o
    àý°j�7  ã                
   @   sª  d dl mZ d dl mZ d dlZd dlZd dlZd dlmZ d dlm	Z	m
Z
mZ d dlmZ d dlmZmZ d dlmZmZ d d	lmZ d
d„ ZG dd„ dƒZedk�rSeejƒ ejddd�Zejdddd� ejdddd� ejdddd� ejdddd� ejdddd� ejddd d� e d!¡Zejd"dd#d$d%� ejd&dd'd� ejd(dd)d� ejd*dd+d,d%� e d-¡Zejd.dd/d0d%� ejd1dd2d3d%� eej ƒd4krÞe !¡  e "d4¡ e #¡ Z$e %e$j&e$j'¡ ee$j(e$j)e$j*e$j+e$j,ƒ\Z-Z.Z/Z0Z0e$_,e-d5k�re 1d6¡ e "d4¡ e$j2�re$j2Z3ne-Z3zee.e/e-e3e$ƒZ4e4 5¡  W dS  e6�yR Z7 ze 8¡ j9ej:k�r@d dl;Z;e; <¡  e =e>e7ƒ¡ W Y dZ7[7dS dZ7[7ww dS )7é    )Údivision)Úprint_functionN)Úversion)ÚUF_ACCOUNTDISABLEÚUF_TRUSTED_FOR_DELEGATIONÚ)UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION)Úlogger)Úparse_identityÚ
ldap_login)ÚldapÚldapasn1)Ú	ldaptypesc                 C   sb   d}|dkrd|  d¡ }nd| }| j|ddgdd	�}d
d„ |D ƒ}t|ƒdkr-d}|S d}|S )Nú-úN/Az(servicePrincipalName=HOST/%s)ú$z(servicePrincipalName=%s)ÚservicePrincipalNameÚdistinguishedNameé   ©ÚsearchFilterÚ
attributesÚ	sizeLimitc                 S   s   g | ]
}t |tjƒr|‘qS © )Ú
isinstancer   ÚSearchResultEntry)Ú.0Úitemr   r   úŽ/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/findDelegation.pyÚ
<listcomp>4   ó    z$checkIfSPNExists.<locals>.<listcomp>r   ÚYesÚNo)ÚrstripÚsearchÚlen)ÚldapConnectionÚsAMAccountNameÚrightsÚ	spnExistsÚqueryÚrespSpnExistsÚresultsr   r   r   ÚcheckIfSPNExists'   s   ýþr,   c                   @   s(   e Zd Zedd„ ƒZdd„ Zdd„ ZdS )ÚFindDelegationc                    sš   g }t |ƒD ]\‰ }t‡ fdd„| D ƒƒ}| t|t|ƒƒ¡ qd dd„ t |ƒD ƒ¡}t|j|Ž ƒ td dd„ |D ƒ¡ƒ | D ]	}t|j|Ž ƒ qAd S )Nc                    s   g | ]}t |ˆ  ƒ‘qS r   )r$   )r   Úrow©Úir   r   r   B   s    z-FindDelegation.printTable.<locals>.<listcomp>ú c                 S   s   g | ]
\}}d ||f ‘qS )z	{%d:%ds} r   )r   ÚnumÚwidthr   r   r   r   E   r   z  c                 S   s   g | ]}d | ‘qS )r   r   )r   ÚitemLenr   r   r   r   I   s    )Ú	enumerateÚmaxÚappendr$   ÚjoinÚprintÚformat)ÚitemsÚheaderÚcolLenÚcolÚ	rowMaxLenÚoutputFormatr.   r   r/   r   Ú
printTable>   s   ÿzFindDelegation.printTablec                 C   sî   || _ || _|| _d | _|| _d| _d| _|j| _|j	| _
|j| _|j| _|j| _|j| _|jd ur<|j d¡\| _| _| j d¡}d| _|D ]}|  jd| 7  _qG| jd d… | _|| jkrs| jsf| jrut d¡ d | _d | _d S d S d S )NÚ ú:Ú.zdc=%s,éÿÿÿÿzNKDC IP address and hostname will be ignored because of cross-domain targeting.)Ú_FindDelegation__usernameÚ_FindDelegation__passwordÚ_FindDelegation__domainÚ_FindDelegation__targetÚ_FindDelegation__targetDomainÚ_FindDelegation__lmhashÚ_FindDelegation__nthashÚaesKeyÚ_FindDelegation__aesKeyÚkÚ_FindDelegation__doKerberosÚdc_ipÚ_FindDelegation__kdcIPÚdc_hostÚ_FindDelegation__kdcHostÚuserÚ_FindDelegation__requestUserÚdisabledÚ_FindDelegation__disabledÚhashesÚsplitÚbaseDNÚloggingÚwarning)ÚselfÚusernameÚpasswordÚuser_domainÚtarget_domainÚcmdLineOptionsÚdomainPartsr0   r   r   r   Ú__init__O   s2   


