o j. @sddlmZddlmZddlmZddlZddlZddlZddlZddl m Z ddl m Z ddl m Z ddlmZdd lmZmZdd lmZmZGd d d Zed krCee jejdddZejddddejdddddejddddejddddejdddded Zejd!dd"d#dejd$dd%dejd&dd'dejd(dd)d*ded+Zejd,dd-d.dejd/dd0d1deej d2kre!e"d2e#Z$e%e$j&e$j'ee$j(e$j)e$j*e$j+e$j,\Z-Z.Z/Z0Z0e$_,e-d3kre1d4e"d2zee.e/e-e$Z2e23WdSe4yBZ5ze6j7ej8kr0ddl9Z9e9:e;eMz+GetADComputers.__init__..)rrrr)rrrrcSrrrrrrr"r#Sr$)options_GetADComputers__username_GetADComputers__password_GetADComputers__domain_GetADComputers__target_GetADComputers__lmhash_GetADComputers__nthashaesKey_GetADComputers__aesKeyk_GetADComputers__doKerberosdc_ip_GetADComputers__kdcIPdc_host_GetADComputers__kdcHostuser_GetADComputers__requestUser resolveIP_GetADComputers__resolveIPhashessplitbaseDN_GetADComputers__header_GetADComputers__colLenjoin enumerate_GetADComputers__outputFormat)selfusernamepassworddomaincmdLineOptions domainPartsirrr"__init__.s6        zGetADComputers.__init__cCs|d8}|d}|S)Nl}*{G ir)trrr" getUnixTimeUszGetADComputers.getUnixTimec Cst|tjdur dSd}d}d}d}z|jrd}tj}tjjddtj_|jgtjj_ |dD]}t |ddkrW|dd  d  d durW|dd  d }t |dd kr|dd  d  d dur|dd  d }ztjj|dd  d d dd} | D]} | j}qWnd}Yt |ddkr|dd  d  d dur|dd  d }t |ddkr|dd  d  d dur|dd  d }q2t|jj|||||gWdS|dD]}t |ddkr|dd  d  d dur|dd  d }t |dd krD|dd  d  d durD|dd  d }t |ddkri|dd  d  d duri|dd  d }t |ddkr|dd  d  d dur|dd  d }qt|jj||||gWdSty} ztjdddtdt | WYd} ~ dSd} ~ ww)NTrF) configure attributestypesAMAccountNamevalsrzutf-8$ dNSHostNameA)tcpzoperatingSystemoperatingSystemVersion Exception)exc_infoz-Skipping item, cannot process due to error %s) isinstancer SearchResultEntryr7dnsresolverResolverdefault_resolverr1 nameserversstrasOctetsdecodeendswithresolveaddressprintr?formatrUloggingdebugerror) r@itemrMrPrSrTresolvedIPAddressr6 attributeanswersrdataerrr" processRecord[sn    $    """"zGetADComputers.processRecordc Cst|j|j|j|j|j|j|j|j|j |j |j }|j |_t d|jt|jj|jtddd|jDd}zt d|tjdd}|j|gd d |g|jd Wn tjycw|dS) Nz)Querying %s for information about domain.z cSsg|]}d|qS)-r)ritemLenrrr"r#sz&GetADComputers.run..z2(&(objectCategory=computer)(objectClass=computer))zSearch Filter=%sd)size)rMrPrSrTr) searchFilterrK sizeLimitsearchControlsperRecordCallback)r r)r:r1r3r/r&r'r(r*r+r-_dstHostrfinfordr?rer;r=r<rgr SimplePagedResultsControlsearchroLDAPSearchErrorclose)r@ldapConnectionrtscrrr"runs2   zGetADComputers.runN)__name__ __module__ __qualname__rG staticmethodrIrorrrrr"r -s '  Br __main__Tz'Queries target domain for computer data)add_help descriptiontargetstorezdomain[/username[:password]])actionhelpz-userrAz Requests data for specific user )rmetavarrz-ts store_truez&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONz -resolveIPzZTries to resolve the IP address of computer objects, by performing the nslookup on the DC.authenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzsf           (