admin/Pennyw0rth-NetExec
1
0
Fork 0
mirror of https://github.com/Pennyw0rth/NetExec synced 2026-06-06 16:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Update check_if_admin parse_result_attributes

Browse Source 
Signed-off-by: termanix <50464194+termanix@users.noreply.github.com>
This commit is contained in:
termanix
2024-10-28 18:10:38 +02:00
committed by GitHub
parent 496ea65394
commit 3d186ec434
1 changed files with 13 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nxc/protocols/ldap.py
+13 -13
View File
@@ -656,33 +656,33 @@ class ldap(connection):
search_filter = "(userAccountControl:1.2.840.113556.1.4.803:=8192)"
attributes = ["objectSid"]
resp = self.search(search_filter, attributes, sizeLimit=0)
resp_parse = parse_result_attributes(resp)
answers = []
if resp and (self.password != "" or self.lmhash != "" or self.nthash != "") and self.username != "":
for attribute in resp[0][1]:
if str(attribute["type"]) == "objectSid":
sid = self.sid_to_str(attribute["vals"][0])
self.sid_domain = "-".join(sid.split("-")[:-1])
for item in resp_parse:
sid = item.get("objectSid").encode("latin1")
sid = self.sid_to_str(sid)
self.sid_domain = "-".join(sid.split("-")[:-1])
# 2. get all group cn name
search_filter = "(|(objectSid=" + self.sid_domain + "-512)(objectSid=" + self.sid_domain + "-544)(objectSid=" + self.sid_domain + "-519)(objectSid=S-1-5-32-549)(objectSid=S-1-5-32-551))"
attributes = ["distinguishedName"]
resp = self.search(search_filter, attributes, sizeLimit=0)
resp_parse = parse_result_attributes(resp)
answers = []
for item in resp:
if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
continue
for attribute in item["attributes"]:
if str(attribute["type"]) == "distinguishedName":
answers.append(str("(memberOf:1.2.840.113556.1.4.1941:=" + attribute["vals"][0] + ")"))
for item in resp_parse:
answers.append(str("(memberOf:1.2.840.113556.1.4.1941:=" + item.get("distinguishedName") + ")"))
# 3. get member of these groups
search_filter = "(&(objectCategory=user)(sAMAccountName=" + self.username + ")(|" + "".join(answers) + "))"
attributes = [""]
resp = self.search(search_filter, attributes, sizeLimit=0)
answers = []
for item in resp:
if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
continue
resp_parse = parse_result_attributes(resp)
for item in resp_parse:
if item:
self.admin_privs = True