6 = TreeNode(self._input[index5:self._offset], index5, elements4) self._offset = self._offset else: address6 = FAILURE if address6 is not FAILURE: elements3.append(address6) else: elements3 = None self._offset = index4 else: elements3 = None self._offset = index4 if elements3 is None: address4 = FAILURE else: address4 = TreeNode(self._input[index4:self._offset], index4, elements3) self._offset = self._offset if address4 is not FAILURE: elements2.append(address4) remaining1 -= 1 if remaining1 <= 0: address3 = TreeNode(self._input[index3:self._offset], index3, elements2) self._offset = self._offset else: address3 = FAILURE if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_oid_type(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['LDAP_OID'][index0] = (address0, self._offset) return address0 def _read_options(self): address0, index0 = FAILURE, self._offset cached = self._cache['options'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset index2, elements0 = self._offset, [] address1 = self._read_option() if address1 is not FAILURE: elements0.append(address1) chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == ';': address2 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address2 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('";"') if address2 is not FAILURE: elements0.append(address2) address3 = self._read_options() if address3 is not FAILURE: elements0.append(address3) else: elements0 = None self._offset = index2 else: elements0 = None self._offset = index2 else: elements0 = None self._offset = index2 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_string(self._input, index2, self._offset, elements0) self._offset = self._offset if address0 is FAILURE: self._offset = index1 address0 = self._read_option() if address0 is FAILURE: self._offset = index1 self._cache['options'][index0] = (address0, self._offset) return address0 def _read_option(self): address0, index0 = FAILURE, self._offset cached = self._cache['option'].get(index0) if cached: self._offset = cached[1] return cached[0] remaining0, index1, elements0, address1 = 1, self._offset, [], True while address1 is not FAILURE: address1 = self._read_AttrTypeChars() if address1 is not FAILURE: elements0.append(address1) remaining0 -= 1 if remaining0 <= 0: address0 = self._actions.return_string(self._input, index1, self._offset, elements0) self._offset = self._offset else: address0 = FAILURE self._cache['option'][index0] = (address0, self._offset) return address0 def _read_AttributeValue(self): address0, index0 = FAILURE, self._offset cached = self._cache['AttributeValue'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_EscapedCharacter() if address0 is FAILURE: self._offset = index1 chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_1.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[^!*\\x29]') if address0 is FAILURE: self._offset = index1 self._cache['AttributeValue'][index0] = (address0, self._offset) return address0 def _read_EscapedCharacter(self): address0, index0 = FAILURE, self._offset cached = self._cache['EscapedCharacter'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 == '\\': address1 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address1 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('\'\\\\\'') if address1 is not FAILURE: elements0.append(address1) address2 = self._read_ASCII_VALUE() if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_escaped_char(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['EscapedCharacter'][index0] = (address0, self._offset) return address0 def _read_ASCII_VALUE(self): address0, index0 = FAILURE, self._offset cached = self._cache['ASCII_VALUE'].get(index0) if cached: self._offset = cached[1] return cached[0] index1, elements0 = self._offset, [] address1 = self._read_HEX_CHAR() if address1 is not FAILURE: elements0.append(address1) address2 = self._read_HEX_CHAR() if address2 is not FAILURE: elements0.append(address2) else: elements0 = None self._offset = index1 else: elements0 = None self._offset = index1 if elements0 is None: address0 = FAILURE else: address0 = self._actions.return_hex(self._input, index1, self._offset, elements0) self._offset = self._offset self._cache['ASCII_VALUE'][index0] = (address0, self._offset) return address0 def _read_HEX_CHAR(self): address0, index0 = FAILURE, self._offset cached = self._cache['HEX_CHAR'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_2.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[a-fA-F0-9]') self._cache['HEX_CHAR'][index0] = (address0, self._offset) return address0 def _read_FILL(self): address0, index0 = FAILURE, self._offset cached = self._cache['FILL'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset address0 = self._read_SPACE() if address0 is FAILURE: self._offset = index1 address0 = self._read_TAB() if address0 is FAILURE: self._offset = index1 address0 = self._read_SEP() if address0 is FAILURE: self._offset = index1 self._cache['FILL'][index0] = (address0, self._offset) return address0 def _read_SPACE(self): address0, index0 = FAILURE, self._offset cached = self._cache['SPACE'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_3.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[\\x20]') self._cache['SPACE'][index0] = (address0, self._offset) return address0 def _read_TAB(self): address0, index0 = FAILURE, self._offset cached = self._cache['TAB'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_4.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[\\x09]') self._cache['TAB'][index0] = (address0, self._offset) return address0 def _read_DIGIT(self): address0, index0 = FAILURE, self._offset cached = self._cache['DIGIT'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_5.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[0-9]') self._cache['DIGIT'][index0] = (address0, self._offset) return address0 def _read_ALPHA(self): address0, index0 = FAILURE, self._offset cached = self._cache['ALPHA'].get(index0) if cached: self._offset = cached[1] return cached[0] chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 1] if chunk0 is not None and Grammar.REGEX_6.search(chunk0): address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('[a-zA-Z]') self._cache['ALPHA'][index0] = (address0, self._offset) return address0 def _read_SEP(self): address0, index0 = FAILURE, self._offset cached = self._cache['SEP'].get(index0) if cached: self._offset = cached[1] return cached[0] index1 = self._offset chunk0 = None if self._offset < self._input_size: chunk0 = self._input[self._offset:self._offset + 2] if chunk0 == '\r\n': address0 = TreeNode(self._input[self._offset:self._offset + 2], self._offset) self._offset = self._offset + 2 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('"\\r\\n"') if address0 is FAILURE: self._offset = index1 chunk1 = None if self._offset < self._input_size: chunk1 = self._input[self._offset:self._offset + 1] if chunk1 == '\n': address0 = TreeNode(self._input[self._offset:self._offset + 1], self._offset) self._offset = self._offset + 1 else: address0 = FAILURE if self._offset > self._failure: self._failure = self._offset self._expected = [] if self._offset == self._failure: self._expected.append('"\\n"') if address0 is FAILURE: self._offset = index1 self._cache['SEP'][index0] = (address0, self._offset) return address0 class Parser(Grammar): def __init__(self, inpt, actions, types): self._input = inpt self._input_size = len(inpt) self._actions = actions self._types = types self._offset = 0 self._cache = defaultdict(dict) self._failure = 0 self._expected = [] def parse(self): tree = self._read_root() if tree is not FAILURE and self._offset == self._input_size: return tree if not self._expected: self._failure = self._offset self._expected.append('') raise ParseError(format_error(self._input, self._failure, self._expected)) def format_error(inpt, offset, expected): lines, line_no, position = inpt.split('\n'), 0, 0 while position <= offset: position += len(lines[line_no]) + 1 line_no += 1 message, line = 'Line ' + str(line_no) + ': expected ' + ', '.join(expected) + '\n', lines[line_no - 1] message += line + '\n' position -= len(line) + 1 message += ' ' * (offset - position) return message + '^' def parse(inpt, actions=None, types=None): parser = Parser(inpt, actions, types) return parser.parse() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/ldap_filter/soundex.py0000664000175000017500000000075514531630505022037 0ustar00webdevwebdevimport re def soundex(string, scale=4): string = string.upper() code = string[0] string = re.sub(r'[AEIOUYHW]', '', string) chr_key = {'BFPV': '1', 'CGJKQSXZ': '2', 'DT': '3', 'L': '4', 'MN': '5', 'R': '6'} for c in string[1:]: for k, v in chr_key.items(): if (c in k) and (v != code[-1]): code += v break return code.ljust(scale, '0') def soundex_compare(val1, val2): return soundex(val1) == soundex(val2) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/messages.py0000664000175000017500000002557214531630505017700 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # # https://tools.ietf.org/html/rfc4511 # https://msdn.microsoft.com/en-us/library/cc223501.aspx from asn1crypto import core import enum import os TAG = 'explicit' # class UNIVERSAL = 0 APPLICATION = 1 CONTEXT = 2 #https://msdn.microsoft.com/en-us/library/cc223359.aspx class MSLDAPCapabilities(core.ObjectIdentifier): _map = { '1.2.840.113556.1.4.800' : 'LDAP_CAP_ACTIVE_DIRECTORY_OID', '1.2.840.113556.1.4.1791': 'LDAP_CAP_ACTIVE_DIRECTORY_LDAP_INTEG_OID', '1.2.840.113556.1.4.1670': 'LDAP_CAP_ACTIVE_DIRECTORY_V51_OID', '1.2.840.113556.1.4.1880': 'LDAP_CAP_ACTIVE_DIRECTORY_ADAM_DIGEST_OID', '1.2.840.113556.1.4.1851': 'LDAP_CAP_ACTIVE_DIRECTORY_ADAM_OID', '1.2.840.113556.1.4.1920': 'LDAP_CAP_ACTIVE_DIRECTORY_PARTIAL_SECRETS_OID', '1.2.840.113556.1.4.1935': 'LDAP_CAP_ACTIVE_DIRECTORY_V60_OID', '1.2.840.113556.1.4.2080': 'LDAP_CAP_ACTIVE_DIRECTORY_V61_R2_OID', '1.2.840.113556.1.4.2237': 'LDAP_CAP_ACTIVE_DIRECTORY_W8_OID', } class scope(core.Enumerated): _map = { 0 : 'baseObject', 1 : 'singleLevel', 2 : 'wholeSubtree', } class derefAliases(core.Enumerated): _map = { 0 : 'neverDerefAliases', 1 : 'derefInSearching', 2 : 'derefFindingBaseObj', 3 : 'derefAlways', } class resultCode(core.Enumerated): _map = { 0 : 'success', 1 : 'operationsError', 2 : 'protocolError', 3 : 'timeLimitExceeded', 4 : 'sizeLimitExceeded', 5 : 'compareFalse', 6 : 'compareTrue', 7 : 'authMethodNotSupported', 8 : 'strongerAuthRequired', 10 : 'referral', 11 : 'adminLimitExceeded', 12 : 'unavailableCriticalExtension', 13 : 'confidentialityRequired', 14 : 'saslBindInProgress', 16 : 'noSuchAttribute', 17 : 'undefinedAttributeType', 18 : 'inappropriateMatching', 19 : 'constraintViolation', 20 : 'attributeOrValueExists', 21 : 'invalidAttributeSyntax', 32 : 'noSuchObject', 33 : 'aliasProblem', 34 : 'invalidDNSyntax', 36 : 'aliasDereferencingProblem', 48 : 'inappropriateAuthentication', 49 : 'invalidCredentials', 50 : 'insufficientAccessRights', 51 : 'busy', 52 : 'unavailable', 53 : 'unwillingToPerform', 54 : 'loopDetect', 64 : 'namingViolation', 65 : 'objectClassViolation', 66 : 'notAllowedOnNonLeaf', 67 : 'notAllowedOnRDN', 68 : 'entryAlreadyExists', 69 : 'objectClassModsProhibited', 71 : 'affectsMultipleDSAs', 80 : 'other', } class ChangeOperation(core.Enumerated): _map = { 0 : 'add', 1 : 'delete', 2 : 'replace', } class LDAPString(core.OctetString): pass class LDAPDN(core.OctetString): pass class LDAPOID(core.OctetString): pass class URI(LDAPString): pass class Referral(core.SequenceOf): _child_spec = URI # https://www.ietf.org/rfc/rfc2696.txt class SearchControlValue(core.Sequence): _fields = [ ('size' , core.Integer), ('cookie' , core.OctetString) ] class Control(core.Sequence): _fields = [ ('controlType', LDAPOID), ('criticality', core.Boolean, {'default' : False }), ('controlValue', core.OctetString, {'optional': True }) , ] class Controls(core.SequenceOf): _child_spec = Control class SaslCredentials(core.Sequence): _fields = [ ('mechanism', core.OctetString), ('credentials', core.OctetString, {'optional': True}), ] class SicilyPackageDiscovery(core.OctetString): pass class SicilyNegotiate(core.OctetString): pass class SicilyResponse(core.OctetString): pass class AuthenticationChoice(core.Choice): _alternatives = [ ('simple', core.OctetString, {'implicit': (CONTEXT, 0)}), ('sasl', SaslCredentials, {'implicit': (CONTEXT, 3)}), ('sicily_disco', SicilyPackageDiscovery, {'implicit': (CONTEXT, 9)}), # FUCK ('sicily_nego', SicilyNegotiate, {'implicit': (CONTEXT, 10)}), #YOU ('sicily_resp', SicilyResponse, {'implicit': (CONTEXT, 11)}), #MICROSOFT ] class BindRequest(core.Sequence): _fields = [ ('version', core.Integer), ('name', core.OctetString), ('authentication', AuthenticationChoice), ] class BindResponse(core.Sequence): _fields = [ ('resultCode', resultCode), ('matchedDN', LDAPDN), ('diagnosticMessage', LDAPString), ('referral', Referral, {'optional': True}), ('serverSaslCreds', core.OctetString, {'implicit': (CONTEXT, 7), 'optional': True}), ] class AttributeDescription(LDAPString): pass class AttributeValue(core.OctetString): pass class MatchingRuleId(LDAPString): pass class AssertionValue(core.OctetString): pass class AttributeValueAssertion(core.Sequence): _fields = [ ('attributeDesc', AttributeDescription), ('assertionValue', AssertionValue), ] class Substring(core.Choice): _alternatives = [ ('initial', AssertionValue, {'implicit': (CONTEXT , 0) } ), ('any', AssertionValue, {'implicit': (CONTEXT , 1) } ), ('final', AssertionValue, {'implicit': (CONTEXT , 2) } ), ] class Substrings(core.SequenceOf): _child_spec = Substring class SubstringFilter(core.Sequence): _fields = [ ('type', AttributeDescription), ('substrings', Substrings), ] class MatchingRuleAssertion(core.Sequence): _fields = [ ('matchingRule', MatchingRuleId, {'implicit': (CONTEXT, 1), 'optional' : True} ), ('type', AttributeDescription, {'implicit': (CONTEXT, 2), 'optional' : True} ), ('matchValue', AssertionValue, {'implicit': (CONTEXT, 3)} ), ('dnAttributes', core.Boolean, {'implicit': (CONTEXT, 4), 'default' : False} ), ] # keep this Filter definition here! It is needed because filter class contains itself! class Filter(core.Choice): pass class Filters(core.SequenceOf): _child_spec = Filter Filter._alternatives = [ ('and', Filters, {'implicit': (CONTEXT , 0) } ), ('or', Filters, {'implicit': (CONTEXT , 1) } ), ('not', Filter, {'explicit': (CONTEXT , 2) } ), # https://tools.ietf.org/html/rfc4511#section-4.5.1.8 ('equalityMatch', AttributeValueAssertion, {'implicit': (CONTEXT , 3) } ), ('substrings', SubstringFilter, {'implicit': (CONTEXT , 4) } ), ('greaterOrEqual', AttributeValueAssertion, {'implicit': (CONTEXT , 