o j) @sddlmZddlmZddlZddlZddlZddlZddlmZddlm Z ddl m Z ddl m Z ddlmZdd lmZmZdd lmZGd d d eZGd ddZedkrcejjdurkedeje_ee jejdddZej ddddej ddddej ddddej dddde!dZ"e"j d dd!d"d#e"j d$dd!d%d#e"j d&d'd(gd)d(d*d+d,e!d-Z"e"j d.dd/d0d#e"j d1dd2de"j d3dd4de"j d5dd6d7d#e#ej$d8kre%e&d8e'Z(e )e(j*e(j+e e(j,\Z-Z.Z/Z0e-durd9Z-e(j1dure0e(_1e(j2dur de(_3e/d9krFe.d9krFe(j4durFe(j5d:urFe(j2durFdd;l6m6Z6e6d<Z/ee.e/e-e(j4e(j2e(j3e(j7e8e(j9e(j: Z;e;| dd } | d krd } n tt|| } | dtj@rd} nd} | dtj@rd} nd} |jdurtd|| | d| d| d| d| | | | ddd| ddd| df qmd|| f}t|d| dt|d| dt|d| dt|d| dt|d | dt|d!| dt|d"| t|d#| t|d$| t|d%| dqm|rPt |}d&|krGtd'dStd(|dStd)dS)*zDumps the list of users and shares registered present at remoteName. remoteName is a valid host name or IP address. z Retrieving endpoint list from %szncacn_np:%s[\pipe\samr]zStringBinding %sset_credentialsNTz#Name,RID,FullName,PrimaryGroupId,BadPasswordCount,LogonCount,PasswordLastSet,PasswordDoesNotExpire,AccountIsDisabled,AdminComment,UserComment,ScriptPathPasswordLastSetHighPart LowPartrzUserAccountControlTrueFalsez#%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%s,%sFullNamePrimaryGroupIdBadPasswordCount LogonCount UserComment,. AdminComment ScriptPathz%s (%d)z /FullName:z/AdminComment:z /UserComment:z/PrimaryGroupId:z/BadPasswordCount:z /LogonCount:z/PasswordLastSet:z/PasswordDoesNotExpire:z/AccountIsDisabled:z /ScriptPath:zReceived one entry.zReceived %d entries.zNo entries received.)!logginginfodebugr DCERPCTransportFactory set_dportr setRemoteHosthasattrr.rrrrrr set_kerberosrr_SAMRDump__fetchList Exceptioncriticalstrrprintr fromtimestampr-r USER_DONT_EXPIRE_PASSWORDUSER_ACCOUNT_DISABLEDreplacelen)r! remoteName remoteHostentries stringbinding rpctransporteentryr"uiduser pwdLastSet dontExpireaccountDisabledbasenumrrrdumpAsn          z SAMRDump.dumpc Cs|}g}||tjzt|}|d}t||}|dd}td|D] }td|dq,t d|ddt |||dd}tj |||dd }|d }t } d} | t krz tj ||| d }Wn ty} zt| d dkr| }WYd} ~ nd} ~ ww|ddD]>} t||tj| d } td| d| d ft|| dtjj}| d| d |ddf}||t|| dq|d} |d} | t kscWnty} z td| WYd} ~ nd} ~ ww||S)N ServerHandleBufferzFound domain(s):z . %sNamezLooking up users in domain %srDomainId) serverHandledomainId DomainHandle)enumerationContextr RelativeIdzFound user: %s, uid = %d UserHandleAllEnumerationContext ErrorCodezError listing users: %s) get_dce_rpcconnectbindr MSRPC_UUID_SAMR hSamrConnect hSamrEnumerateDomainsInSamServerrLr@rAhSamrLookupDomainInSamServerhSamrOpenDomainrhSamrEnumerateUsersInDomainr rKfind get_packet hSamrOpenUserMAXIMUM_ALLOWEDhSamrQueryInformationUser2USER_INFORMATION_CLASSUserAllInformationappendhSamrCloseHandler rJ disconnect)r!rVdcerTrespredomainsr$ domainHandlestatusrhrWrZrrArXrrr __fetchListsX     zSAMRDump.__fetchList) rrrNNFNrF)r rrr+ staticmethodr-r`rHrrrrr)s   Mr__main__utf8Tz>This script downloads the list of users for the target system.)add_help descriptiontargetstorez6[[domain/]username[:password]@])actionhelpz-csv store_truezTurn CSV outputz-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ON connectionz-dc-ipz ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter)rmetavarrz -target-ipzIP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve itz-port139445?zdestination portz)Destination port to connect to SMB Server)choicesnargsdefaultrrauthenticationz-hashesz LMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASHz-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyzsl                 8 (