ýzFindDelegation.__init__c                 C   s6  t | j| j| j| j| j| j| j| j| j	| j
| j| jdd�}|j| _d}| jr+|d7 }n|d7 }| jd ur<|d| j 7 }n|d7 }z|j|g d¢d	d
�}W n' tjys } z| ¡  d¡dkrht d¡ | ¡ }n‚ W Y d }~nd }~ww g }t dt|ƒ ¡ |D �]|}t|tjƒdur�q�d}d}d}	d}
d}g }d}�zF|d D �]}t|d ƒdkr·t|d d ƒ}d}nct|d ƒdkràt|d d ƒ}	t|	ƒt@ rÕd}
| d¡ nEt|	ƒt @ rßd}
d}n:t|d ƒdkrût|d d ƒ !d¡d  !d¡d }nt|d ƒdk�r|dk�rd}
|d D ]
}| t|ƒ¡ �qt|d ƒdk�r¾g }g }d }t"j#t$|d d ƒd!�}|d" j%D ]}|d#|d$ d%  &¡  d 7 }�q:| j�rU|d&7 }n|d'7 }|j|ddgd	d
�}|D ]6}t|tjƒdu�rr�qe| t|d d d d ƒ¡ | t|d d d d ƒ !d¡d  !d¡d ¡ �qe|du �r¾t'||ƒD ]\}}t(|||ƒ}| ||d(|t|ƒg¡ �q¦q¡|
d)v �rá|du �rá|D ]}t(|||ƒ}| |||
|t|ƒg¡ �qËW q� t)�yþ } zt *d*t|ƒ ¡ W Y d }~q�d }~ww t|ƒdk�r| j+|g d+¢d,� t,d-ƒ d S t,d.ƒ d S )/NT)rb   Úfqdnz´(&(|(UserAccountControl:1.2.840.113556.1.4.803:=16777216)(UserAccountControl:1.2.840.113556.1.4.803:=524288)(msDS-AllowedToDelegateTo=*)(msDS-AllowedToActOnBehalfOfOtherIdentity=*)z/)(UserAccountControl:1.2.840.113556.1.4.803:=2)z2)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))z(sAMAccountName:=%s))ú))r&   Ú
pwdLastSetÚuserAccountControlÚobjectCategoryú(msDS-AllowedToActOnBehalfOfOtherIdentityúmsDS-AllowedToDelegateToiç  r   ÚsizeLimitExceededr   zNsizeLimitExceeded exception caught, giving up and processing the data receivedzTotal of records returned %dFrB   r   Útyper&   Úvalsri   ÚUnconstrainedr   ú"Constrained w/ Protocol Transitionr   rj   ú=ú,rl   ú#Constrained w/o Protocol Transitionrk   z(&(|)ÚdataÚDaclz(objectSid=ÚAceÚSidz0)(UserAccountControl:1.2.840.113556.1.4.803:=2))z3)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))zResource-Based Constrained)rp   rt   rq   z-Skipping item, cannot process due to error %s)ÚAccountNameÚAccountTypeÚDelegationTypeÚDelegationRightsToz
SPN Exists)r<   z

zNo entries found!)-r
   rI   r[   rR   rT   rP   rF   rG   rH   rK   rL   rN   rJ   Ú_dstHostrX   rV   r#   r   ÚLDAPSearchErrorÚgetErrorStringÚfindr\   ÚdebugÚ
getAnswersr$   r   r   r   ÚstrÚintr   r7   r   rZ   r   ÚSR_SECURITY_DESCRIPTORÚbytesÚacesÚformatCanonicalÚzipr,   Ú	ExceptionÚerrorrA   r9   )r^   r%   r   ÚrespÚeÚanswersr   Ú
mustCommitr&   ri   Ú
delegationÚ
objectTypeÚrightsToÚprotocolTransitionÚ	attributeÚdelegRightsÚ
rbcdRightsÚrbcdObjTypeÚsdÚaceÚdelegUserRespÚitem2r'   ÚobjTyper(   r   r   r   Úrunp   s¸   :


ü
þ€ú

€&
 
6
€

€€þzFindDelegation.runN)Ú__name__Ú
__module__Ú__qualname__ÚstaticmethodrA   re   r�   r   r   r   r   r-   =   s
    
!r-   Ú__main__Tz3Queries target domain for delegation relationships )Úadd_helpÚdescriptionÚtargetÚstorezdomain[/username[:password]])ÚactionÚhelpz-target-domainzvDomain to query/request if different than the domain of the user. Allows for retrieving delegation info across trusts.z-tsÚ
store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz-userzRequests data for specific userz	-disabledzQuery disabled users tooÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r§   Úmetavarr¨   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addressz—IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter. Ignoredif -target-domain is specified.z-dc-hostÚhostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedr   rB   zuserDomain should be specified!)?Ú
__future__r   r   Úargparser\   ÚsysÚimpacketr   Úimpacket.dcerpc.v5.samrr   r   r   Úimpacket.examplesr   Úimpacket.examples.utilsr	   r
   Úimpacket.ldapr   r   r   r,   r-   rž   r9   ÚBANNERÚArgumentParserÚparserÚadd_argumentÚadd_argument_groupÚgroupr$   ÚargvÚ
print_helpÚexitÚ
parse_argsÚoptionsÚinitÚtsr�   r¥   rY   Úno_passrM   rO   Ú
userDomainr_   r`   Ú_Úcriticalrb   ÚtargetDomainÚexecuterr�   rŠ   r�   Ú	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excr‹   rƒ   r   r   r   r   Ú<module>   sl    
&



(


€üÈ