o
    jI!                     @   s   d dl mZ d dlZd dlZd dlZd dlZd dlZd dlZd dlm	Z	m
Z
 e  edZG dd dZG dd dZd	d Zed
krJe  dS dS )    )unicode_literalsN)trust_flagstrust_directionsldd2bloodhoundc                   @   s$   e Zd Zedd Zedd ZdS )Utilsc                 C   s*   t jdd| | dd  t jddd  S )Nz,DC=.zDC=)flags   )resubfindI)ldap r   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/ldapdomaindump/convert.pyldap_to_domain   s   *zUtils.ldap_to_domainc                 C   sX   | d | d d d dd| d d d   |  f d| d v r(| d d d	S g d	S )
Ndn
attributes	objectSidr   group%s@%ssAMAccountNamememberOf)r   sidtype	principalr   )upper)groupodomainr   r   r   get_group_object   s   zUtils.get_group_objectN)__name__
__module____qualname__staticmethodr   r   r   r   r   r   r      s
    
r   c                   @   sV   e Zd Zdd Zdd Zdd Zdd Zd	d
 Zdd Zdd Z	dddZ
dd ZdS )BloodHoundConverterc                 C   s.   g | _ g | _g | _g | _i | _i | _i | _d S )N)computers_filestrust_filesgroup_files
user_filesgroups_by_dngroups_by_siddomaincache)selfr   r   r   __init__   s   
zBloodHoundConverter.__init__c                 C   sJ   | ddd }z| j| W S  ty$   t|| j|< | j|  Y S w )N-   r   )rsplitr+   KeyErrorr   r   )r,   r   r   dsidr   r   r   
get_domain*   s   zBloodHoundConverter.get_domainc              
   C   s   | j D ]G}t|dd}t|}W d    n1 sw   Y  |D ]&}t|| |d d d |d }|| j|d < || j	|d d d < q#qd S )Nrutf-8r   r   r   r   )
r'   codecsopenjsonloadr   r   r3   r)   r*   )r,   fileinfiledatar   
groupattrsr   r   r   build_mappings2   s   
$z"BloodHoundConverter.build_mappingsc              
   C   s   t ddd;}|d | jD ])}t |dd}t|}W d    n1 s)w   Y  |D ]}| || q0qW d    d S 1 sEw   Y  d S )Ngroup_membership.csvwr5   z"GroupName,AccountName,AccountType
r4   )r6   r7   writer(   r8   r9   write_entry_memberships)r,   outfiler:   r;   r<   userr   r   r   write_users>   s   

"zBloodHoundConverter.write_usersc              
   C   s   t ddd7}| jD ]*}t |dd}t|}W d    n1 s$w   Y  |D ]	}| ||d q+qW d    d S 1 sAw   Y  d S )Nr?   ar5   r4   computer)r6   r7   r%   r8   r9   rB   )r,   rC   r:   r;   r<   rG   r   r   r   write_computersI   s   
"z#BloodHoundConverter.write_computersc                 C   s   t ddd:}| j D ]+}|d D ]$}z|d| j| d |d df  W q ty7   td| Y qw qW d    d S 1 sDw   Y  d S )	Nr?   rF   r5   r   	%s,%s,%s
r   r   ,Unknown group %s. Not found in groups cache!)r6   r7   r)   valuesrA   r1   loggerwarning)r,   rC   r   membergroupr   r   r   write_groupsT   s   &"z BloodHoundConverter.write_groupsc              
   C   s&  dd t  D }tdddy}|d | jD ]g}t|dd}t|}W d    n1 s2w   Y  |D ]F}|d d	 d
 }|td @ rLd}nd}|td @ rWd}	nd}	t	
|d |d d d
 ||d d d
  |t|	g}
|d|
d  q9qW d    d S 1 sw   Y  d S )Nc                 S   s   i | ]	\}}||  qS r   )
capitalize).0meaningflagr   r   r   
<dictcomp>`   s    z4BloodHoundConverter.write_trusts.<locals>.<dictcomp>z
trusts.csvr@   r5   z>SourceDomain,TargetDomain,TrustDirection,TrustType,Transitive
r4   r   trustAttributesr   WITHIN_FORESTParentChildExternalNON_TRANSITIVEFTr   nametrustDirection,
)r   itemsr6   r7   rA   r&   r8   r9   r   r   r   strjoin)r,   direction_maprC   r:   r;   r<   trustr   	trustTypeisTransitiveoutr   r   r   write_trusts_   s2   

"z BloodHoundConverter.write_trustsrD   c           	   	   C   sV  |  |d d d |d }|dkr#d|d d d  | f }nd|d d d d d	  | f }d
|d v rh|d d
 D ]$}z| j| }|d|d ||f  W qC tyg   td| Y qCw |d d d ddd }z| jd||d d d f  }|d|d ||f  W d S  ty   td|d d d  Y d S w )Nr   r   r   r   rD   r   r   z%s.%sr   rI   r   rJ   r.   r/   z%s-%dprimaryGroupIDz*Unknown rid %d. Not found in groups cache!)	r3   r   r)   rA   r1   rL   rM   r0   r*   )	r,   entryrC   
entry_typer   r   r   rgroupr2   r   r   r   rB   }   s&   "(
z+BloodHoundConverter.write_entry_membershipsc              	   C   sh   | j | j| j| jd}|D ]$}|tjd }z||  | W q t	y1   t
d| Y qw d S )N)zdomain_users.jsonzdomain_groups.jsonzdomain_trusts.jsonzdomain_computers.jsonrg   zUnknown input file: %s)r(   r'   r&   r%   splitosseplowerappendr1   rL   debug)r,   infilesfilemapr:   filenamer   r   r   parse_files   s   zBloodHoundConverter.parse_filesN)rD   )r    r!   r"   r-   r3   r>   rE   rH   rO   rf   rB   ru   r   r   r   r   r$      s    
r$   c                  C   s   t jdd} | jdtdddd | jdd	d
dd |  }|jr&ttj	 t
 }||j t|jdkr=td d S t|jdkrKtd d S td |  td |  td |  td |  td |  td d S )Nz_LDAPDomainDump to BloodHound CSV converter utility. Supports users/computers/trusts conversion.)descriptionfiles+FILENAMEz_The ldapdomaindump json files to load. Required files: domain_users.json and domain_groups.json)r   nargsmetavarhelpz-dz--debug
store_truezEnable debug logger)actionr|   r   zTNo domain_groups.json files were specified. Need at least one to perform conversion.zSNo domain_users.json files were specified. Need at least one to perform conversion.zMapping groups...zProcessing userszProcessing groupszProcessing computerszProcessing trustszDone!)argparseArgumentParseradd_argumentr_   
parse_argsrq   rL   setLevelloggingDEBUGr$   ru   rw   lenr'   errorr(   r>   rE   rO   rH   rf   print)parserargs	converterr   r   r   r      s2   






__main__)
__future__r   r   rm   r   r8   r6   r
   ldapdomaindumpr   r   basicConfig	getLoggerrL   r   r$   r   r    r   r   r   r   <module>   s"    
 
