admin/e-fin-ADWS-BOF
1
0
Fork 0
mirror of https://github.com/e-fin/ADWS-BOF synced 2026-06-23 09:33:17 +00:00
Code Issues Packages Projects Releases Wiki Activity

remove debug prints, update readme

Browse Source
This commit is contained in:
Your Name
2026-06-05 17:12:43 -04:00
parent 69bfe48941
commit ee91e0bdc6
2 changed files with 139 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
ADWS-BOF/adwsldap.cpp
+3 -5
View File
@@ -1383,9 +1383,7 @@ extern "C" {
}
else {
/* Unknown opcode — log and skip to avoid corrupting output */
BeaconPrintf(CALLBACK_OUTPUT,
"[nbfse] unknown value opcode 0x%02X at pos %llu\n",
opcode, (u64)r->pos);
}
if (with_end) return 2;
@@ -2762,13 +2760,13 @@ extern "C" {
char* presp = (char*)xml.data;
if (presp) {
size_t plen = adws_strlen(presp);
BeaconPrintf(CALLBACK_OUTPUT, "=== RAW DECODED XML (len=%llu) ===\n", plen);
for (size_t pi = 0; pi < plen; pi += 400) {
size_t chunk = plen - pi < 400 ? plen - pi : 400;
char tmp[401];
adws_memcpy(tmp, presp + pi, chunk);
tmp[chunk] = 0;
BeaconPrintf(CALLBACK_OUTPUT, "%s", tmp);
}
}
buf_free(&raw_responses[ri]);
README.md
+136
View File
@@ -4,9 +4,145 @@ This repository is for a beacon object file that allos operators to query LDAP u
This is still very much a work in progress
## Example Usage
```
[06/05 17:10:53] beacon> adwsldapsearch --ip 192.168.1.100 --domain lab.local --username administrator --password nicetry --query (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Domain Admins,CN=Users,DC=lab,DC=local))
[06/05 17:10:53] [+] host called home, sent: 105470 bytes
[06/05 17:10:53] [+] received output:
[*] Object 1
logonCount : 50
codePage : 0
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
description : Built-in account for administering the computer/domain
uSNChanged : 69677
instanceType : 4
name : Administrator
badPasswordTime : 134243686929634297
pwdLastSet : 134176712944191294
objectClass : top
objectClass : person
objectClass : organizationalPerson
objectClass : user
badPwdCount : 0
sAMAccountType : 805306368
lastLogonTimestamp : 134249737202264337
uSNCreated : 8196
objectGUID : {4B2E7F70-8614-4EB5-88ED-BDA213DEFA50}
memberOf : CN=Group Policy Creator Owners,CN=Users,DC=lab,DC=local
memberOf : CN=Domain Admins,CN=Users,DC=lab,DC=local
memberOf : CN=Enterprise Admins,CN=Users,DC=lab,DC=local
memberOf : CN=Schema Admins,CN=Users,DC=lab,DC=local
memberOf : CN=Administrators,CN=Builtin,DC=lab,DC=local
whenCreated : 20260311141845.0Z
userAccountControl : 66048
cn : Administrator
countryCode : 0
primaryGroupID : 513
whenChanged : 20260603152200.0Z
dSCorePropagationData : 20260311143504.0Z
dSCorePropagationData : 20260311143504.0Z
dSCorePropagationData : 20260311141954.0Z
dSCorePropagationData : 16010101181216.0Z
lastLogon : 134249766192554339
distinguishedName : CN=Administrator,CN=Users,DC=lab,DC=local
adminCount : 1
isCriticalSystemObject : TRUE
sAMAccountName : Administrator
objectSid : S-1-5-21-1063646002-3733688200-3763894859-500
lastLogoff : 0
accountExpires : 9223372036854775807
container-hierarchy-parent : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
relativeDistinguishedName : CN=Administrator
distinguishedName : CN=Administrator,CN=Users,DC=lab,DC=local
[06/05 17:10:53] [+] received output:
[*] Object 2
logonCount : 44
codePage : 0
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
dSCorePropagationData : 20260423165034.0Z
dSCorePropagationData : 16010101000000.0Z
uSNChanged : 66772
instanceType : 4
name : domainuser1
badPasswordTime : 134237718550978880
pwdLastSet : 134177141599763086
objectClass : top
objectClass : person
objectClass : organizationalPerson
objectClass : user
badPwdCount : 0
sAMAccountType : 805306368
lastLogonTimestamp : 134246849608723280
uSNCreated : 16429
objectGUID : {6DEB9A5E-3ADA-4E21-93FA-5F7DB6EFAA7B}
memberOf : CN=Domain Admins,CN=Users,DC=lab,DC=local
whenCreated : 20260311144919.0Z
userAccountControl : 66048
cn : domainuser1
countryCode : 0
primaryGroupID : 513
whenChanged : 20260531070920.0Z
lastLogon : 134248849202713069
distinguishedName : CN=domainuser1,CN=Users,DC=lab,DC=local
adminCount : 1
sAMAccountName : domainuser1
objectSid : S-1-5-21-1063646002-3733688200-3763894859-1106
lastLogoff : 0
displayName : domainuser1
accountExpires : 9223372036854775807
userPrincipalName : domainuser1@lab.local
container-hierarchy-parent : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
relativeDistinguishedName : CN=domainuser1
distinguishedName : CN=domainuser1,CN=Users,DC=lab,DC=local
[06/05 17:10:53] [+] received output:
[*] Object 3
logonCount : 0
codePage : 0
objectCategory : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
dSCorePropagationData : 20260603152410.0Z
dSCorePropagationData : 16010101000000.0Z
uSNChanged : 69679
instanceType : 4
name : labadmin
badPasswordTime : 0
pwdLastSet : 134249731714679835
objectClass : top
objectClass : person
objectClass : organizationalPerson
objectClass : user
badPwdCount : 0
sAMAccountType : 805306368
lastLogonTimestamp : 134249732251991876
uSNCreated : 69659
objectGUID : {95A0188B-C2DC-4C73-8628-EA786216A967}
memberOf : CN=Domain Admins,CN=Users,DC=lab,DC=local
whenCreated : 20260603151251.0Z
userAccountControl : 66048
cn : labadmin
countryCode : 0
primaryGroupID : 513
whenChanged : 20260603152410.0Z
lastLogon : 0
distinguishedName : CN=labadmin,CN=Users,DC=lab,DC=local
adminCount : 1
sAMAccountName : labadmin
objectSid : S-1-5-21-1063646002-3733688200-3763894859-1111
lastLogoff : 0
displayName : labadmin
accountExpires : 9223372036854775807
userPrincipalName : labadmin@lab.local
container-hierarchy-parent : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
relativeDistinguishedName : CN=labadmin
distinguishedName : CN=labadmin,CN=Users,DC=lab,DC=local
```
## TODO
- [ ] Dervice DN from user provided domain (its currently hardcoded to my lab domain)
- [ ] Authenticate with current access token
- [ ] Specify FQDN or ip
- [ ] Add feature to allow operator to specify * in attributes with other attributes (example: *,ntsecuritydescriptor)
- [ ] Look into making output better
- [ ] Create complimentary Python script to convert output into BH JSON for ingestion