o j @sddlZddlZddlZddlmZddlmZddlmZddl m Z ddl m Z m Z GdddZed kreejejd d d Zejd d ddddejdd dddejddddejddedddejddddeejdkreedeZe ejejzeejej ej!Z"e#d eje"$WdSe%yZ&ze'j(ej)krddl*Z*e*+e,e-e&WYdZ&[&dSdZ&[&wwdS)!N)Resolver) SysCallError)version)logger)LDAPConnectionLDAPSessionErrorc@s4eZdZddZddZddZddZd d Zd S) CheckLDAPcCs||_||_||_dS)N)domaindc_iptimeout)selfr r r r /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/CheckLDAPStatus.py__init__s zCheckLDAP.__init__cCsXg}t}|j|_|jg|_|jd|jddd}|D] }|t|j dq|S)Nz_ldap._tcp.dc._msdcs.SRVT)tcp.) rr r nameserversresolver appendstrtargetrstrip)r dc_listresolverdc_querydcr r rlist_dc$s zCheckLDAP.list_dccCs`|}tdt|d|j|D]}||}||}td|d|d|qdS)NzFound z domain controller(s) in z Hostname: z > LDAP Signing Required: z" > LDAPS Channel Binding Status: )rlogginginfolenr check_ldap_signingcheck_ldaps_cbtprint)r rrsigning_requiredchannel_binding_statusr r rrun/s  z CheckLDAP.runc Csd}d|}zt|d}d|_|jd|jdW|Sty}zt|ddkr.d}nat|d dkrt|d}t|j}|d d d |d <t||_z |jd|jdWn;ty}zt|ddkrut d|d}WYd}~n"d}~wwt d|WYd}~|SWYd}~|SWYd}~|SWYd}~|Sd}~wt y}zt d||j d dvrd}nWYd}~|Sd}~ww)NNeverzldaps://)url )userr z data 80090346rAlwayszdata 52ez9LDAPS channel binding is set to 'When Supported' on host zWhen SupportedzYLDAPSessionError while checking for channel binding requirements (likely NTLM disabled): zHReceived SysCallError when trying to enumerate channel binding support: ) ECONNRESET WSAECONNRESETzUnexpected EOFz No TLS cert) rchannel_binding_valueloginr rrfind bytearraybytesrdebugrargs)r hostname cbt_statusldap_urlldap_connectionenew_cbvr r rr"7sR         zCheckLDAP.check_ldaps_cbtc Csd}d|}zt|dd}|j|jdtd|W|StyU}z*t|ddkr;td|d }ntd |WYd}~|SWYd}~|Sd}~ww) NFzldap://)r(signing)r z LDAP signing is not enforced on strongerAuthRequiredrzLDAP signing is enforced on TzQLDAPSessionError while checking for signing requirements (likely NTLM disabled): )rr3r rr7rrr4)r r9r$r;r<r=r r rr!Ws"   zCheckLDAP.check_ldap_signingN)__name__ __module__ __qualname__rrr&r"r!r r r rrs   r__main__Tz5LDAP signing and channel binding enumeration utility.)add_help descriptionz-dc-ipstorez ip addresszCIP Address of a domain controller or a DNS resolver for the domain.)requiredactionmetavarhelpz-domainz )rHrIrKz-debug store_truezTurn DEBUG output ON)rIrKz-timeoutr/z DNS timeout)rItypedefaultrKz-tsz&Adds timestamp to every logging outputr-zTargeted domain: ).argparsersys dns.resolverr OpenSSL.SSLrimpacketrimpacket.examplesrimpacket.ldap.ldaprrrrAr#BANNERArgumentParserparser add_argumentintr argv print_helpexit parse_argsoptionsinittsr7r r r dumperrr& Exceptionr= getLoggerlevelDEBUG traceback print_excerrorrr r r rsD    H