5) } ), ('lessOrEqual', AttributeValueAssertion, {'implicit': (CONTEXT , 6) } ), ('present', AttributeDescription, {'implicit': (CONTEXT , 7) } ), ('approxMatch', AttributeValueAssertion, {'implicit': (CONTEXT , 8) } ), ('extensibleMatch', MatchingRuleAssertion, {'implicit': (CONTEXT , 9) } ), ] class AttributeSelection(core.SequenceOf): _child_spec = LDAPString class SearchRequest(core.Sequence): _fields = [ ('baseObject', LDAPDN), ('scope', scope), ('derefAliases', derefAliases), ('sizeLimit', core.Integer), ('timeLimit', core.Integer), ('typesOnly', core.Boolean), ('filter', Filter), ('attributes', AttributeSelection), ] class AttributeValueSet(core.SetOf): _child_spec = AttributeValue class PartialAttribute(core.Sequence): _fields = [ ('type', AttributeDescription), ('attributes', AttributeValueSet), ] class PartialAttributeList(core.SequenceOf): _child_spec = PartialAttribute class SearchResultEntry(core.Sequence): _fields = [ ('objectName', LDAPDN), ('attributes', PartialAttributeList), ] class SearchResultReference(core.SequenceOf): _child_spec = URI class UnbindRequest(core.Null): pass class LDAPResult(core.Sequence): _fields = [ ('resultCode', resultCode ), ('matchedDN', LDAPDN), ('diagnosticMessage', LDAPString), ('referral', Referral, {'implicit': (CONTEXT, 3), 'optional': True}), ] class SearchResultDone(LDAPResult): pass class Change(core.Sequence): _fields = [ ('operation', ChangeOperation), ('modification', PartialAttribute), ] class Changes(core.SequenceOf): _child_spec = Change class ModifyRequest(core.Sequence): _fields = [ ('object', LDAPDN), ('changes', Changes), ] class ModifyResponse(LDAPResult): pass class Attribute(PartialAttribute): pass class AttributeList(core.SequenceOf): _child_spec = Attribute class AddRequest(core.Sequence): _fields = [ ('entry', LDAPDN), ('attributes', AttributeList), ] class AddResponse(LDAPResult): pass class DelRequest(LDAPDN): pass class DelResponse(LDAPResult): pass class RelativeLDAPDN(LDAPString): pass class ModifyDNRequest(core.Sequence): _fields = [ ('entry', LDAPDN), ('newrdn', RelativeLDAPDN), ('deleteoldrdn', core.Boolean), ('deleteoldrdn', LDAPDN), ('newSuperior', LDAPDN, {'optional': True}), ] class ModifyDNResponse(LDAPResult): pass class CompareRequest(core.Sequence): _fields = [ ('entry', LDAPDN), ('ava', AttributeValueAssertion), ] class CompareResponse(LDAPResult): pass class ExtendedRequest(core.Sequence): _fields = [ ('requestName', LDAPOID, {'implicit': (CONTEXT , 0) }), ('requestValue', core.OctetString, {'implicit': (CONTEXT , 1), 'optional' : True}), ] class ExtendedResponse(core.Sequence): _fields = [ ('resultCode', resultCode ), ('matchedDN', LDAPDN), ('diagnosticMessage', LDAPString), ('referral', Referral, {'implicit': (CONTEXT, 3), 'optional': True}), ('responseName', LDAPOID, {'implicit': (CONTEXT , 10) , 'optional' : True}), ('responseValue', core.OctetString, {'implicit': (CONTEXT , 11) , 'optional' : True}), ] class IntermediateResponse(core.Sequence): _fields = [ ('responseName', LDAPOID, {'implicit': (CONTEXT , 0) , 'optional' : True}), ('responseValue', core.OctetString, {'implicit': (CONTEXT , 1) , 'optional' : True}), ] class protocolOp(core.Choice): _alternatives = [ ('bindRequest', BindRequest, {'implicit': (APPLICATION , 0) } ), ('bindResponse', BindResponse, {'implicit': (APPLICATION , 1) } ), ('unbindRequest', UnbindRequest, {'implicit': (APPLICATION,2) } ), ('searchRequest', SearchRequest, {'implicit': (APPLICATION,3) } ), ('searchResEntry', SearchResultEntry, {'implicit': (APPLICATION,4) } ), ('searchResDone', SearchResultDone, {'implicit': (APPLICATION,5) } ), ('modifyRequest', ModifyRequest, {'implicit': (APPLICATION,6) } ), ('modifyResponse', ModifyResponse, {'implicit': (APPLICATION,7) } ), ('addRequest', AddRequest, {'implicit': (APPLICATION,8) } ), ('addResponse', AddResponse, {'implicit': (APPLICATION,9) } ), ('delRequest', DelRequest, {'implicit': (APPLICATION,10) } ), ('delResponse', DelResponse, {'implicit': (APPLICATION,11) } ), ('modDNRequest', ModifyDNRequest, {'implicit': (APPLICATION,12) } ), ('modDNResponse', ModifyDNResponse, {'implicit': (APPLICATION,13) } ), ('compareRequest', CompareRequest, {'implicit': (APPLICATION,14) } ), ('compareResponse', CompareResponse, {'implicit': (APPLICATION,15) } ), ('abandonRequest', core.Integer, {'implicit': (APPLICATION,16) } ), #integer is the messageid to abandon ('searchResRef', SearchResultReference, {'implicit': (APPLICATION,19) } ), ('extendedReq', ExtendedRequest, {'implicit': (APPLICATION,23) } ), ('extendedResp', ExtendedResponse, {'implicit': (APPLICATION,24) } ), ('intermResponse', IntermediateResponse, {'implicit': (APPLICATION,25) } ), ] class LDAPMessage(core.Sequence): _fields = [ ('messageID', core.Integer), ('protocolOp', protocolOp), ('controls', Controls, {'implicit': (CONTEXT, 0), 'optional': True}), ] ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/query.py0000664000175000017500000000533414531630505017230 0ustar00webdevwebdevfrom .ldap_filter import Filter as LF from .ldap_filter.filter import LDAPBase from asn1crypto.core import ObjectIdentifier from msldap.protocol.messages import Filter, Filters, \ AttributeDescription, SubstringFilter, MatchingRuleAssertion, \ Substrings, Substring def equality(attr, value): if attr[-1] == ':': name, oid_raw = attr[:-1].split(':') return Filter({ 'extensibleMatch' : MatchingRuleAssertion({ 'matchingRule' : oid_raw.encode(), 'type' : name.encode(), 'matchValue' : value.encode(), 'dnAttributes' : False }) }) elif value == '*': return Filter({ 'present' : AttributeDescription(attr.encode()) }) elif value.startswith('*') and value.endswith('*'): return Filter({ 'substrings' : SubstringFilter({ 'type' : attr.encode(), 'substrings' : Substrings([ Substring({ 'any' : value[1:-1].encode() }) ]) }) }) elif value.startswith('*') is True: return Filter({ 'substrings' : SubstringFilter({ 'type' : attr.encode(), 'substrings' : Substrings([ Substring({ 'final' : value[1:].encode() }) ]) }) }) elif value.endswith('*') is True: return Filter({ 'substrings' : SubstringFilter({ 'type' : attr.encode(), 'substrings' : Substrings([ Substring({ 'initial' : value[:-1].encode() }) ]) }) }) else: return Filter({ 'equalityMatch' : { 'attributeDesc' : attr.encode(), 'assertionValue' : value.encode() } }) def query_syntax_converter_inner(ftr): if ftr.type == 'filter': if ftr.comp == '=': return equality(ftr.attr, ftr.val) elif ftr.comp == '<=': key = 'lessOrEqual' elif ftr.comp == '>=': key = 'greaterOrEqual' elif ftr.comp == '~=': key = 'approxMatch' return Filter({ key : { 'attributeDesc' : ftr.attr.encode(), 'assertionValue' : ftr.val.encode() } }) elif ftr.type == 'group': if ftr.comp == '&' or ftr.comp == '|': if ftr.comp == '&': key = 'and' elif ftr.comp == '|': key = 'or' #x = [query_syntax_converter_inner(f) for f in ftr.filters] return Filter({ key : Filters([query_syntax_converter_inner(f) for f in ftr.filters]) }) elif ftr.comp == '!': return Filter({ #'not' : Filter(ftr.filters[0]) 'not' : query_syntax_converter_inner(ftr.filters[0]) }) def query_syntax_converter(ldap_query_string): """ Converts and LDAP query string into a ASN1 Filter object. warning: the parser has a name collision with the asn1 strucutre! """ flt = LF.parse(ldap_query_string) return query_syntax_converter_inner(flt) def escape_filter_chars(text): return LDAPBase.escape(text)././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701813305.0 msldap-0.5.9/msldap/protocol/typeconversion.py0000664000175000017500000020276214533716071021163 0ustar00webdevwebdevimport datetime import re from winacl.dtyp.sid import SID from winacl.dtyp.guid import GUID from winacl.dtyp.security_descriptor import SECURITY_DESCRIPTOR from msldap import logger from msldap.protocol.messages import Attribute, Change, PartialAttribute from msldap.wintypes.managedpassword import MSDS_MANAGEDPASSWORD_BLOB MSLDAP_DT_WIN_EPOCH = datetime.datetime(1601, 1, 1) #this regex and the function that uses it is from ldap3 time_format = re.compile( r''' ^ (?P[0-9]{4}) (?P0[1-9]|1[0-2]) (?P0[1-9]|[12][0-9]|3[01]) (?P[01][0-9]|2[0-3]) (?: (?P[0-5][0-9]) (?P[0-5][0-9]|60)? )? (?: [.,] (?P[0-9]+) )? (?: Z | (?: (?P[+-]) (?P[01][0-9]|2[0-3]) (?P[0-5][0-9])? ) ) $ ''', re.VERBOSE ) def bytes2timedelta(x, encode = False): return int2timedelta([int.from_bytes(x[0], byteorder='little', signed=True)], encode=encode) def int2timedelta(x, encode = False): if encode is False: x = int(x[0]) if x == '-9223372036854775808': return datetime.timedelta.max return datetime.timedelta(microseconds=(x / 10.)) raise NotImplementedError() ###### NEW FUNCTIONS def single_utf16le(x, encode = False): if encode is False: return x[0].decode('utf-16-le') return [x.encode('utf-16-le')] def single_interval(x, encode = False): if encode is False: x = int(x[0]) if x == 9223372036854775807: return datetime.datetime.max.replace(tzinfo=datetime.timezone.utc) us = x / 10. try: return (MSLDAP_DT_WIN_EPOCH + datetime.timedelta(microseconds=us)).replace(tzinfo=datetime.timezone.utc) except: return MSLDAP_DT_WIN_EPOCH raise NotImplementedError() def x2gmsa(x, encode = False): if encode is False: return MSDS_MANAGEDPASSWORD_BLOB.from_bytes(x[0]) raise NotImplementedError() def single_sid(x, encode = False): if encode is False: return str(SID.from_bytes(x[0])) return [SID.from_string(x).to_bytes()] def single_str(x, encode = False, encoding = 'utf-8'): if encode is False: return x[0].decode(encoding) return [x.encode(encoding)] def single_bytes(x, encode = False): if encode is False: return x[0] return [x] def single_int(x, encode = False): if encode is False: return int(x[0]) return [str(x).encode()] def single_bool(x, encode = False, encoding = 'utf-8'): if encode is False: x = x[0].decode(encoding) if x == 'FALSE': return False return True return [b'TRUE' if x is True else b'FALSE'] def single_guid(x, encode = False): if encode is False: return str(GUID.from_bytes(x[0])) return [GUID.from_string(x).to_bytes()] def single_sd(x, encode = False): if encode is False: return SECURITY_DESCRIPTOR.from_bytes(x[0]) return [x.to_bytes()] def single_date(x, encode = False, encoding = 'utf-8'): if encode is False: try: x = x[0].decode(encoding) match = time_format.fullmatch(x) if match is None: return x matches = match.groupdict() offset = datetime.timedelta( hours=int(matches['OffHour'] or 0), minutes=int(matches['OffMinute'] or 0) ) if matches['Offset'] == '-': offset *= -1 # Python does not support leap second in datetime (!) if matches['Second'] == '60': matches['Second'] = '59' # According to RFC, fraction may be applied to an Hour/Minute (!) fraction = float('0.' + (matches['Fraction'] or '0')) if matches['Minute'] is None: fraction *= 60 minute = int(fraction) fraction -= minute else: minute = int(matches['Minute']) if matches['Second'] is None: fraction *= 60 second = int(fraction) fraction -= second else: second = int(matches['Second']) microseconds = int(fraction * 1000000) return datetime.datetime( int(matches['Year']), int(matches['Month']), int(matches['Day']), int(matches['Hour']), minute, second, microseconds, datetime.timezone(offset), ) except Exception: # exceptions should be investigated, anyway the formatter return the raw_value pass return x raise NotImplementedError() def multi_date(x, encode = False): if encode is False: res = [] for a in x: res.append(single_date((a, None))) return res if isinstance(x, list) is False: x = [x] raise NotImplementedError() def multi_int(x, encode = False): if encode is False: return [int(e) for e in x ] if isinstance(x, list) is False: x = [x] return [str(k).encode() for k in x] def multi_str(x, encode = False, encoding = 'utf-8'): if encode is False: return [e.decode(encoding) for e in x ] if isinstance(x, list) is False: x = [x] return [line.encode(encoding) for line in x] def multi_sid(x, encode = False): if encode is False: t = [] for s in x: t.append(str(SID.from_bytes(s))) return t if isinstance(x, list) is False: x = [x] return [SID.from_string(k).to_bytes() for k in x] def multi_interval(x, encode = False): if encode is False: t = [] for s in x: t.append(single_interval(s)) return t if isinstance(x, list) is False: x = [x] raise NotImplementedError() def multi_sid(x, encode = False): if encode is False: t = [] for s in x: t.append(str(SID.from_bytes(s))) return t if isinstance(x, list) is False: x = [x] return [SID.from_string(k).to_bytes() for k in x] def multi_bytes(x, encode=False): if encode is False: return x if isinstance(x, list) is False: x = [x] return x def multi_bool(x, encode=False): if encode is False: return [single_bool([r]) for r in x] if isinstance(x, list) is False: x = [x] return [single_bool(r)[0] for r in x] def multi_sd(x, encode=False): if encode is False: return [single_sd([r] for r in x)] if isinstance(x, list) is False: x = [x] return [single_sd(r)[0] for r in x] MSLDAP_BUILTIN_ATTRIBUTE_TYPES = { 'supportedCapabilities' : multi_str, 'serverName' : single_str, 'ldapServiceName': single_str, 'dnsHostName' : single_str, 'supportedSASLMechanisms' : multi_str, 'supportedLDAPPolicies' : multi_str, 'supportedLDAPVersion' : multi_int, 'supportedControl' : multi_str, 'rootDomainNamingContext' : single_str, 'configurationNamingContext' : single_str, 'schemaIDGUID' : single_guid, 'lDAPDisplayName' : single_str, 'schemaNamingContext' : single_str, 'defaultNamingContext' : single_str, 'adminDescription' : single_str, 'adminDisplayName' : single_str, 'namingContexts' : multi_str, 'dsServiceName' : single_str, 'subschemaSubentry' : single_str, 'distinguishedName' : single_str, 'objectCategory' : single_str, 'userPrincipalName' : single_str, 'sAMAccountType' : single_int, 'sAMAccountName' : single_str, 'logonCount' : single_int, 'accountExpires' : single_interval, 'objectSid' : single_sid, 'primaryGroupID' : single_int, 'pwdLastSet' : single_interval, 'lastLogon' : single_interval, 'lastLogoff' : single_interval, 'lastLogonTimestamp' : single_interval, 'badPasswordTime' : single_interval, 'countryCode' : single_int, 'codePage' : single_int, 'badPwdCount' : single_int, 'userAccountControl' : single_int, 'objectGUID' : single_guid, 'name' : single_str, 'displayName' : single_str, 'whenChanged' : single_date, 'whenCreated' : single_date, 'distinguishedName' : single_str, 'givenName' : single_str, 'cn' : single_str, 'objectClass' : multi_str, 'dc' : single_str, 'msDS-Behavior-Version' : single_int, 'masteredBy' : single_str, 'systemFlags' : single_int, 'rIDManagerReference' : single_str, 'auditingPolicy' : single_bytes, 'uASCompat' : single_int, 'serverState' : single_int, 'nextRid' : single_int, 'minPwdLength' : single_int, 'minPwdAge' : int2timedelta, 'lockoutThreshold' : single_int, 