admin/Pennyw0rth-NetExec
1
0
Fork 0
mirror of https://github.com/Pennyw0rth/NetExec synced 2026-06-06 16:34:30 +00:00
Code Issues Packages Projects Releases Wiki Activity

Address comments from NeffIsBack

Browse Source
This commit is contained in:
Max Harley
2025-05-30 11:51:42 -04:00
parent 74c252656a
commit 73dc41122a
1 changed files with 30 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
nxc/protocols/ldap.py
+30 -7
View File
@@ -201,7 +201,7 @@ class ldap(connection):
target_domain = sub(
r",DC=",
".",
base_dn[base_dn.lower().find("dc=") :],
base_dn[base_dn.lower().find("dc="):],
flags=IGNORECASE,
)[3:]
except ConnectionRefusedError as e:
@@ -322,7 +322,12 @@ class ldap(connection):
self.output_filename = os.path.expanduser(f"~/.nxc/logs/{self.hostname}_{self.host}".replace(":", "-"))
try:
self.db.add_host(self.host, self.hostname, self.domain, self.server_os)
self.db.add_host(
self.host,
self.hostname,
self.domain,
self.server_os
)
except Exception as e:
self.logger.debug(f"Error adding host {self.host} into db: {e!s}")
@@ -338,7 +343,7 @@ class ldap(connection):
self.logger.display(f"{self.server_os} (name:{self.hostname}) (domain:{self.domain}) ({signing}) ({cbt_status}) {ntlm}")
def kerberos_login(self, domain, username, password="", ntlm_hash="", aesKey="", kdcHost="", useCache=False):
self.username = username if not self.username else self.username # With ccache we get the username from the ticket
self.username = username if not self.username else self.username # With ccache we get the username from the ticket
self.password = password
self.domain = domain
self.kdcHost = kdcHost
@@ -870,12 +875,27 @@ class ldap(connection):
trust_direction = int(trust["trustDirection"])
trust_type = int(trust["trustType"])
trust_attributes = int(trust["trustAttributes"])
# See: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c
trust_attribute_flags = {0x1: "Non-Transitive", 0x2: "Uplevel-Only", 0x4: "Quarantined Domain", 0x8: "Forest Transitive", 0x10: "Cross Organization", 0x20: "Within Forest", 0x40: "Treat as External", 0x80: "Uses RC4 Encryption", 0x200: "Cross Organization No TGT Delegation", 0x800: "Cross Organization Enable TGT Delegation", 0x2000: "PAM Trust"}
trust_attribute_flags = {
0x1: "Non-Transitive",
0x2: "Uplevel-Only",
0x4: "Quarantined Domain",
0x8: "Forest Transitive",
0x10: "Cross Organization",
0x20: "Within Forest",
0x40: "Treat as External",
0x80: "Uses RC4 Encryption",
0x200: "Cross Organization No TGT Delegation",
0x800: "Cross Organization Enable TGT Delegation",
0x2000: "PAM Trust"
}
# For check if multiple posibble flags, like Uplevel-Only, Treat as External
trust_attributes_text = ", ".join(text for flag, text in trust_attribute_flags.items() if trust_attributes & flag) or "Other" # If Trust attrs not known
trust_attributes_text = ", ".join(
text for flag, text in trust_attribute_flags.items()
if trust_attributes & flag
) or "Other" # If Trust attrs not known
# Convert trust direction/type to human-readable format
direction_text = {
@@ -1091,7 +1111,10 @@ class ldap(connection):
self.logger.highlight(outputFormat.format(*row))
# Building the search filter
search_filter = f"(&(|(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION})(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_FOR_DELEGATION})(msDS-AllowedToDelegateTo=*)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE})))"
search_filter = (f"(&(|(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION})"
f"(UserAccountControl:1.2.840.113556.1.4.803:={UF_TRUSTED_FOR_DELEGATION})"
"(msDS-AllowedToDelegateTo=*)(msDS-AllowedToActOnBehalfOfOtherIdentity=*))"
f"(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_ACCOUNTDISABLE})))")
# f"(!(UserAccountControl:1.2.840.113556.1.4.803:={UF_SERVER_TRUST_ACCOUNT})))") This would filter out RBCD to DCs
attributes = ["sAMAccountName", "pwdLastSet", "userAccountControl", "objectCategory", "msDS-AllowedToActOnBehalfOfOtherIdentity", "msDS-AllowedToDelegateTo"]