'lockOutObservationWindow' : single_int, 'lockoutDuration' : single_int, 'forceLogoff' : int2timedelta, 'creationTime' : single_interval, 'maxPwdAge' : int2timedelta, 'pwdHistoryLength' : single_int, 'pwdProperties' : single_int, 'uSNChanged' : single_int, 'uSNCreated' : single_int, 'instanceType' : single_int, 'memberOf' : multi_str, 'description' : single_str, 'servicePrincipalName' : multi_str, 'sn' : single_str, 'initials' : single_str, #'nTSecurityDescriptor' : x2sd, 'nTSecurityDescriptor' : single_bytes, 'tokenGroups' : multi_sid, 'localPolicyFlags' : single_int, 'msDS-SupportedEncryptionTypes' : single_int, 'isCriticalSystemObject' : single_bool, 'dNSHostName' : single_str, 'operatingSystemVersion' : single_str, 'operatingSystem' : single_str, 'ou' : single_str, 'showInAdvancedViewOnly' : single_bool, 'gPLink' : single_str, 'gPCFileSysPath' : single_str, 'flags' : single_int, 'versionNumber' : single_int, 'gPCFunctionalityVersion' : single_int, 'gPCMachineExtensionNames' : multi_str, 'gPCUserExtensionNames' : multi_str, 'groupType' : single_int, 'member' : multi_str, 'adminCount' : single_int, 'msDS-AllowedToDelegateTo' : multi_str, 'dSCorePropagationData' : single_date, 'trustDirection' : single_int, 'trustType' : single_int, 'trustAttributes' : single_int, 'flatName' : single_str, 'trustPosixOffset' : single_int, 'trustPartner' : single_str, 'securityIdentifier' : single_bytes, 'unicodePwd' : single_str, 'ms-Mcs-AdmPwd' : single_str, 'msLAPS-EncryptedPassword': single_bytes, 'msLAPS-EncryptedPasswordHistory': multi_bytes, 'msLAPS-EncryptedDSRMPassword': single_bytes, 'msLAPS-EncryptedDSRMPasswordHistory': multi_bytes, 'msLAPS-Password': single_str, 'msLAPS-PasswordExpirationTime': single_interval, 'msDS-AllowedToActOnBehalfOfOtherIdentity': single_bytes, 'msLAPS-Encrypted-Password-Attributes': single_bytes, 'cACertificate': single_bytes, 'certificateTemplates': multi_str, 'cACertificateDN': single_str, 'msPKI-Enrollment-Servers': multi_str, # it's actually a 5-part multi string split by '\n' 'revision' : single_int, 'pKIKeyUsage' : single_bytes, 'pKIDefaultKeySpec' : single_str, 'pKIMaxIssuingDepth' : single_int, 'pKICriticalExtensions' : single_str, 'pKIExpirationPeriod' : bytes2timedelta, 'pKIOverlapPeriod' : bytes2timedelta, 'pKIExtendedKeyUsage' : multi_str, 'msPKI-RA-Signature' : single_int, 'msPKI-Enrollment-Flag' : single_int, 'msPKI-Private-Key-Flag' : single_int, 'msPKI-Certificate-Name-Flag' : single_int, 'msPKI-Minimal-Key-Size' : single_int, 'msPKI-Template-Schema-Version': single_int, 'msPKI-Template-Minor-Revision': single_int, 'msPKI-Cert-Template-OID' : single_str, 'msPKI-Certificate-Application-Policy' : multi_str, 'msPKI-RA-Application-Policies' : multi_str, #I'm guessing here 'msDS-ManagedPassword' : x2gmsa, 'msDS-GroupMSAMembership' : single_sd, 'isSingleValued' : single_bool, 'attributeSyntax' : single_str, #na 'isMemberOfPartialAttributeSet' : single_bool, #na 'attributeID': single_str, #na 'gidNumber' : single_int, 'msds-additionaldnshostname' : multi_str, } MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC = { #'objectClass' : multi_str, #'sn' : single_str, #'gidNumber' : single_int, 'unicodePwd' : single_utf16le, #'lockoutTime' : single_int, #'sAMAccountName' : single_str, #'userAccountControl' : single_int, #'displayName' : single_str, #'userPrincipalName' : single_str, #'servicePrincipalName' : multi_str, #'msds-additionaldnshostname' : multi_str, #'gPCMachineExtensionNames' : multi_str, #'gPCUserExtensionNames' : multi_str, #'versionNumber' : single_int, #'member' : multi_str, 'msDS-AllowedToActOnBehalfOfOtherIdentity' : single_bytes, 'nTSecurityDescriptor' : single_bytes, #'msPKI-Certificate-Name-Flag' : single_int } def encode_attributes(x): """converts a dict to attributelist""" res = [] for k in x: lookup_table = None if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC elif k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES else: raise Exception('Unknown conversion type for key "%s"' % k) res.append(Attribute({ 'type' : k.encode(), 'attributes' : lookup_table[k](x[k], True) })) return res def convert_attributes(x): t = {} for e in x: #print(e) k = e['type'].decode() #print('k: %s' % k) if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: t[k] = MSLDAP_BUILTIN_ATTRIBUTE_TYPES[k](e['attributes'], False) elif k in LDAP_WELL_KNOWN_ATTRS: t[k] = LDAP_WELL_KNOWN_ATTRS[k](e['attributes'], False) else: logger.debug('Unknown type! %s data: %s' % (k, e['attributes'])) t[k] = e['attributes'] return t def convert_result(x): #print(x) #import traceback #traceback.print_stack() return { 'objectName' : x['objectName'].decode(), 'attributes' : convert_attributes(x['attributes']) } def encode_changes(x): logger.debug('Encode changes: %s' % x) res = [] for k in x: lookup_table = None if k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES_ENC elif k in MSLDAP_BUILTIN_ATTRIBUTE_TYPES: lookup_table = MSLDAP_BUILTIN_ATTRIBUTE_TYPES else: raise Exception('Unknown conversion type for key "%s"' % k) for mod, value in x[k]: res.append(Change({ 'operation' : mod, 'modification' : PartialAttribute({ 'type' : k.encode(), 'attributes' : lookup_table[k](value, True) }) })) #print(lookup_table[k](value, True)) return res LDAP_WELL_KNOWN_ATTRS = { "accountExpires" : single_int, "accountNameHistory" : multi_str, "aCSAggregateTokenRatePerUser" : single_int, "aCSAllocableRSVPBandwidth" : single_int, "aCSCacheTimeout" : single_int, "aCSDirection" : single_int, "aCSDSBMDeadTime" : single_int, "aCSDSBMPriority" : single_int, "aCSDSBMRefresh" : single_int, "aCSEnableACSService" : single_bool, "aCSEnableRSVPAccounting" : single_bool, "aCSEnableRSVPMessageLogging" : single_bool, "aCSEventLogLevel" : single_int, "aCSIdentityName" : multi_str, "aCSMaxAggregatePeakRatePerUser" : single_int, "aCSMaxDurationPerFlow" : single_int, "aCSMaxNoOfAccountFiles" : single_int, "aCSMaxNoOfLogFiles" : single_int, "aCSMaxPeakBandwidth" : single_int, "aCSMaxPeakBandwidthPerFlow" : single_int, "aCSMaxSizeOfRSVPAccountFile" : single_int, "aCSMaxSizeOfRSVPLogFile" : single_int, "aCSMaxTokenBucketPerFlow" : single_int, "aCSMaxTokenRatePerFlow" : single_int, "aCSMaximumSDUSize" : single_int, "aCSMinimumDelayVariation" : single_int, "aCSMinimumLatency" : single_int, "aCSMinimumPolicedSize" : single_int, "aCSNonReservedMaxSDUSize" : single_int, "aCSNonReservedMinPolicedSize" : single_int, "aCSNonReservedPeakRate" : single_int, "aCSNonReservedTokenSize" : single_int, "aCSNonReservedTxLimit" : single_int, "aCSNonReservedTxSize" : single_int, "aCSPermissionBits" : single_int, "aCSPolicyName" : single_str, "aCSPriority" : single_int, "aCSRSVPAccountFilesLocation" : single_str, "aCSRSVPLogFilesLocation" : single_str, "aCSServerList" : multi_str, "aCSServiceType" : single_int, "aCSTimeOfDay" : single_str, "aCSTotalNoOfFlows" : single_int, "notes" : single_str, "additionalTrustedServiceNames" : multi_str, "streetAddress" : single_str, "addressBookRoots" : multi_str, "addressBookRoots2" : multi_str, "addressEntryDisplayTable" : single_bytes, "addressEntryDisplayTableMSDOS" : single_bytes, "homePostalAddress" : single_str, "addressSyntax" : single_bytes, "addressType" : single_str, "adminContextMenu" : multi_str, "adminCount" : single_int, "adminDescription" : single_str, "adminDisplayName" : single_str, "adminMultiselectPropertyPages" : multi_str, "adminPropertyPages" : multi_str, "allowedAttributes" : multi_str, "allowedAttributesEffective" : multi_str, "allowedChildClasses" : multi_str, "allowedChildClassesEffective" : multi_str, "altSecurityIdentities" : multi_str, "aNR" : single_str, "appSchemaVersion" : single_int, "applicationName" : single_str, "appliesTo" : multi_str, "assetNumber" : single_str, "assistant" : single_str, "assocNTAccount" : single_bytes, "associatedDomain" : multi_str, "associatedName" : multi_str, "attributeDisplayNames" : multi_str, "attributeID" : single_str, "attributeSecurityGUID" : single_bytes, "attributeSyntax" : single_str, "attributeTypes" : multi_str, "attributeCertificateAttribute" : multi_bytes, "audio" : multi_bytes, "auditingPolicy" : single_bytes, "authenticationOptions" : single_int, "authorityRevocationList" : multi_bytes, "auxiliaryClass" : multi_str, "badPasswordTime" : single_int, "badPwdCount" : single_int, "birthLocation" : single_bytes, "bootFile" : multi_str, "bootParameter" : multi_str, "bridgeheadServerListBL" : multi_str, "bridgeheadTransportList" : multi_str, "buildingName" : multi_str, "builtinCreationTime" : single_int, "builtinModifiedCount" : single_int, "businessCategory" : multi_str, "bytesPerMinute" : single_int, "cACertificate" : multi_bytes, "cACertificateDN" : single_str, "cAConnect" : single_str, "cAUsages" : multi_str, "cAWEBURL" : single_str, "canUpgradeScript" : multi_str, "canonicalName" : multi_str, "carLicense" : multi_str, "catalogs" : multi_str, "categories" : multi_str, "categoryId" : single_bytes, "certificateAuthorityObject" : single_str, "certificateRevocationList" : single_bytes, "certificateTemplates" : multi_str, "classDisplayName" : multi_str, "codePage" : single_int, "cOMClassID" : multi_str, "cOMCLSID" : single_str, "cOMInterfaceID" : multi_str, "cOMOtherProgId" : multi_str, "cOMProgID" : multi_str, "cOMTreatAsClassId" : single_str, "cOMTypelibId" : multi_str, "cOMUniqueLIBID" : single_str, "info" : single_str, "cn" : single_str, "company" : single_str, "contentIndexingAllowed" : single_bool, "contextMenu" : multi_str, "controlAccessRights" : multi_bytes, "cost" : single_int, "countryCode" : single_int, "c" : single_str, "createDialog" : single_str, "createTimeStamp" : single_date, "createWizardExt" : multi_str, "creationTime" : single_int, "creationWizard" : single_str, "creator" : single_str, "cRLObject" : single_str, "cRLPartitionedRevocationList" : single_bytes, "crossCertificatePair" : multi_bytes, "currMachineId" : single_bytes, "currentLocation" : single_bytes, "currentParentCA" : multi_str, "currentValue" : single_bytes, "dBCSPwd" : single_bytes, "defaultClassStore" : multi_str, "defaultGroup" : single_str, "defaultHidingValue" : single_bool, "defaultLocalPolicyObject" : single_str, "defaultObjectCategory" : single_str, "defaultPriority" : single_int, "defaultSecurityDescriptor" : single_str, "deltaRevocationList" : multi_bytes, "department" : single_str, "departmentNumber" : multi_str, "description" : multi_str, "desktopProfile" : single_str, "destinationIndicator" : multi_str, "dhcpClasses" : multi_bytes, "dhcpFlags" : single_int, "dhcpIdentification" : single_str, "dhcpMask" : multi_str, "dhcpMaxKey" : single_int, "dhcpObjDescription" : single_str, "dhcpObjName" : single_str, "dhcpOptions" : multi_bytes, "dhcpProperties" : multi_bytes, "dhcpRanges" : multi_str, "dhcpReservations" : multi_str, "dhcpServers" : multi_str, "dhcpSites" : multi_str, "dhcpState" : multi_str, "dhcpSubnets" : multi_str, "dhcpType" : single_int, "dhcpUniqueKey" : single_int, "dhcpUpdateTime" : single_int, "displayName" : single_str, "displayNamePrintable" : single_str, "dITContentRules" : multi_str, "division" : single_str, "dMDLocation" : single_str, "dmdName" : single_str, "dNReferenceUpdate" : multi_str, "dnsAllowDynamic" : single_bool, "dnsAllowXFR" : single_bool, "dNSHostName" : single_str, "dnsNotifySecondaries" : multi_int, "dNSProperty" : multi_bytes, "dnsRecord" : multi_bytes, "dnsRoot" : multi_str, "dnsSecureSecondaries" : multi_int, "dNSTombstoned" : single_bool, "documentAuthor" : multi_str, "documentIdentifier" : multi_str, "documentLocation" : multi_str, "documentPublisher" : multi_str, "documentTitle" : multi_str, "documentVersion" : multi_str, "domainCAs" : multi_str, "dc" : single_str, "domainCrossRef" : single_str, "domainID" : single_str, "domainIdentifier" : single_int, "domainPolicyObject" : single_str, "domainPolicyReference" : single_str, "domainReplica" : single_str, "domainWidePolicy" : multi_bytes, "drink" : multi_str, "driverName" : single_str, "driverVersion" : single_int, "dSCorePropagationData" : multi_date, "dSHeuristics" : single_str, "dSUIAdminMaximum" : single_int, "dSUIAdminNotification" : multi_str, "dSUIShellMaximum" : single_int, "dSASignature" : single_bytes, "dynamicLDAPServer" : single_str, "mail" : single_str, "eFSPolicy" : multi_bytes, "employeeID" : single_str, "employeeNumber" : single_str, "employeeType" : single_str, "Enabled" : single_bool, "enabledConnection" : single_bool, "enrollmentProviders" : single_str, "entryTTL" : single_int, "extendedAttributeInfo" : multi_str, "extendedCharsAllowed" : single_bool, "extendedClassInfo" : multi_str, "extensionName" : multi_str, "extraColumns" : multi_str, "facsimileTelephoneNumber" : single_str, "fileExtPriority" : multi_str, "flags" : single_int, "flatName" : single_str, "forceLogoff" : single_int, "foreignIdentifier" : single_bytes, "friendlyNames" : multi_str, "fromEntry" : multi_bool, "fromServer" : single_str, "frsComputerReference" : single_str, "frsComputerReferenceBL" : multi_str, "fRSControlDataCreation" : single_str, "fRSControlInboundBacklog" : single_str, "fRSControlOutboundBacklog" : single_str, "fRSDirectoryFilter" : single_str, "fRSDSPoll" : single_int, "fRSExtensions" : single_bytes, "fRSFaultCondition" : single_str, "fRSFileFilter" : single_str, "fRSFlags" : single_int, "fRSLevelLimit" : single_int, "fRSMemberReference" : single_str, "fRSMemberReferenceBL" : multi_str, "fRSPartnerAuthLevel" : single_int, "fRSPrimaryMember" : single_str, "fRSReplicaSetGUID" : single_bytes, "fRSReplicaSetType" : single_int, "fRSRootPath" : single_str, "fRSRootSecurity" : single_sd, "fRSServiceCommand" : single_str, "fRSServiceCommandStatus" : single_str, "fRSStagingPath" : single_str, "fRSTimeLastCommand" : single_date, "fRSTimeLastConfigChange" : single_date, "fRSUpdateTimeout" : single_int, "fRSVersion" : single_str, "fRSVersionGUID" : single_bytes, "fRSWorkingPath" : single_str, "fSMORoleOwner" : single_str, "garbageCollPeriod" : single_int, "gecos" : single_str, "generatedConnection" : single_bool, "generationQualifier" : single_str, "gidNumber" : single_int, "givenName" : single_str, "globalAddressList" : multi_str, "globalAddressList2" : multi_str, "governsID" : single_str, "gPLink" : single_str, "gPOptions" : single_int, "gPCFileSysPath" : single_str, "gPCFunctionalityVersion" : single_int, "gPCMachineExtensionNames" : single_str, "gPCUserExtensionNames" : single_str, "gPCWQLFilter" : single_str, "groupAttributes" : single_int, "groupMembershipSAM" : single_bytes, "groupPriority" : multi_str, "groupType" : single_int, "groupsToIgnore" : multi_str, "hasMasterNCs" : multi_str, "hasPartialReplicaNCs" : multi_str, "helpData16" : single_bytes, "helpData32" : single_bytes, "helpFileName" : single_str, "hideFromAB" : single_bool, "homeDirectory" : single_str, "homeDrive" : single_str, "host" : multi_str, "houseIdentifier" : multi_str, "iconPath" : multi_str, "implementedCategories" : multi_bytes, "indexedScopes" : multi_str, "initialAuthIncoming" : single_str, "initialAuthOutgoing" : single_str, "initials" : single_str, "installUiLevel" : single_int, "instanceType" : single_int, "interSiteTopologyFailover" : single_int, "interSiteTopologyGenerator" : single_str, "interSiteTopologyRenew" : single_int, "internationalISDNNumber" : multi_str, "invocationId" : single_bytes, "ipHostNumber" : multi_str, "ipNetmaskNumber" : single_str, "ipNetworkNumber" : single_str, "ipProtocolNumber" : single_int, "ipsecData" : single_bytes, "ipsecDataType" : single_int, "ipsecFilterReference" : multi_str, "ipsecID" : single_str, "ipsecISAKMPReference" : single_str, "ipsecName" : single_str, "iPSECNegotiationPolicyAction" : single_str, "ipsecNegotiationPolicyReference" : single_str, "iPSECNegotiationPolicyType" : single_str, "ipsecNFAReference" : multi_str, "ipsecOwnersReference" : multi_str, "ipsecPolicyReference" : single_str, "ipServicePort" : single_int, "ipServiceProtocol" : multi_str, "isCriticalSystemObject" : single_bool, "isDefunct" : single_bool, "isDeleted" : single_bool, "isEphemeral" : single_bool, "memberOf" : multi_str, "isMemberOfPartialAttributeSet" : single_bool, "isPrivilegeHolder" : multi_str, "isRecycled" : single_bool, "isSingleValued" : single_bool, "jpegPhoto" : multi_bytes, "keywords" : multi_str, "knowledgeInformation" : multi_str, "labeledURI" : multi_str, "lastBackupRestorationTime" : single_int, "lastContentIndexed" : single_int, "lastKnownParent" : single_str, "lastLogoff" : single_int, "lastLogon" : single_int, "lastLogonTimestamp" : single_int, "lastSetTime" : single_int, "lastUpdateSequence" : single_str, "lDAPAdminLimits" : multi_str, "lDAPDisplayName" : single_str, "lDAPIPDenyList" : multi_bytes, "legacyExchangeDN" : single_str, "linkID" : single_int, "linkTrackSecret" : single_bytes, "lmPwdHistory" : multi_bytes, "localPolicyFlags" : single_int, "localPolicyReference" : single_str, "localeID" : multi_int, "l" : single_str, "localizationDisplayId" : single_int, "localizedDescription" : multi_str, "location" : single_str, "lockOutObservationWindow" : single_int, "lockoutDuration" : single_int, "lockoutThreshold" : single_int, "lockoutTime" : single_int, "loginShell" : single_str, "thumbnailLogo" : single_bytes, "logonCount" : single_int, "logonHours" : single_bytes, "logonWorkstation" : single_bytes, "lSACreationTime" : single_int, "lSAModifiedCount" : single_int, "macAddress" : multi_str, "machineArchitecture" : multi_int, "machinePasswordChangeInterval" : single_int, "machineRole" : single_int, "machineWidePolicy" : multi_bytes, "managedBy" : single_str, "managedObjects" : multi_str, "manager" : single_str, "mAPIID" : single_int, "marshalledInterface" : multi_bytes, "masteredBy" : multi_str, "maxPwdAge" : single_int, "maxRenewAge" : single_int, "maxStorage" : single_int, "maxTicketAge" : single_int, "mayContain" : multi_str, "meetingAdvertiseScope" : single_str, "meetingApplication" : multi_str, "meetingBandwidth" : multi_int, "meetingBlob" : single_bytes, "meetingContactInfo" : single_str, "meetingDescription" : single_str, "meetingEndTime" : multi_date, "meetingID" : single_str, "meetingIP" : single_str, "meetingIsEncrypted" : single_str, "meetingKeyword" : multi_str, "meetingLanguage" : multi_str, "meetingLocation" : multi_str, "meetingMaxParticipants" : single_int, "meetingName" : single_str, "meetingOriginator" : single_str, "meetingOwner" : single_str, "meetingProtocol" : multi_str, "meetingRating" : multi_str, "meetingRecurrence" : single_str, "meetingScope" : multi_str, "meetingStartTime" : multi_date, "meetingType" : single_str, "meetingURL" : multi_str, "member" : multi_str, "memberNisNetgroup" : multi_str, "memberUid" : multi_str, "mhsORAddress" : multi_str, "minPwdAge" : single_int, "minPwdLength" : single_int, "minTicketAge" : single_int, "modifiedCount" : single_int, "modifiedCountAtLastProm" : single_int, "modifyTimeStamp" : single_date, "moniker" : multi_bytes, "monikerDisplayName" : multi_str, "moveTreeState" : multi_bytes, "msAuthz-CentralAccessPolicyID" : single_sid, "msAuthz-EffectiveSecurityPolicy" : single_str, "msAuthz-LastEffectiveSecurityPolicy" : single_str, "msAuthz-MemberRulesInCentralAccessPolicy" : multi_str, "msAuthz-MemberRulesInCentralAccessPolicyBL" : multi_str, "msAuthz-ProposedSecurityPolicy" : single_str, "msAuthz-ResourceCondition" : single_str, "msCOM-DefaultPartitionLink" : single_str, "msCOM-ObjectId" : single_bytes, "msCOM-PartitionLink" : multi_str, "msCOM-PartitionSetLink" : multi_str, "msCOM-UserLink" : multi_str, "msCOM-UserPartitionSetLink" : single_str, "msDFS-Commentv2" : single_str, "msDFS-GenerationGUIDv2" : single_bytes, "msDFS-LastModifiedv2" : single_date, "msDFS-LinkIdentityGUIDv2" : single_bytes, "msDFS-LinkPathv2" : single_str, "msDFS-LinkSecurityDescriptorv2" : single_sd, "msDFS-NamespaceIdentityGUIDv2" : single_bytes, "msDFS-Propertiesv2" : multi_str, "msDFS-SchemaMajorVersion" : single_int, "msDFS-SchemaMinorVersion" : single_int, "msDFS-ShortNameLinkPathv2" : single_str, "msDFS-TargetListv2" : single_bytes, "msDFS-Ttlv2" : single_int, "msDFSR-CachePolicy" : single_int, "msDFSR-CommonStagingPath" : single_str, "msDFSR-CommonStagingSizeInMb" : single_int, "msDFSR-ComputerReference" : single_str, "msDFSR-ComputerReferenceBL" : multi_str, "msDFSR-ConflictPath" : single_str, "msDFSR-ConflictSizeInMb" : single_int, "msDFSR-ContentSetGuid" : single_bytes, "msDFSR-DefaultCompressionExclusionFilter" : single_str, "msDFSR-DeletedPath" : single_str, "msDFSR-DeletedSizeInMb" : single_int, "msDFSR-DfsLinkTarget" : single_str, "msDFSR-DfsPath" : single_str, "msDFSR-DirectoryFilter" : single_str, "msDFSR-DisablePacketPrivacy" : single_bool, "msDFSR-Enabled" : single_bool, "msDFSR-Extension" : single_bytes, "msDFSR-FileFilter" : single_str, "msDFSR-Flags" : single_int, "msDFSR-Keywords" : single_str, "msDFSR-MaxAgeInCacheInMin" : single_int, "msDFSR-MemberReference" : single_str, "msDFSR-MemberReferenceBL" : multi_str, "msDFSR-MinDurationCacheInMin" : single_int, "msDFSR-OnDemandExclusionDirectoryFilter" : single_str, "msDFSR-OnDemandExclusionFileFilter" : single_str, "msDFSR-Options" : single_int, "msDFSR-Options2" : single_int, "msDFSR-Priority" : single_int, "msDFSR-RdcEnabled" : single_bool, "msDFSR-RdcMinFileSizeInKb" : single_int, "msDFSR-ReadOnly" : single_bool, "msDFSR-ReplicationGroupGuid" : single_bytes, "msDFSR-ReplicationGroupType" : single_int, "msDFSR-RootFence" : single_int, "msDFSR-RootPath" : single_str, "msDFSR-RootSizeInMb" : single_int, "msDFSR-Schedule" : single_bytes, "msDFSR-StagingCleanupTriggerInPercent" : single_int, "msDFSR-StagingPath" : single_str, "msDFSR-StagingSizeInMb" : single_int, "msDFSR-TombstoneExpiryInMin" : single_int, "msDFSR-Version" : single_str, "msDNS-DNSKEYRecordSetTTL" : single_int, "msDNS-DNSKEYRecords" : multi_bytes, "msDNS-DSRecordAlgorithms" : single_int, "msDNS-DSRecordSetTTL" : single_int, "msDNS-IsSigned" : single_bool, "msDNS-KeymasterZones" : multi_str, "msDNS-MaintainTrustAnchor" : single_int, "msDNS-NSEC3CurrentSalt" : single_str, "msDNS-NSEC3HashAlgorithm" : single_int, "msDNS-NSEC3Iterations" : single_int, "msDNS-NSEC3OptOut" : single_bool, "msDNS-NSEC3RandomSaltLength" : single_int, "msDNS-NSEC3UserSalt" : single_str, "msDNS-ParentHasSecureDelegation" : single_bool, "msDNS-PropagationTime" : single_int, "msDNS-RFC5011KeyRollovers" : single_bool, "msDNS-SecureDelegationPollingPeriod" : single_int, "msDNS-SignWithNSEC3" : single_bool, "msDNS-SignatureInceptionOffset" : single_int, "msDNS-SigningKeyDescriptors" : multi_bytes, "msDNS-SigningKeys" : multi_bytes, "msDRM-IdentityCertificate" : multi_bytes, "msDS-AdditionalDnsHostName" : multi_str, "msDS-AdditionalSamAccountName" : multi_str, "msDS-AllUsersTrustQuota" : single_int, "msDS-AllowedDNSSuffixes" : multi_str, "msDS-AllowedToActOnBehalfOfOtherIdentity" : single_sd, "msDS-AllowedToDelegateTo" : multi_str, "msDS-AppliesToResourceTypes" : multi_str, "msDS-Approx-Immed-Subordinates" : single_int, "msDS-ApproximateLastLogonTimeStamp" : single_int, "msDS-AssignedAuthNPolicy" : single_str, "msDS-AssignedAuthNPolicyBL" : multi_str, "msDS-AssignedAuthNPolicySilo" : single_str, "msDS-AssignedAuthNPolicySiloBL" : multi_str, "msDS-AuthenticatedAtDC" : multi_str, "msDS-AuthenticatedToAccountlist" : multi_str, "msDS-AuthNPolicyEnforced" : single_bool, "msDS-AuthNPolicySiloEnforced" : single_bool, "msDS-AuthNPolicySiloMembers" : multi_str, "msDS-AuthNPolicySiloMembersBL" : multi_str, "msDS-Auxiliary-Classes" : multi_str, "msDS-AzApplicationData" : single_str, "msDS-AzApplicationName" : single_str, "msDS-AzApplicationVersion" : single_str, "msDS-AzBizRule" : single_str, "msDS-AzBizRuleLanguage" : single_str, "msDS-AzClassId" : single_str, "msDS-AzDomainTimeout" : single_int, "msDS-AzGenerateAudits" : single_bool, "msDS-AzGenericData" : single_str, "msDS-AzLastImportedBizRulePath" : single_str, "msDS-AzLDAPQuery" : single_str, "msDS-AzMajorVersion" : single_int, "msDS-AzMinorVersion" : single_int, "msDS-AzObjectGuid" : single_bytes, "msDS-AzOperationID" : single_int, "msDS-AzScopeName" : single_str, "msDS-AzScriptEngineCacheMax" : single_int, "msDS-AzScriptTimeout" : single_int, "msDS-AzTaskIsRoleDefinition" : single_bool, "msDS-Behavior-Version" : single_int, "msDS-BridgeHeadServersUsed" : multi_str, "msDS-ByteArray" : multi_bytes, "msDS-Cached-Membership" : single_bytes, "msDS-Cached-Membership-Time-Stamp" : single_int, "msDS-ClaimAttributeSource" : single_str, "msDS-ClaimIsSingleValued" : single_bool, "msDS-ClaimIsValueSpaceRestricted" : single_bool, "msDS-ClaimPossibleValues" : single_str, "msDS-ClaimSharesPossibleValuesWith" : single_str, "msDS-ClaimSharesPossibleValuesWithBL" : multi_str, "msDS-ClaimSource" : single_str, "msDS-ClaimSourceType" : single_str, "msDS-ClaimTypeAppliesToClass" : multi_str, "msDS-ClaimValueType" : single_int, "msDS-CloudAnchor" : single_bytes, "msDS-CloudIsEnabled" : single_bool, "msDS-CloudIsManaged" : single_bool, "msDS-CloudIssuerPublicCertificates" : multi_bytes, "msDS-cloudExtensionAttribute1" : single_str, "msDS-cloudExtensionAttribute10" : single_str, "msDS-cloudExtensionAttribute11" : single_str, "msDS-cloudExtensionAttribute12" : single_str, "msDS-cloudExtensionAttribute13" : single_str, "msDS-cloudExtensionAttribute14" : single_str, "msDS-cloudExtensionAttribute15" : single_str, "msDS-cloudExtensionAttribute16" : single_str, "msDS-cloudExtensionAttribute17" : single_str, "msDS-cloudExtensionAttribute18" : single_str, "msDS-cloudExtensionAttribute19" : single_str, "msDS-cloudExtensionAttribute2" : single_str, "msDS-cloudExtensionAttribute20" : single_str, "msDS-cloudExtensionAttribute3" : single_str, "msDS-cloudExtensionAttribute4" : single_str, "msDS-cloudExtensionAttribute5" : single_str, "msDS-cloudExtensionAttribute6" : single_str, "msDS-cloudExtensionAttribute7" : single_str, "msDS-cloudExtensionAttribute8" : single_str, "msDS-cloudExtensionAttribute9" : single_str, "msDS-ComputerAllowedToAuthenticateTo" : single_bytes, "msDS-ComputerAuthNPolicy" : single_str, "msDS-ComputerAuthNPolicyBL" : multi_str, "msDS-ComputerSID" : single_sid, "msDS-ComputerTGTLifetime" : single_int, "mS-DS-ConsistencyChildCount" : single_int, "mS-DS-ConsistencyGuid" : single_bytes, "mS-DS-CreatorSID" : single_sid, "msDS-CustomKeyInformation" : single_bytes, "msDS-DateTime" : multi_date, "msDS-DefaultQuota" : single_int, "msDS-DeletedObjectLifetime" : single_int, "msDS-DeviceDN" : single_str, "msDS-DeviceID" : single_bytes, "msDS-DeviceLocation" : single_str, "msDS-DeviceMDMStatus" : single_str, "msDS-DeviceObjectVersion" : single_int, "msDS-DeviceOSType" : single_str, "msDS-DeviceOSVersion" : single_str, "msDS-DevicePhysicalIDs" : multi_str, "msDS-DeviceTrustType" : single_int, "msDS-DnsRootAlias" : single_str, "msDS-DrsFarmID" : single_str, "msDS-EgressClaimsTransformationPolicy" : single_str, "msDS-EnabledFeature" : multi_str, "msDS-EnabledFeatureBL" : multi_str, "msDS-Entry-Time-To-Die" : single_date, "msDS-ExecuteScriptPassword" : single_bytes, "msDS-ExpirePasswordsOnSmartCardOnlyAccounts" : single_bool, "msDS-ExternalDirectoryObjectId" : single_str, "msDS-ExternalKey" : multi_str, "msDS-ExternalStore" : multi_str, "msDS-FailedInteractiveLogonCount" : single_int, "msDS-FailedInteractiveLogonCountAtLastSuccessfulLogon" : single_int, "msDS-FilterContainers" : multi_str, "msDS-GenerationId" : single_bytes, "msDS-GeoCoordinatesAltitude" : single_int, "msDS-GeoCoordinatesLatitude" : single_int, "msDS-GeoCoordinatesLongitude" : single_int, "msDS-GroupMSAMembership" : single_sd, "msDS-HABSeniorityIndex" : single_int, "msDS-HasDomainNCs" : multi_str, "msDS-hasFullReplicaNCs" : multi_str, "msDS-HasInstantiatedNCs" : multi_str, "msDS-hasMasterNCs" : multi_str, "msDS-HostServiceAccount" : multi_str, "msDS-HostServiceAccountBL" : multi_str, "msDS-IngressClaimsTransformationPolicy" : single_str, "msDS-Integer" : multi_int, "msDS-IntId" : single_int, "msDS-IsCompliant" : single_bool, "msDS-IsDomainFor" : multi_str, "msDS-IsEnabled" : single_bool, "msDS-IsFullReplicaFor" : multi_str, "msds-memberOfTransitive" : multi_str, "msDS-IsPartialReplicaFor" : multi_str, "msDS-IsPossibleValuesPresent" : single_bool, "msDS-IsPrimaryComputerFor" : multi_str, "msDS-IsUsedAsResourceSecurityAttribute" : single_bool, "msDS-IsUserCachableAtRodc" : single_int, "msDS-isGC" : single_bool, "msDS-IsManaged" : single_bool, "msDS-isRODC" : single_bool, "msDS-IssuerCertificates" : multi_bytes, "msDS-IssuerPublicCertificates" : multi_bytes, "msDS-KeyApproximateLastLogonTimeStamp" : single_int, "msDS-KeyCredentialLink" : multi_str, "msDS-KeyCredentialLink-BL" : multi_str, "msDS-KeyId" : single_bytes, "msDS-KeyMaterial" : single_bytes, "msDS-KeyPrincipal" : single_str, "msDS-KeyPrincipalBL" : multi_str, "msDS-KeyUsage" : single_str, "msDS-KeyVersionNumber" : single_int, "msDS-KrbTgtLink" : single_str, "msDS-KrbTgtLinkBl" : multi_str, "msDS-LastFailedInteractiveLogonTime" : single_int, "msDS-LastKnownRDN" : single_str, "msDS-LastSuccessfulInteractiveLogonTime" : single_int, "msDS-LocalEffectiveDeletionTime" : single_date, "msDS-LocalEffectiveRecycleTime" : single_date, "msDS-LockoutDuration" : single_int, "msDS-LockoutObservationWindow" : single_int, "msDS-LockoutThreshold" : single_int, "msDS-LogonTimeSyncInterval" : single_int, "ms-DS-MachineAccountQuota" : single_int, "msDS-ManagedPassword" : single_bytes, "msDS-ManagedPasswordId" : single_bytes, "msDS-ManagedPasswordInterval" : single_int, "msDS-ManagedPasswordPreviousId" : single_bytes, "msDs-masteredBy" : multi_str, "msDs-MaxValues" : single_int, "msDS-MaximumPasswordAge" : single_int, "msDS-MaximumRegistrationInactivityPeriod" : single_int, "msds-memberTransitive" : multi_str, "msDS-MembersForAzRole" : multi_str, "msDS-MembersForAzRoleBL" : multi_str, "msDS-MembersOfResourcePropertyList" : multi_str, "msDS-MembersOfResourcePropertyListBL" : multi_str, "msDS-MinimumPasswordAge" : single_int, "msDS-MinimumPasswordLength" : single_int, "msDS-NCReplCursors" : multi_str, "msDS-NCReplInboundNeighbors" : multi_str, "msDS-NCReplOutboundNeighbors" : multi_str, "msDS-NC-Replica-Locations" : multi_str, "msDS-NC-RO-Replica-Locations" : multi_str, "msDS-NC-RO-Replica-Locations-BL" : multi_str, "msDS-NcType" : single_int, "msDS-NeverRevealGroup" : multi_str, "msDS-NonMembers" : multi_str, "msDS-NonMembersBL" : multi_str, "msDS-Non-Security-Group-Extra-Classes" : multi_str, "msDS-ObjectReference" : multi_str, "msDS-ObjectReferenceBL" : multi_str, "msDS-ObjectSoa" : single_str, "msDS-OIDToGroupLink" : single_str, "msDS-OIDToGroupLinkBl" : multi_str, "msDS-OperationsForAzRole" : multi_str, "msDS-OperationsForAzRoleBL" : multi_str, "msDS-OperationsForAzTask" : multi_str, "msDS-OperationsForAzTaskBL" : multi_str, "msDS-OptionalFeatureFlags" : single_int, "msDS-OptionalFeatureGUID" : single_bytes, "msDS-Other-Settings" : multi_str, "msDS-parentdistname" : single_str, "msDS-PasswordComplexityEnabled" : single_bool, "msDS-PasswordHistoryLength" : single_int, "msDS-PasswordReversibleEncryptionEnabled" : single_bool, "msDS-PasswordSettingsPrecedence" : single_int, "msDS-PerUserTrustQuota" : single_int, "msDS-PerUserTrustTombstonesQuota" : single_int, "msDS-PhoneticCompanyName" : single_str, "msDS-PhoneticDepartment" : single_str, "msDS-PhoneticDisplayName" : single_str, "msDS-PhoneticFirstName" : single_str, "msDS-PhoneticLastName" : single_str, "msDS-preferredDataLocation" : single_str, "msDS-Preferred-GC-Site" : single_str, "msDS-PrimaryComputer" : multi_str, "msDS-PrincipalName" : single_str, "msDS-PromotionSettings" : single_str, "msDS-PSOApplied" : multi_str, "msDS-PSOAppliesTo" : multi_str, "msDS-QuotaAmount" : single_int, "msDS-QuotaEffective" : single_int, "msDS-QuotaTrustee" : single_sid, "msDS-QuotaUsed" : single_int, "msDS-RegisteredOwner" : single_bytes, "msDS-RegisteredUsers" : multi_bytes, "msDS-RegistrationQuota" : single_int, "msDS-ReplAttributeMetaData" : multi_str, "msDS-ReplValueMetaData" : multi_str, "msDS-ReplValueMetaDataExt" : multi_str, "mS-DS-ReplicatesNCReason" : multi_str, "msDS-Replication-Notify-First-DSA-Delay" : single_int, "msDS-Replication-Notify-Subsequent-DSA-Delay" : single_int, "msDS-ReplicationEpoch" : single_int, "msDS-RequiredDomainBehaviorVersion" : single_int, "msDS-RequiredForestBehaviorVersion" : single_int, "msDS-ResultantPSO" : single_str, "msDS-RetiredReplNCSignatures" : single_bytes, "msDS-RevealOnDemandGroup" : multi_str, "msDS-RevealedDSAs" : multi_str, "msDS-RevealedList" : multi_str, "msDS-RevealedListBL" : multi_str, "msDS-RevealedUsers" : multi_str, "msDS-RIDPoolAllocationEnabled" : single_bool, "msDs-Schema-Extensions" : multi_bytes, "msDS-SDReferenceDomain" : single_str, "msDS-SecondaryKrbTgtNumber" : single_int, "msDS-Security-Group-Extra-Classes" : multi_str, "msDS-ServiceAllowedNTLMNetworkAuthentication" : single_bool, "msDS-ServiceAllowedToAuthenticateFrom" : single_bytes, "msDS-ServiceAllowedToAuthenticateTo" : single_bytes, "msDS-ServiceAuthNPolicy" : single_str, "msDS-ServiceAuthNPolicyBL" : multi_str, "msDS-ServiceTGTLifetime" : single_int, "msDS-Settings" : multi_str, "msDS-ShadowPrincipalSid" : single_sid, "msDS-Site-Affinity" : multi_bytes, "msDS-SiteName" : single_str, "msDS-SourceAnchor" : single_str, "msDS-SourceObjectDN" : single_str, "msDS-SPNSuffixes" : multi_str, "msDS-StrongNTLMPolicy" : single_int, "msDS-SupportedEncryptionTypes" : single_int, "msDS-SyncServerUrl" : multi_str, "msDS-TasksForAzRole" : multi_str, "msDS-TasksForAzRoleBL" : multi_str, "msDS-TasksForAzTask" : multi_str, "msDS-TasksForAzTaskBL" : multi_str, "msDS-TDOEgressBL" : multi_str, "msDS-TDOIngressBL" : multi_str, "msds-tokenGroupNames" : multi_str, "msds-tokenGroupNamesGlobalAndUniversal" : multi_str, "msds-tokenGroupNamesNoGCAcceptable" : multi_str, "msDS-TombstoneQuotaFactor" : single_int, "msDS-TopQuotaUsage" : multi_str, "msDS-TransformationRules" : single_str, "msDS-TransformationRulesCompiled" : single_bytes, "msDS-TrustForestTrustInfo" : single_bytes, "msDS-UpdateScript" : single_str, "msDS-User-Account-Control-Computed" : single_int, "msDS-UserAllowedNTLMNetworkAuthentication" : single_bool, "msDS-UserAllowedToAuthenticateFrom" : single_bytes, "msDS-UserAllowedToAuthenticateTo" : single_bytes, "msDS-UserAuthNPolicy" : single_str, "msDS-UserAuthNPolicyBL" : multi_str, "msDS-UserPasswordExpiryTimeComputed" : single_int, "msDS-UserTGTLifetime" : single_int, "msDS-USNLastSyncSuccess" : single_int, "msDS-ValueTypeReference" : single_str, "msDS-ValueTypeReferenceBL" : multi_str, "msExchAssistantName" : single_str, "msExchHouseIdentifier" : single_str, "msExchLabeledURI" : multi_str, "ownerBL" : multi_str, "msFRS-Hub-Member" : single_str, "msFRS-Topology-Pref" : single_str, "msFVE-KeyPackage" : single_bytes, "msFVE-RecoveryGuid" : single_bytes, "msFVE-RecoveryPassword" : single_str, "msFVE-VolumeGuid" : single_bytes, "msieee80211-Data" : single_bytes, "msieee80211-DataType" : single_int, "msieee80211-ID" : single_str, "msIIS-FTPDir" : single_str, "msIIS-FTPRoot" : single_str, "msImaging-HashAlgorithm" : single_str, "msImaging-PSPIdentifier" : single_bytes, "msImaging-PSPString" : single_str, "msImaging-ThumbprintHash" : single_bytes, "msKds-CreateTime" : single_int, "msKds-DomainID" : single_str, "msKds-KDFAlgorithmID" : single_str, "msKds-KDFParam" : single_bytes, "msKds-PrivateKeyLength" : single_int, "msKds-PublicKeyLength" : single_int, "msKds-RootKeyData" : single_bytes, "msKds-SecretAgreementAlgorithmID" : single_str, "msKds-SecretAgreementParam" : single_bytes, "msKds-UseStartTime" : single_int, "msKds-Version" : single_int, "ms-Mcs-AdmPwd" : single_str, "ms-Mcs-AdmPwdExpirationTime" : single_int, "ms-net-ieee-80211-GP-PolicyData" : single_str, "ms-net-ieee-80211-GP-PolicyGUID" : single_str, "ms-net-ieee-80211-GP-PolicyReserved" : single_bytes, "ms-net-ieee-8023-GP-PolicyData" : single_str, "ms-net-ieee-8023-GP-PolicyGUID" : single_str, "ms-net-ieee-8023-GP-PolicyReserved" : single_bytes, "msPKIAccountCredentials" : multi_str, "msPKI-Cert-Template-OID" : single_str, "msPKI-Certificate-Application-Policy" : multi_str, "msPKI-Certificate-Name-Flag" : single_int, "msPKI-Certificate-Policy" : multi_str, "msPKI-CredentialRoamingTokens" : multi_str, "msPKIDPAPIMasterKeys" : multi_str, "msPKI-Enrollment-Flag" : single_int, "msPKI-Enrollment-Servers" : multi_str, "msPKI-Minimal-Key-Size" : single_int, "msPKI-OID-Attribute" : single_int, "msPKI-OID-CPS" : multi_str, "msPKI-OIDLocalizedName" : multi_str, "msPKI-OID-User-Notice" : multi_str, "msPKI-Private-Key-Flag" : single_int, "msPKI-RA-Application-Policies" : multi_str, "msPKI-RA-Policies" : multi_str, "msPKI-RA-Signature" : single_int, "msPKIRoamingTimeStamp" : single_bytes, "msPKI-Site-Name" : single_str, "msPKI-Supersede-Templates" : multi_str, "msPKI-Template-Minor-Revision" : single_int, "msPKI-Template-Schema-Version" : single_int, "msRADIUS-FramedInterfaceId" : single_str, "msRADIUS-FramedIpv6Prefix" : single_str, "msRADIUS-FramedIpv6Route" : multi_str, "msRADIUS-SavedFramedInterfaceId" : single_str, "msRADIUS-SavedFramedIpv6Prefix" : single_str, "msRADIUS-SavedFramedIpv6Route" : multi_str, "msRRASAttribute" : multi_str, "msRRASVendorAttributeEntry" : multi_str, "msSPP-ConfigLicense" : single_bytes, "msSPP-ConfirmationId" : single_str, "msSPP-CSVLKPartialProductKey" : single_str, "msSPP-CSVLKPid" : single_str, "msSPP-CSVLKSkuId" : single_bytes, "msSPP-InstallationId" : single_str, "msSPP-IssuanceLicense" : single_bytes, "msSPP-KMSIds" : multi_bytes, "msSPP-OnlineLicense" : single_bytes, "msSPP-PhoneLicense" : single_bytes, "mS-SQL-Alias" : single_str, "mS-SQL-AllowAnonymousSubscription" : single_bool, "mS-SQL-AllowImmediateUpdatingSubscription" : single_bool, "mS-SQL-AllowKnownPullSubscription" : single_bool, "mS-SQL-AllowQueuedUpdatingSubscription" : single_bool, "mS-SQL-AllowSnapshotFilesFTPDownloading" : single_bool, "mS-SQL-AppleTalk" : single_str, "mS-SQL-Applications" : multi_str, "mS-SQL-Build" : single_int, "mS-SQL-CharacterSet" : single_int, "mS-SQL-Clustered" : single_bool, "mS-SQL-ConnectionURL" : single_str, "mS-SQL-Contact" : single_str, "mS-SQL-CreationDate" : single_str, "mS-SQL-Database" : single_str, "mS-SQL-Description" : single_str, "mS-SQL-GPSHeight" : single_str, "mS-SQL-GPSLatitude" : single_str, "mS-SQL-GPSLongitude" : single_str, "mS-SQL-InformationDirectory" : single_bool, "mS-SQL-InformationURL" : single_str, "mS-SQL-Keywords" : multi_str, "mS-SQL-Language" : single_str, "mS-SQL-LastBackupDate" : single_str, "mS-SQL-LastDiagnosticDate" : single_str, "mS-SQL-LastUpdatedDate" : single_str, "mS-SQL-Location" : single_str, "mS-SQL-Memory" : single_int, "mS-SQL-MultiProtocol" : single_str, "mS-SQL-Name" : single_str, "mS-SQL-NamedPipe" : single_str, "mS-SQL-PublicationURL" : single_str, "mS-SQL-Publisher" : single_str, "mS-SQL-RegisteredOwner" : single_str, "mS-SQL-ServiceAccount" : single_str, "mS-SQL-Size" : single_int, "mS-SQL-SortOrder" : single_str, "mS-SQL-SPX" : single_str, "mS-SQL-Status" : single_int, "mS-SQL-TCPIP" : single_str, "mS-SQL-ThirdParty" : single_bool, "mS-SQL-Type" : single_str, "mS-SQL-UnicodeSortOrder" : single_int, "mS-SQL-Version" : single_str, "mS-SQL-Vines" : single_str, "msTAPI-ConferenceBlob" : single_bytes, "msTAPI-IpAddress" : multi_str, "msTAPI-ProtocolId" : single_str, "msTAPI-uid" : single_str, "msTPM-OwnerInformationTemp" : single_str, "msTPM-OwnerInformation" : single_str, "msTPM-SrkPubThumbprint" : single_bytes, "msTPM-TpmInformationForComputer" : single_str, "msTPM-TpmInformationForComputerBL" : multi_str, "msTSAllowLogon" : single_bool, "msTSBrokenConnectionAction" : single_bool, "msTSConnectClientDrives" : single_bool, "msTSConnectPrinterDrives" : single_bool, "msTSDefaultToMainPrinter" : single_bool, "msTSEndpointData" : single_str, "msTSEndpointPlugin" : single_str, "msTSEndpointType" : single_int, "msTSExpireDate" : single_date, "msTSExpireDate2" : single_date, "msTSExpireDate3" : single_date, "msTSExpireDate4" : single_date, "msTSHomeDirectory" : single_str, "msTSHomeDrive" : single_str, "msTSInitialProgram" : single_str, "msTSLicenseVersion" : single_str, "msTSLicenseVersion2" : single_str, "msTSLicenseVersion3" : single_str, "msTSLicenseVersion4" : single_str, "msTSManagingLS" : single_str, "msTSManagingLS2" : single_str, "msTSManagingLS3" : single_str, "msTSManagingLS4" : single_str, "msTSMaxConnectionTime" : single_int, "msTSMaxDisconnectionTime" : single_int, "msTSMaxIdleTime" : single_int, "msTSPrimaryDesktop" : single_str, "msTSPrimaryDesktopBL" : multi_str, "msTSProfilePath" : single_str, "msTSProperty01" : multi_str, "msTSProperty02" : multi_str, "msTSReconnectionAction" : single_bool, "msTSRemoteControl" : single_int, "msTSSecondaryDesktopBL" : multi_str, "msTSSecondaryDesktops" : multi_str, "msTSWorkDirectory" : single_str, "msTSLSProperty01" : multi_str, "msTSLSProperty02" : multi_str, "msWMI-Author" : single_str, "msWMI-ChangeDate" : single_str, "msWMI-Class" : single_str, "msWMI-ClassDefinition" : single_str, "msWMI-CreationDate" : single_str, "msWMI-Genus" : single_int, "msWMI-ID" : single_str, "msWMI-Int8Default" : single_int, "msWMI-Int8Max" : single_int, "msWMI-Int8Min" : single_int, "msWMI-Int8ValidValues" : multi_int, "msWMI-IntDefault" : single_int, "msWMI-intFlags1" : single_int, "msWMI-intFlags2" : single_int, "msWMI-intFlags3" : single_int, "msWMI-intFlags4" : single_int, "msWMI-IntMax" : single_int, "msWMI-IntMin" : single_int, "msWMI-IntValidValues" : multi_int, "msWMI-Mof" : single_str, "msWMI-Name" : single_str, "msWMI-NormalizedClass" : multi_str, "msWMI-Parm1" : single_str, "msWMI-Parm2" : single_str, "msWMI-Parm3" : single_str, "msWMI-Parm4" : single_str, "msWMI-PropertyName" : single_str, "msWMI-Query" : single_str, "msWMI-QueryLanguage" : single_str, "msWMI-ScopeGuid" : single_str, "msWMI-SourceOrganization" : single_str, "msWMI-StringDefault" : single_str, "msWMI-StringValidValues" : multi_str, "msWMI-TargetClass" : single_str, "msWMI-TargetNameSpace" : single_str, "msWMI-TargetObject" : multi_bytes, "msWMI-TargetPath" : single_str, "msWMI-TargetType" : single_str, "mscopeId" : single_str, "msiFileList" : multi_str, "msiScript" : single_bytes, "msiScriptName" : single_str, "msiScriptPath" : single_str, "msiScriptSize" : single_int, "mSMQAuthenticate" : single_bool, "mSMQBasePriority" : single_int, "mSMQComputerType" : single_str, "mSMQComputerTypeEx" : single_str, "mSMQCost" : single_int, "mSMQCSPName" : single_str, "mSMQDependentClientService" : single_bool, "mSMQDependentClientServices" : single_bool, "mSMQDigests" : multi_bytes, "mSMQDigestsMig" : multi_bytes, "mSMQDsService" : single_bool, "mSMQDsServices" : single_bool, "mSMQEncryptKey" : single_bytes, "mSMQForeign" : single_bool, "mSMQInRoutingServers" : multi_str, "mSMQInterval1" : single_int, "mSMQInterval2" : single_int, "mSMQJournal" : single_bool, "mSMQJournalQuota" : single_int, "mSMQLabel" : single_str, "mSMQLabelEx" : single_str, "mSMQLongLived" : single_int, "mSMQMigrated" : single_bool, "MSMQ-MulticastAddress" : single_str, "mSMQNameStyle" : single_bool, "mSMQNt4Flags" : single_int, "mSMQNt4Stub" : multi_int, "mSMQOSType" : single_int, "mSMQOutRoutingServers" : multi_str, "mSMQOwnerID" : single_bytes, "mSMQPrevSiteGates" : multi_str, "mSMQPrivacyLevel" : single_int, "mSMQQMID" : single_bytes, "mSMQQueueJournalQuota" : single_int, "mSMQQueueNameExt" : single_str, "mSMQQueueQuota" : single_int, "mSMQQueueType" : single_bytes, "mSMQQuota" : single_int, "msMQ-Recipient-FormatName" : single_str, "mSMQRoutingService" : single_bool, "mSMQRoutingServices" : single_bool, "MSMQ-SecuredSource" : single_bool, "mSMQServiceType" : single_int, "mSMQServices" : single_int, "mSMQSignCertificates" : single_bytes, "mSMQSignCertificatesMig" : single_bytes, "mSMQSignKey" : single_bytes, "mSMQSite1" : single_str, "mSMQSite2" : single_str, "mSMQSiteForeign" : multi_bool, "mSMQSiteGates" : multi_str, "mSMQSiteGatesMig" : multi_str, "mSMQSiteID" : single_bytes, "mSMQSiteName" : single_str, "mSMQSiteNameEx" : single_str, "mSMQSites" : multi_bytes, "mSMQTransactional" : single_bool, "mSMQUserSid" : single_bytes, "mSMQVersion" : single_int, "msNPAllowDialin" : single_bool, "msNPCalledStationID" : multi_str, "msNPCallingStationID" : multi_str, "msNPSavedCallingStationID" : multi_str, "msRADIUSCallbackNumber" : single_str, "msRADIUSFramedIPAddress" : single_int, "msRADIUSFramedRoute" : multi_str, "msRADIUSServiceType" : single_int, "msRASSavedCallbackNumber" : single_str, "msRASSavedFramedIPAddress" : single_int, "msRASSavedFramedRoute" : multi_str, "msSFU30Aliases" : multi_str, "msSFU30CryptMethod" : single_str, "msSFU30Domains" : multi_str, "msSFU30FieldSeparator" : single_str, "msSFU30IntraFieldSeparator" : single_str, "msSFU30IsValidContainer" : single_int, "msSFU30KeyAttributes" : multi_str, "msSFU30KeyValues" : multi_str, "msSFU30MapFilter" : single_str, "msSFU30MasterServerName" : single_str, "msSFU30MaxGidNumber" : single_int, "msSFU30MaxUidNumber" : single_int, "msSFU30Name" : single_str, "msSFU30NetgroupHostAtDomain" : multi_str, "msSFU30NetgroupUserAtDomain" : multi_str, "msSFU30NisDomain" : single_str, "msSFU30NSMAPFieldPosition" : single_str, "msSFU30OrderNumber" : single_str, "msSFU30PosixMember" : multi_str, "msSFU30PosixMemberOf" : multi_str, "msSFU30ResultAttributes" : multi_str, "msSFU30SearchAttributes" : multi_str, "msSFU30SearchContainer" : single_str, "msSFU30YpServers" : multi_str, "mustContain" : multi_str, "nameServiceFlags" : single_int, "nCName" : single_str, "nETBIOSName" : single_str, "netbootAllowNewClients" : single_bool, "netbootAnswerOnlyValidClients" : single_bool, "netbootAnswerRequests" : single_bool, "netbootCurrentClientCount" : single_int, "netbootDUID" : single_bytes, "netbootGUID" : single_bytes, "netbootInitialization" : single_str, "netbootIntelliMirrorOSes" : multi_str, "netbootLimitClients" : single_bool, "netbootLocallyInstalledOSes" : multi_str, "netbootMachineFilePath" : single_str, "netbootMaxClients" : single_int, "netbootMirrorDataFile" : multi_str, "netbootNewMachineNamingPolicy" : multi_str, "netbootNewMachineOU" : single_str, "netbootSCPBL" : multi_str, "netbootServer" : single_str, "netbootSIFFile" : multi_str, "netbootTools" : multi_str, "networkAddress" : multi_str, "nextLevelStore" : single_str, "nextRid" : single_int, "nisMapEntry" : single_str, "nisMapName" : single_str, "nisNetgroupTriple" : multi_str, "nonSecurityMember" : multi_str, "nonSecurityMemberBL" : multi_str, "notificationList" : single_str, "nTGroupMembers" : multi_bytes, "nTMixedDomain" : single_int, "ntPwdHistory" : multi_bytes, "nTSecurityDescriptor" : single_sd, "distinguishedName" : single_str, "objectCategory" : single_str, "objectClass" : multi_str, "objectClassCategory" : single_int, "objectClasses" : multi_str, "objectCount" : single_int, "objectGUID" : single_bytes, "objectSid" : single_sid, "objectVersion" : single_int, "oEMInformation" : single_str, "oMObjectClass" : single_bytes, "oMSyntax" : single_int, "oMTGuid" : single_bytes, "oMTIndxGuid" : single_bytes, "oncRpcNumber" : single_int, "operatingSystem" : single_str, "operatingSystemHotfix" : single_str, "operatingSystemServicePack" : single_str, "operatingSystemVersion" : single_str, "operatorCount" : single_int, "optionDescription" : multi_str, "options" : single_int, "optionsLocation" : multi_str, "o" : multi_str, "ou" : multi_str, "organizationalStatus" : multi_str, "originalDisplayTable" : single_bytes, "originalDisplayTableMSDOS" : single_bytes, "otherLoginWorkstations" : multi_str, "otherMailbox" : multi_str, "middleName" : single_str, "otherWellKnownObjects" : multi_str, "owner" : single_str, "packageFlags" : single_int, "packageName" : single_str, "packageType" : single_int, "parentCA" : single_str, "parentCACertificateChain" : single_bytes, "parentGUID" : single_bytes, "partialAttributeDeletionList" : single_bytes, "partialAttributeSet" : single_bytes, "pekKeyChangeInterval" : single_int, "pekList" : single_bytes, "pendingCACertificates" : single_bytes, "pendingParentCA" : multi_str, "perMsgDialogDisplayTable" : single_bytes, "perRecipDialogDisplayTable" : single_bytes, "personalTitle" : single_str, "otherFacsimileTelephoneNumber" : multi_str, "otherHomePhone" : multi_str, "homePhone" : single_str, "otherIpPhone" : multi_str, "ipPhone" : single_str, "primaryInternationalISDNNumber" : single_str, "otherMobile" : multi_str, "mobile" : single_str, "otherTelephone" : multi_str, "otherPager" : multi_str, "pager" : single_str, "photo" : multi_bytes, "physicalDeliveryOfficeName" : single_str, "physicalLocationObject" : single_str, "thumbnailPhoto" : single_bytes, "pKICriticalExtensions" : multi_str, "pKIDefaultCSPs" : multi_str, "pKIDefaultKeySpec" : single_int, "pKIEnrollmentAccess" : multi_sd, "pKIExpirationPeriod" : single_bytes, "pKIExtendedKeyUsage" : multi_str, "pKIKeyUsage" : single_bytes, "pKIMaxIssuingDepth" : single_int, "pKIOverlapPeriod" : single_bytes, "pKT" : single_bytes, "pKTGuid" : single_bytes, "policyReplicationFlags" : single_int, "portName" : multi_str, "possSuperiors" : multi_str, "possibleInferiors" : multi_str, "postOfficeBox" : multi_str, "postalAddress" : multi_str, "postalCode" : single_str, "preferredDeliveryMethod" : multi_int, "preferredOU" : single_str, "preferredLanguage" : single_str, "prefixMap" : single_bytes, #"presentationAddress" : single_bstr, "previousCACertificates" : single_bytes, "previousParentCA" : multi_str, "primaryGroupID" : single_int, "primaryGroupToken" : single_int, "printAttributes" : single_int, "printBinNames" : multi_str, "printCollate" : single_bool, "printColor" : single_bool, "printDuplexSupported" : single_bool, "printEndTime" : single_int, "printFormName" : single_str, "printKeepPrintedJobs" : single_bool, "printLanguage" : multi_str, "printMACAddress" : single_str, "printMaxCopies" : single_int, "printMaxResolutionSupported" : single_int, "printMaxXExtent" : single_int, "printMaxYExtent" : single_int, "printMediaReady" : multi_str, "printMediaSupported" : multi_str, "printMemory" : single_int, "printMinXExtent" : single_int, "printMinYExtent" : single_int, "printNetworkAddress" : single_str, "printNotify" : single_str, "printNumberUp" : single_int, "printOrientationsSupported" : multi_str, "printOwner" : single_str, "printPagesPerMinute" : single_int, "printRate" : single_int, "printRateUnit" : single_str, "printSeparatorFile" : single_str, "printShareName" : multi_str, "printSpooling" : single_str, "printStaplingSupported" : single_bool, "printStartTime" : single_int, "printStatus" : single_str, "printerName" : single_str, "priorSetTime" : single_int, "priorValue" : single_bytes, "priority" : single_int, "privateKey" : single_bytes, "privilegeAttributes" : single_int, "privilegeDisplayName" : single_str, "privilegeHolder" : multi_str, "privilegeValue" : single_int, "productCode" : single_bytes, "profilePath" : single_str, "proxiedObjectName" : single_str, "proxyAddresses" : multi_str, "proxyGenerationEnabled" : single_bool, "proxyLifetime" : single_int, "publicKeyPolicy" : single_bytes, "purportedSearch" : single_str, "pwdHistoryLength" : single_int, "pwdLastSet" : single_int, "pwdProperties" : single_int, "qualityOfService" : single_int, "queryFilter" : single_str, "queryPolicyBL" : multi_str, "queryPolicyObject" : single_str, "queryPoint" : single_str, "rangeLower" : single_int, "rangeUpper" : single_int, "name" : single_str, "rDNAttID" : single_str, "registeredAddress" : multi_bytes, "remoteServerName" : multi_str, "remoteSource" : single_str, "remoteSourceType" : single_int, "remoteStorageGUID" : single_str, "replInterval" : single_int, "replPropertyMetaData" : single_bytes, "replTopologyStayOfExecution" : single_int, "replUpToDateVector" : single_bytes, "replicaSource" : single_str, "directReports" : multi_str, "repsFrom" : multi_bytes, "repsTo" : multi_bytes, "requiredCategories" : multi_bytes, "retiredReplDSASignatures" : single_bytes, "revision" : single_int, "rid" : single_int, "rIDAllocationPool" : single_int, "rIDAvailablePool" : single_int, "rIDManagerReference" : single_str, "rIDNextRID" : single_int, "rIDPreviousAllocationPool" : single_int, "rIDSetReferences" : multi_str, "rIDUsedPool" : single_int, "rightsGuid" : single_str, "roleOccupant" : multi_str, "roomNumber" : multi_str, "rootTrust" : multi_str, "rpcNsAnnotation" : single_str, "rpcNsBindings" : multi_str, "rpcNsCodeset" : multi_str, "rpcNsEntryFlags" : single_int, "rpcNsGroup" : multi_str, "rpcNsInterfaceID" : single_str, "rpcNsObjectID" : multi_str, "rpcNsPriority" : multi_int, "rpcNsProfileEntry" : single_str, "rpcNsTransferSyntax" : single_str, "sAMAccountName" : single_str, "sAMAccountType" : single_int, "samDomainUpdates" : single_bytes, "schedule" : single_bytes, "schemaFlagsEx" : single_int, "schemaIDGUID" : single_bytes, "schemaInfo" : multi_bytes, "schemaUpdate" : single_date, "schemaVersion" : multi_int, "scopeFlags" : single_int, "scriptPath" : single_str, "sDRightsEffective" : single_int, "searchFlags" : single_int, "searchGuide" : multi_bytes, "secretary" : multi_str, "securityIdentifier" : single_sid, "seeAlso" : multi_str, "seqNotification" : single_int, "serialNumber" : multi_str, "serverName" : single_str, "serverReference" : single_str, "serverReferenceBL" : multi_str, "serverRole" : single_int, "serverState" : single_int, "serviceBindingInformation" : multi_str, "serviceClassID" : single_bytes, "serviceClassInfo" : multi_bytes, "serviceClassName" : single_str, "serviceDNSName" : single_str, "serviceDNSNameType" : single_str, "serviceInstanceVersion" : single_bytes, "servicePrincipalName" : multi_str, "setupCommand" : single_str, "shadowExpire" : single_int, "shadowFlag" : single_int, "shadowInactive" : single_int, "shadowLastChange" : single_int, "shadowMax" : single_int, "shadowMin" : single_int, "shadowWarning" : single_int, "shellContextMenu" : multi_str, "shellPropertyPages" : multi_str, "shortServerName" : single_str, "showInAddressBook" : multi_str, "showInAdvancedViewOnly" : single_bool, "sIDHistory" : multi_sid, "signatureAlgorithms" : single_str, "siteGUID" : single_bytes, "siteLinkList" : multi_str, "siteList" : multi_str, "siteObject" : single_str, "siteObjectBL" : multi_str, "siteServer" : multi_str, "mailAddress" : single_str, "sPNMappings" : multi_str, "st" : single_str, "street" : single_str, "structuralObjectClass" : multi_str, "subClassOf" : single_str, "subRefs" : multi_str, "subSchemaSubEntry" : multi_str, "superScopeDescription" : multi_str, "superScopes" : multi_str, "superiorDNSRoot" : single_str, "supplementalCredentials" : multi_bytes, "supportedApplicationContext" : multi_bytes, "sn" : single_str, "syncAttributes" : single_int, "syncMembership" : multi_str, "syncWithObject" : single_str, "syncWithSID" : single_sid, "systemAuxiliaryClass" : multi_str, "systemFlags" : single_int, "systemMayContain" : multi_str, "systemMustContain" : multi_str, "systemOnly" : single_bool, "systemPossSuperiors" : multi_str, "telephoneNumber" : single_str, "teletexTerminalIdentifier" : multi_bytes, "telexNumber" : multi_bytes, "primaryTelexNumber" : single_str, "templateRoots" : multi_str, "templateRoots2" : multi_str, "terminalServer" : single_bytes, "co" : single_str, "textEncodedORAddress" : single_str, "timeRefresh" : single_int, "timeVolChange" : single_int, "title" : single_str, "tokenGroups" : multi_sid, "tokenGroupsGlobalAndUniversal" : multi_sid, "tokenGroupsNoGCAcceptable" : multi_sid, "tombstoneLifetime" : single_int, "transportAddressAttribute" : single_str, "transportDLLName" : single_str, "transportType" : single_str, "treatAsLeaf" : single_bool, "treeName" : single_str, "trustAttributes" : single_int, "trustAuthIncoming" : single_bytes, "trustAuthOutgoing" : single_bytes, "trustDirection" : single_int, "trustParent" : single_str, "trustPartner" : single_str, "trustPosixOffset" : single_int, "trustType" : single_int, "uASCompat" : single_int, "uid" : multi_str, "uidNumber" : single_int, "uNCName" : single_str, "unicodePwd" : single_bytes, "uniqueIdentifier" : multi_str, "uniqueMember" : multi_str, "unixHomeDirectory" : single_str, "unixUserPassword" : multi_bytes, "unstructuredAddress" : multi_str, "unstructuredName" : multi_str, "upgradeProductCode" : multi_bytes, "uPNSuffixes" : multi_str, "userAccountControl" : single_int, "userCert" : single_bytes, "comment" : single_str, "userParameters" : single_str, "userPassword" : multi_bytes, "userPrincipalName" : single_str, "userSharedFolder" : single_str, "userSharedFolderOther" : multi_str, "userSMIMECertificate" : multi_bytes, "userWorkstations" : single_str, "userClass" : multi_str, "userPKCS12" : multi_bytes, "uSNChanged" : single_int, "uSNCreated" : single_int, "uSNDSALastObjRemoved" : single_int, "USNIntersite" : single_int, "uSNLastObjRem" : single_int, "uSNSource" : single_int, "validAccesses" : single_int, "vendor" : single_str, "versionNumber" : single_int, "versionNumberHi" : single_int, "versionNumberLo" : single_int, "volTableGUID" : single_bytes, "volTableIdxGUID" : single_bytes, "volumeCount" : single_int, "wbemPath" : multi_str, "wellKnownObjects" : multi_str, "whenChanged" : single_date, "whenCreated" : single_date, "winsockAddresses" : multi_bytes, "wWWHomePage" : single_str, "url" : multi_str, "x121Address" : multi_str, "x500uniqueIdentifier" : multi_bytes, "userCertificate" : multi_bytes, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/protocol/utils.py0000664000175000017500000000104314531630505017214 0ustar00webdevwebdev def calcualte_length(data): """ LDAP protocol doesnt send the total length of the message in the header, it only sends raw ASN1 encoded data structures, which has the length encoded. This function "decodes" the length os the asn1 structure, and returns it as int. """ if data[1] <= 127: return data[1] + 2 else: bcount = data[1] - 128 #if (bcount +2 ) > len(data): # raise Exception('LDAP data too larage! Length byte count: %s' % bcount) return int.from_bytes(data[2:2+bcount], byteorder = 'big', signed = False) + bcount + 2 ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/msldap/relay/0000775000175000017500000000000014535076203014762 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/relay/__init__.py0000664000175000017500000000000014531630505017056 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/relay/server.py0000664000175000017500000000522014531630505016636 0ustar00webdevwebdevfrom asysocks.unicomm.common.target import UniTarget, UniProto from asysocks.unicomm.server import UniServer from msldap.network.packetizer import LDAPPacketizer from msldap.relay.serverconnection import LDAPRelayServerConnection from asyauth.protocols.spnego.relay.native import spnegorelay_ntlm_factory from asyauth.protocols.ntlm.relay.native import NTLMRelaySettings, ntlmrelay_factory import traceback import asyncio class LDAPServerSettings: def __init__(self, gssapi_factory): self.gssapi_factory = gssapi_factory @property def gssapi(self): return self.gssapi_factory() class LDAPRelayServer: def __init__(self, target, settings): self.target = target self.settings = settings self.server = None self.serving_task = None self.connections = {} self.conn_ctr = 0 def get_ctr(self): self.conn_ctr += 1 return self.conn_ctr async def __handle_connection(self): try: async for connection in self.server.serve(): print('connection in!') smbconnection = LDAPRelayServerConnection(self.settings, connection) self.connections[self.get_ctr()] = smbconnection x = asyncio.create_task(smbconnection.run()) except Exception as e: traceback.print_exc() return async def run(self): self.server = UniServer(self.target, LDAPPacketizer()) self.serving_task = asyncio.create_task(self.__handle_connection()) return self.serving_task async def test_relay_queue(rq): try: from aiosmb.connection import SMBConnection from aiosmb.commons.connection.target import SMBTarget from aiosmb.commons.interfaces.machine import SMBMachine test_target = SMBTarget('10.10.10.2') while True: item = await rq.get() print(item) connection = SMBConnection(item, test_target, preserve_gssapi=False, nosign=True) _, err = await connection.login() if err is not None: print('SMB client login err: %s' % err) print(traceback.format_tb(err.__traceback__)) continue machine = SMBMachine(connection) async for share, err in machine.list_shares(): if err is not None: print('SMB client list_shares err: %s' % err) continue print(share) except Exception as e: traceback.print_exc() return async def amain(): try: auth_relay_queue = asyncio.Queue() x = asyncio.create_task(test_relay_queue(auth_relay_queue)) target = UniTarget('0.0.0.0', 636, UniProto.SERVER_SSL_TCP) settings = LDAPServerSettings(lambda: spnegorelay_ntlm_factory(auth_relay_queue, lambda: ntlmrelay_factory())) server = LDAPRelayServer(target, settings) server_task = await server.run() await server_task except Exception as e: traceback.print_exc() return if __name__ == '__main__': asyncio.run(amain())././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/relay/serverconnection.py0000664000175000017500000000771014531630505020724 0ustar00webdevwebdevfrom msldap.protocol.utils import calcualte_length from msldap.protocol.messages import LDAPMessage, AuthenticationChoice, protocolOp, BindResponse from msldap import logger import traceback import asyncio class LDAPRelayServerConnection: def __init__(self, settings, connection): self.settings = settings self.gssapi = settings.gssapi self.ntlm = self.gssapi.authentication_contexts['NTLMSSP - Microsoft NTLM Security Support Provider'] self.connection = connection self.__auth_type = None self.__auth_iter = 0 async def log_async(self, level, msg): if self.settings.log_q is not None: src = 'LDAPCON-%s:%s' % (self.client_ip, self.client_port) await self.settings.log_q.put((src, level, msg)) else: logger.log(level, msg) async def terminate(self): self.handle_in_task.cancel() async def __handle_ldap_in(self): async for msg_data in self.connection.read(): try: msg = LDAPMessage.load(msg_data) if msg['protocolOp']._choice == 0: await self.__bindreq(msg) else: raise Exception('Unknown LDAP message! %s' % msg.native) except Exception as e: await self.log_async(1, str(e)) return async def __bindreq(self, msg): try: msg_id = msg.native['messageID'] authdata_raw = msg.native['protocolOp']['authentication'] if isinstance(authdata_raw, bytes) is True: self.__auth_type = 'NTLM' if self.__auth_iter == 0: t = { 'resultCode' : 0, 'matchedDN' : 'NTLM'.encode(), 'diagnosticMessage' : b'', } po = {'bindResponse' : BindResponse(t)} b= { 'messageID' : msg_id, 'protocolOp' : protocolOp(po), } resp = LDAPMessage(b) await self.connection.write(resp.dump()) self.__auth_iter += 1 return else: resdata, to_conitnue, err = await self.ntlm.authenticate_relay_server(authdata_raw) if err is not None: raise err if resdata is None: t = { 'resultCode' : 49, 'matchedDN' : b'', 'diagnosticMessage' : b'8009030C: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4563\x00', } po = {'bindResponse' : BindResponse(t)} b= { 'messageID' : msg_id, 'protocolOp' : protocolOp(po), } resp = LDAPMessage(b) await self.connection.write(resp.dump()) await self.terminate() return t = { 'resultCode' : 0, 'matchedDN' : resdata, 'diagnosticMessage' : b'', } po = {'bindResponse' : BindResponse(t)} b= { 'messageID' : msg_id, 'protocolOp' : protocolOp(po), } resp = LDAPMessage(b) await self.connection.write(resp.dump()) self.__auth_iter += 1 return if isinstance(authdata_raw, dict) is True: self.__auth_type = 'GSSAPI' resdata, to_conitnue, err = await self.gssapi.authenticate_relay_server(authdata_raw['credentials']) if err is not None: raise err if resdata is None: t = { 'resultCode' : 49, 'matchedDN' : b'', 'diagnosticMessage' : b'8009030C: LdapErr: DSID-0C090569, comment: AcceptSecurityContext error, data 52e, v4563\x00', } po = {'bindResponse' : BindResponse(t)} b= { 'messageID' : msg_id, 'protocolOp' : protocolOp(po), } resp = LDAPMessage(b) await self.connection.write(resp.dump()) await self.terminate() return t = { 'resultCode' : 14, 'matchedDN' : b'', 'diagnosticMessage' : b'', 'serverSaslCreds': resdata } po = {'bindResponse' : BindResponse(t)} b= { 'messageID' : msg_id, 'protocolOp' : protocolOp(po), } resp = LDAPMessage(b) await self.connection.write(resp.dump()) self.__auth_iter += 1 else: raise Exception('Unknown auth method %s' % authdata_raw) except Exception as e: traceback.print_exc() return async def run(self): self.handle_in_task = asyncio.create_task(self.__handle_ldap_in()) await self.handle_in_task././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/msldap/wintypes/0000775000175000017500000000000014535076203015530 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/__init__.py0000664000175000017500000000027114531630505017636 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # from .asn1.sdflagsrequest import SDFlagsRequest, SDFlagsRequestValue __all__ = ['SDFlagsRequest', 'SDFlagsRequestValue'] ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/msldap/wintypes/asn1/0000775000175000017500000000000014535076203016372 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/asn1/__init__.py0000664000175000017500000000007714531630505020504 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/asn1/sdflagsrequest.py0000664000175000017500000000121614531630505021775 0ustar00webdevwebdev#!/usr/bin/env python3 # # Author: # Tamas Jos (@skelsec) # import enum from asn1crypto import core class SDFlagsRequest(enum.IntFlag): OWNER_SECURITY_INFORMATION = 0x1 #Owner identifier of the object.(OSI) GROUP_SECURITY_INFORMATION = 0x2 #Primary group identifier.(GSI) DACL_SECURITY_INFORMATION = 0x4 #Discretionary access control list (DACL) of the object.(DSI) SACL_SECURITY_INFORMATION = 0x8 #System access control list (SACL) of the object.(SSI) # https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/3888c2b7-35b9-45b7-afeb-b772aa932dd0 class SDFlagsRequestValue(core.Sequence): _fields = [ ('Flags', core.Integer), ]././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/msldap/wintypes/dnsp/0000775000175000017500000000000014535076203016474 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/dnsp/__init__.py0000664000175000017500000000000014531630505020570 0ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/dnsp/strcutures.py0000664000175000017500000002534214531630505021274 0ustar00webdevwebdev # parts of the dns implementation was taken from https://github.com/dirkjanm/adidnsdump import enum import io import socket import datetime from typing import List class DNS_RECORD_TYPE(enum.Enum): ZERO = 0x0000 #An empty record type ([RFC1034] section 3.6 and [RFC1035] section 3.2.2). A = 0x0001 #An A record type, used for storing an IP address ([RFC1035] section 3.2.2). NS = 0x0002 #An authoritative name-server record type ([RFC1034] section 3.6 and [RFC1035] section 3.2.2). MD = 0x0003 #A mail-destination record type ([RFC1035] section 3.2.2). MF = 0x0004 #A mail forwarder record type ([RFC1035] section 3.2.2). CNAME = 0x0005 #A record type that contains the canonical name of a DNS alias ([RFC1035] section 3.2.2). SOA = 0x0006 #A Start of Authority (SOA) record type ([RFC1035] section 3.2.2). MB = 0x0007 #A mailbox record type ([RFC1035] section 3.2.2). MG = 0x0008 #A mail group member record type ([RFC1035] section 3.2.2). MR = 0x0009 #A mail-rename record type ([RFC1035] section 3.2.2). NULL = 0x000A #A record type for completion queries ([RFC1035] section 3.2.2). WKS = 0x000B #A record type for a well-known service ([RFC1035] section 3.2.2). PTR = 0x000C #A record type containing FQDN pointer ([RFC1035] section 3.2.2). HINFO = 0x000D #A host information record type ([RFC1035] section 3.2.2). MINFO = 0x000E #A mailbox or mailing list information record type ([RFC1035] section 3.2.2). MX = 0x000F #A mail-exchanger record type ([RFC1035] section 3.2.2). TXT = 0x0010 #A record type containing a text string ([RFC1035] section 3.2.2). RP = 0x0011 #A responsible-person record type [RFC1183]. AFSDB = 0x0012 #A record type containing AFS database location [RFC1183]. X25 = 0x0013 #An X25 PSDN address record type [RFC1183]. ISDN = 0x0014 #An ISDN address record type [RFC1183]. RT = 0x0015 #A route through record type [RFC1183]. SIG = 0x0018 #A cryptographic public key signature record type [RFC2931]. KEY = 0x0019 #A record type containing public key used in DNSSEC [RFC2535]. AAAA = 0x001C #An IPv6 address record type [RFC3596]. LOC = 0x001D #A location information record type [RFC1876]. NXT = 0x001E #A next-domain record type [RFC2065]. SRV = 0x0021 #A server selection record type [RFC2782]. ATMA = 0x0022 # An Asynchronous Transfer Mode (ATM) address record type [ATMA]. NAPTR = 0x0023 #An NAPTR record ype [RFC2915]. DNAME = 0x0027 #A DNAME record type [RFC2672]. DS = 0x002B #A DS record type [RFC4034]. RRSIG = 0x002E #An RRSIG record type [RFC4034]. NSEC = 0x002F #An NSEC record type [RFC4034]. DNSKEY = 0x0030 #A DNSKEY record type [RFC4034]. DHCID = 0x0031 #A DHCID record type [RFC4701]. NSEC3 = 0x0032 #An NSEC3 record type [RFC5155]. NSEC3PARAM = 0x0033 #An NSEC3PARAM record type [RFC5155]. TLSA = 0x0034 #A TLSA record type [RFC6698]. ALL = 0x00FF #A query-only type requesting all records [RFC1035]. WINS = 0xFF01 # A record type containing Windows Internet Name Service (WINS) forward lookup data [MS-WINSRA]. WINSR = 0xFF02 #A record type containing WINS reverse lookup data [MS-WINSRA]. # https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dnsp/ac793981-1c60-43b8-be59-cdbb5c4ecb8a class DNS_RECORD: def __init__(self): self.DataLength:int = None self.Type:DNS_RECORD_TYPE = None self.Version: bytes = b'\x05' self.Rank:bytes = None self.Flags:bytes = b'\x00\x00' self.Serial:bytes = None self.TtlSeconds:int = None self.Reserved:bytes = b'\x00\x00\x00\x00' self.TimeStamp:bytes = None self.Data:bytes = None @staticmethod def from_bytes(data): return DNS_RECORD.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RECORD() res.DataLength = int.from_bytes(buff.read(2), 'little', signed = False) res.Type = DNS_RECORD_TYPE(int.from_bytes(buff.read(2), 'little', signed = False)) res.Version = buff.read(1) res.Rank = buff.read(1) res.Flags = buff.read(2) res.Serial = buff.read(4) res.TtlSeconds = int.from_bytes(buff.read(4), 'little', signed = False) res.Reserved = buff.read(4) res.TimeStamp = buff.read(4) res.Data = buff.read(res.DataLength) return res def get_formatted(self): if self.Data is None or len(self.Data) == 0: return None if self.Type in MSLDAP_DNS_TYPE_TO_CLASS: return MSLDAP_DNS_TYPE_TO_CLASS[self.Type].from_bytes(self.Data) return DNS_RPC_RECORD_UNKNOWN.from_bytes(self.Data) def __str__(self): t = '==== DNS_RECORD ====\r\n' t += 'DataLength: %s\r\n' % self.DataLength t += 'Type: %s\r\n' % self.Type.name t += 'Version: %s\r\n' % self.Version.hex() t += 'Rank: %s\r\n' % self.Rank.hex() t += 'Flags: %s\r\n' % self.Flags.hex() t += 'Serial: %s\r\n' % self.Serial.hex() t += 'TtlSeconds: %s\r\n' % self.TtlSeconds t += 'Reserved: %s\r\n' % self.Reserved.hex() t += 'TimeStamp: %s\r\n' % self.TimeStamp.hex() t += 'Data: %s\r\n' % self.Data.hex() return t class DNS_RPC_RECORD_UNKNOWN: def __init__(self): self.Data:bytes = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_UNKNOWN.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_UNKNOWN() res.Data = buff.read() return res def to_line(self, separator = '\t'): return str(self) def __str__(self): return self.Data.hex() class DNS_RPC_RECORD_A: def __init__(self): self.IpAddress:str = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_A.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_A() res.IpAddress = socket.inet_ntoa(buff.read(4)) return res def to_line(self, separator = '\t'): return str(self) def __str__(self): return self.IpAddress class DNS_RPC_RECORD_AAAA: def __init__(self): self.IpAddress:str = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_AAAA.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_AAAA() res.IpAddress = socket.inet_ntop(socket.AF_INET6, buff.read(16)) return res def to_line(self, separator = '\t'): return str(self) def __str__(self): return self.IpAddress class DNS_RPC_RECORD_SRV: def __init__(self): self.wPriority:int = None self.wWeight:int = None self.wPort:int = None self.nameTarget:DNS_COUNT_NAME = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_SRV.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_SRV() res.wPriority = int.from_bytes(buff.read(2), 'little', signed = False) res.wWeight = int.from_bytes(buff.read(2), 'little', signed = False) res.wPort = int.from_bytes(buff.read(2), 'little', signed = False) res.nameTarget = DNS_COUNT_NAME.from_buffer(buff) return res def to_line(self, separator = '\t'): return separator.join([ str(self.wPriority), str(self.wWeight), str(self.wPort), str(self.nameTarget) ]) def __str__(self): return 'Prio: %s | Weight: %s | Port: %s | Name: %s' % (self.wPriority, self.wWeight, self.wPort, self.nameTarget) class DNS_RPC_RECORD_TS: def __init__(self): self.entombedTime:datetime.datetime = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_TS.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_TS() tsraw = buff.read(8, signed = False, byteorder = 'little') microseconds = tsraw / 10 try: res.entombedTime = datetime.datetime(1601,1,1) + datetime.timedelta(microseconds=microseconds) except OverflowError: return None return res def to_line(self, separator = '\t'): return str(self) def __str__(self): return str(self.entombedTime) class DNS_COUNT_NAME: def __init__(self): self.Length:int = None self.LabelCount:int = None #self.RawName:str = None self.labels:List[str] = [] @staticmethod def from_bytes(data): return DNS_COUNT_NAME.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_COUNT_NAME() res.Length = int.from_bytes(buff.read(1), 'little', signed = False) res.LabelCount = int.from_bytes(buff.read(1), 'little', signed = False) #res.RawName = buff.read(res.Length) for _ in range(res.LabelCount): res.labels.append(buff.read(buff.read(1)[0]).decode('utf-8')) buff.read(1) # IMPORTANT! The last byte is always 0x00 and is not indicated in the LabelCount return res def to_line(self, separator = '\t'): return str(self) def __str__(self): return '.'.join(self.labels) class DNS_RPC_RECORD_NULL: def __init__(self): self.bData:bytes = b'' @staticmethod def from_bytes(data): return DNS_RPC_RECORD_NULL.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_NULL() return res def to_line(self, separator = '\t'): return '' def __str__(self): return '' class DNS_RPC_RECORD_SOA: def __init__(self): self.dwSerialNo:int = None self.dwRefresh:int = None self.dwRetry:int = None self.dwExpire:int = None self.dwMinimumTtl:int = None self.namePrimaryServer:DNS_COUNT_NAME = None self.zoneAdminEmail:DNS_COUNT_NAME = None @staticmethod def from_bytes(data): return DNS_RPC_RECORD_SOA.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): res = DNS_RPC_RECORD_SOA() res.dwSerialNo = int.from_bytes(buff.read(4), 'little', signed = False) res.dwRefresh = int.from_bytes(buff.read(4), 'little', signed = False) res.dwRetry = int.from_bytes(buff.read(4), 'little', signed = False) res.dwExpire = int.from_bytes(buff.read(4), 'little', signed = False) res.dwMinimumTtl = int.from_bytes(buff.read(4), 'little', signed = False) res.namePrimaryServer = DNS_COUNT_NAME.from_buffer(buff) res.zoneAdminEmail = DNS_COUNT_NAME.from_buffer(buff) return res def to_line(self, separator = '\t'): return separator.join([ str(self.dwSerialNo), str(self.dwRefresh), str(self.dwRetry), str(self.dwExpire), str(self.dwMinimumTtl), str(self.namePrimaryServer), str(self.zoneAdminEmail) ]) def __str__(self): return 'Serial: %s | Refresh: %s | Retry: %s | Expire: %s | TTL: %s | NS: %s | Email: %s' % (self.dwSerialNo, self.dwRefresh, self.dwRetry, self.dwExpire, self.dwMinimumTtl, self.namePrimaryServer, self.zoneAdminEmail) MSLDAP_DNS_TYPE_TO_CLASS = { DNS_RECORD_TYPE.ZERO : DNS_RPC_RECORD_NULL, DNS_RECORD_TYPE.A : DNS_RPC_RECORD_A, DNS_RECORD_TYPE.AAAA : DNS_RPC_RECORD_AAAA, DNS_RECORD_TYPE.SRV : DNS_RPC_RECORD_SRV, DNS_RECORD_TYPE.PTR : DNS_COUNT_NAME, DNS_RECORD_TYPE.NS : DNS_COUNT_NAME, DNS_RECORD_TYPE.CNAME : DNS_COUNT_NAME, DNS_RECORD_TYPE.DNAME : DNS_COUNT_NAME, DNS_RECORD_TYPE.MB : DNS_COUNT_NAME, DNS_RECORD_TYPE.MR : DNS_COUNT_NAME, DNS_RECORD_TYPE.MG : DNS_COUNT_NAME, DNS_RECORD_TYPE.MD : DNS_COUNT_NAME, DNS_RECORD_TYPE.MF : DNS_COUNT_NAME, DNS_RECORD_TYPE.SOA : DNS_RPC_RECORD_SOA, }././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/encryptedlaps.py0000664000175000017500000000537314531630505020764 0ustar00webdevwebdevimport io import enum from asn1crypto.cms import ContentInfo class EncryptedLAPSBlob: def __init__(self): self.update_timestamp: int self.flags: int self.blob: bytes self.asn1blob: ContentInfo def get_keyidentifier(self): sid = self.asn1blob.native['content']['recipient_infos'][0]['kekid']['other']['key_attr']['1']['0']['0']['1'] print(sid) return LAPS_KEYIDENTIFIER.from_bytes(self.asn1blob.native['content']['recipient_infos'][0]['kekid']['key_identifier']) def from_bytes(data: bytes): return EncryptedLAPSBlob.from_buffer(io.BytesIO(data)) def from_buffer(buff: io.BytesIO): blob = EncryptedLAPSBlob() blob.update_timestamp = int.from_bytes(buff.read(8), byteorder='little', signed=False) blob_length = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.flags = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.blob = buff.read(blob_length) blob.asn1blob = ContentInfo.load(blob.blob) return blob def __str__(self): t = '' for k in self.__dict__: t += '%s: %s\n' % (k, self.__dict__[k]) return t class KEYIDFLAGS(enum.IntFlag): DHPARAMS = 1 UNKNOWN = 2 class LAPS_KEYIDENTIFIER: def __init__(self): self.version = None self.magic = None self.flags = None self.l0_index = None self.l1_index = None self.l2_index = None self.root_key_identifier = None self.unknown_length = None self.domain_length = None self.forest_length = None self.unknown = None self.domain = None self.forest = None @staticmethod def from_bytes(data:bytes): return LAPS_KEYIDENTIFIER.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): blob = LAPS_KEYIDENTIFIER() blob.version = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.magic = buff.read(4) blob.flags = KEYIDFLAGS(int.from_bytes(buff.read(4), byteorder='little', signed=False)) blob.l0_index = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.l1_index = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.l2_index = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.root_key_identifier = buff.read(16) blob.unknown_length = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.domain_length = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.forest_length = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.unknown = buff.read(blob.unknown_length) blob.domain = buff.read(blob.domain_length) blob.forest = buff.read(blob.forest_length) return blob def __str__(self): t = '' for k in self.__dict__: if isinstance(self.__dict__[k], bytes): t += '%s: %s\n' % (k, self.__dict__[k].hex()) else: t += '%s: %s\n' % (k, self.__dict__[k]) return t././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/msldap/wintypes/managedpassword.py0000664000175000017500000000442714531630505021265 0ustar00webdevwebdevimport io from unicrypto.hashlib import md4 class MSDS_MANAGEDPASSWORD_BLOB: def __init__(self): self.Version = None self.Reserved = None self.Length = None self.CurrentPasswordOffset = None self.PreviousPasswordOffset = None self.QueryPasswordIntervalOffset = None self.UnchangedPasswordIntervalOffset = None self.CurrentPassword = None self.PreviousPassword = None #('AlignmentPadding',':'), self.QueryPasswordInterval = None self.UnchangedPasswordInterval = None self.nt_hash = None @staticmethod def from_bytes(data:bytes): return MSDS_MANAGEDPASSWORD_BLOB.from_buffer(io.BytesIO(data)) @staticmethod def from_buffer(buff:io.BytesIO): blob = MSDS_MANAGEDPASSWORD_BLOB() blob.Version = int.from_bytes(buff.read(2), byteorder='little', signed=False) blob.Reserved = int.from_bytes(buff.read(2), byteorder='little', signed=False) blob.Length = int.from_bytes(buff.read(4), byteorder='little', signed=False) blob.CurrentPasswordOffset = int.from_bytes(buff.read(2), byteorder='little', signed=False) blob.PreviousPasswordOffset = int.from_bytes(buff.read(2), byteorder='little', signed=False) blob.QueryPasswordIntervalOffset = int.from_bytes(buff.read(2), byteorder='little', signed=False) blob.UnchangedPasswordIntervalOffset = int.from_bytes(buff.read(2), byteorder='little', signed=False) ppwo = blob.PreviousPasswordOffset if ppwo == 0: ppwo = blob.QueryPasswordIntervalOffset if blob.CurrentPasswordOffset >0: buff.seek(blob.CurrentPasswordOffset, 0) blob.CurrentPassword = buff.read(ppwo - blob.CurrentPasswordOffset) if blob.PreviousPasswordOffset >0: buff.seek(blob.PreviousPasswordOffset, 0) blob.PreviousPassword = buff.read(blob.QueryPasswordIntervalOffset - blob.CurrentPasswordOffset) if blob.QueryPasswordIntervalOffset >0: buff.seek(blob.QueryPasswordIntervalOffset, 0) blob.QueryPasswordInterval = buff.read(blob.UnchangedPasswordIntervalOffset - blob.UnchangedPasswordIntervalOffset) if blob.UnchangedPasswordIntervalOffset >0: buff.seek(blob.UnchangedPasswordIntervalOffset, 0) blob.UnchangedPasswordInterval = buff.read() blob.nt_hash = md4(blob.CurrentPassword[:-2]).hexdigest() return blob def __str__(self): t = '' for k in self.__dict__: t += '%s: %s\r\n' % (k, self.__dict__[k]) return t././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132866.9994087 msldap-0.5.9/msldap.egg-info/0000775000175000017500000000000014535076203015340 5ustar00webdevwebdev././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/PKG-INFO0000664000175000017500000000073514535076202016441 0ustar00webdevwebdevMetadata-Version: 2.1 Name: msldap Version: 0.5.9 Summary: Python library to play with MS LDAP Home-page: https://github.com/skelsec/msldap Author: Tamas Jos Author-email: info@skelsecprojects.com Classifier: Programming Language :: Python :: 3.7 Classifier: Programming Language :: Python :: 3.8 Classifier: License :: OSI Approved :: MIT License Classifier: Operating System :: OS Independent Requires-Python: >=3.7 License-File: LICENSE Python library to play with MS LDAP ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/SOURCES.txt0000664000175000017500000000535614535076202017234 0ustar00webdevwebdevLICENSE MANIFEST.in README.md pyproject.toml setup.py msldap/__init__.py msldap/__main__.py msldap/_version.py msldap/bloodhound.py msldap/client.py msldap/connection.py msldap.egg-info/PKG-INFO msldap.egg-info/SOURCES.txt msldap.egg-info/dependency_links.txt msldap.egg-info/entry_points.txt msldap.egg-info/not-zip-safe msldap.egg-info/requires.txt msldap.egg-info/top_level.txt msldap/commons/__init__.py msldap/commons/adexplorer.py msldap/commons/authbuilder.py msldap/commons/common.py msldap/commons/exceptions.py msldap/commons/factory.py msldap/commons/ldif.py msldap/commons/target.py msldap/commons/utils.py msldap/examples/__init__.py msldap/examples/jsontest.py msldap/examples/msldapbloodhound.py msldap/examples/msldapclient.py msldap/examples/msldapcompdnslist.py msldap/examples/utils/__init__.py msldap/examples/utils/completers.py msldap/external/__init__.py msldap/external/aiocmd/__init__.py msldap/external/aiocmd/setup.py msldap/external/aiocmd/aiocmd/__init__.py msldap/external/aiocmd/aiocmd/aiocmd.py msldap/external/aiocmd/aiocmd/nested_completer.py msldap/external/asciitree/__init__.py msldap/external/asciitree/setup.py msldap/external/asciitree/asciitree/__init__.py msldap/external/asciitree/asciitree/drawing.py msldap/external/asciitree/asciitree/traversal.py msldap/external/asciitree/asciitree/util.py msldap/external/bloodhoundpy/__init__.py msldap/external/bloodhoundpy/acls.py msldap/external/bloodhoundpy/resolver.py msldap/external/bloodhoundpy/utils.py msldap/external/bloodhoundpy/lib/__init__.py msldap/external/bloodhoundpy/lib/cstruct.py msldap/ldap_objects/__init__.py msldap/ldap_objects/adca.py msldap/ldap_objects/adcertificatetemplate.py msldap/ldap_objects/adcomp.py msldap/ldap_objects/adcontainer.py msldap/ldap_objects/adenrollmentservice.py msldap/ldap_objects/adgmsa.py msldap/ldap_objects/adgpo.py msldap/ldap_objects/adgroup.py msldap/ldap_objects/adinfo.py msldap/ldap_objects/adou.py msldap/ldap_objects/adschemaentry.py msldap/ldap_objects/adsec.py msldap/ldap_objects/adtrust.py msldap/ldap_objects/aduser.py msldap/ldap_objects/common.py msldap/network/__init__.py msldap/network/packetizer.py msldap/protocol/__init__.py msldap/protocol/constants.py msldap/protocol/messages.py msldap/protocol/query.py msldap/protocol/typeconversion.py msldap/protocol/utils.py msldap/protocol/ldap_filter/__init__.py msldap/protocol/ldap_filter/filter.py msldap/protocol/ldap_filter/parser.py msldap/protocol/ldap_filter/soundex.py msldap/relay/__init__.py msldap/relay/server.py msldap/relay/serverconnection.py msldap/wintypes/__init__.py msldap/wintypes/encryptedlaps.py msldap/wintypes/managedpassword.py msldap/wintypes/asn1/__init__.py msldap/wintypes/asn1/sdflagsrequest.py msldap/wintypes/dnsp/__init__.py msldap/wintypes/dnsp/strcutures.py././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/dependency_links.txt0000664000175000017500000000000114535076202021405 0ustar00webdevwebdev ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/entry_points.txt0000664000175000017500000000016714535076202020641 0ustar00webdevwebdev[console_scripts] msldap = msldap.examples.msldapclient:main msldap-bloodhound = msldap.examples.msldapbloodhound:main ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/not-zip-safe0000664000175000017500000000000114535076202017565 0ustar00webdevwebdev ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/requires.txt0000664000175000017500000000017714535076202017744 0ustar00webdevwebdevunicrypto>=0.0.10 asyauth>=0.0.18 asysocks>=0.2.11 asn1crypto>=1.3.0 winacl>=0.1.8 prompt-toolkit>=3.0.2 tqdm wcwidth tabulate ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702132866.0 msldap-0.5.9/msldap.egg-info/top_level.txt0000664000175000017500000000000714535076202020066 0ustar00webdevwebdevmsldap ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701261637.0 msldap-0.5.9/pyproject.toml0000664000175000017500000000013014531630505015271 0ustar00webdevwebdev[build-system] requires = ["setuptools>=61.0.0"] build-backend = "setuptools.build_meta"././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1702132867.0194087 msldap-0.5.9/setup.cfg0000664000175000017500000000004614535076203014207 0ustar00webdevwebdev[egg_info] tag_build = tag_date = 0 ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1702131829.0 msldap-0.5.9/setup.py0000664000175000017500000000273014535074165014107 0ustar00webdevwebdevfrom setuptools import setup, find_packages import re VERSIONFILE="msldap/_version.py" verstrline = open(VERSIONFILE, "rt").read() VSRE = r"^__version__ = ['\"]([^'\"]*)['\"]" mo = re.search(VSRE, verstrline, re.M) if mo: verstr = mo.group(1) else: raise RuntimeError("Unable to find version string in %s." % (VERSIONFILE,)) setup( # Application name: name="msldap", # Version number (initial): version=verstr, # Application author details: author="Tamas Jos", author_email="info@skelsecprojects.com", # Packages packages=find_packages(exclude=["tests*"]), # Include additional files into the package include_package_data=True, # Details url="https://github.com/skelsec/msldap", zip_safe = False, # # license="LICENSE.txt", description="Python library to play with MS LDAP", long_description="Python library to play with MS LDAP", # long_description=open("README.txt").read(), python_requires='>=3.7', classifiers=[ "Programming Language :: Python :: 3.7", "Programming Language :: Python :: 3.8", "License :: OSI Approved :: MIT License", "Operating System :: OS Independent", ], install_requires=[ 'unicrypto>=0.0.10', 'asyauth>=0.0.18', 'asysocks>=0.2.11', 'asn1crypto>=1.3.0', 'winacl>=0.1.8', 'prompt-toolkit>=3.0.2', 'tqdm', 'wcwidth', 'tabulate' ], entry_points={ 'console_scripts': [ 'msldap = msldap.examples.msldapclient:main', 'msldap-bloodhound = msldap.examples.msldapbloodhound:main', ], } )