ADWS LDAP Beacon Object File

This repository is for a beacon object file that allos operators to query LDAP using Active Directory Web Services (ADWS).

This is still very much a work in progress

Example Usage

[06/05 17:10:53] beacon> adwsldapsearch --ip 192.168.1.100 --domain lab.local --username administrator --password nicetry --query (&(objectClass=user)(memberOf:1.2.840.113556.1.4.1941:=CN=Domain Admins,CN=Users,DC=lab,DC=local))
[06/05 17:10:53] [+] host called home, sent: 105470 bytes
[06/05 17:10:53] [+] received output:
[*] Object 1
  logonCount                    : 50
  codePage                      : 0
  objectCategory                : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
  description                   : Built-in account for administering the computer/domain
  uSNChanged                    : 69677
  instanceType                  : 4
  name                          : Administrator
  badPasswordTime               : 134243686929634297
  pwdLastSet                    : 134176712944191294
  objectClass                   : top
  objectClass                   : person
  objectClass                   : organizationalPerson
  objectClass                   : user
  badPwdCount                   : 0
  sAMAccountType                : 805306368
  lastLogonTimestamp            : 134249737202264337
  uSNCreated                    : 8196
  objectGUID                    : {4B2E7F70-8614-4EB5-88ED-BDA213DEFA50}
  memberOf                      : CN=Group Policy Creator Owners,CN=Users,DC=lab,DC=local
  memberOf                      : CN=Domain Admins,CN=Users,DC=lab,DC=local
  memberOf                      : CN=Enterprise Admins,CN=Users,DC=lab,DC=local
  memberOf                      : CN=Schema Admins,CN=Users,DC=lab,DC=local
  memberOf                      : CN=Administrators,CN=Builtin,DC=lab,DC=local
  whenCreated                   : 20260311141845.0Z
  userAccountControl            : 66048
  cn                            : Administrator
  countryCode                   : 0
  primaryGroupID                : 513
  whenChanged                   : 20260603152200.0Z
  dSCorePropagationData         : 20260311143504.0Z
  dSCorePropagationData         : 20260311143504.0Z
  dSCorePropagationData         : 20260311141954.0Z
  dSCorePropagationData         : 16010101181216.0Z
  lastLogon                     : 134249766192554339
  distinguishedName             : CN=Administrator,CN=Users,DC=lab,DC=local
  adminCount                    : 1
  isCriticalSystemObject        : TRUE
  sAMAccountName                : Administrator
  objectSid                     : S-1-5-21-1063646002-3733688200-3763894859-500
  lastLogoff                    : 0
  accountExpires                : 9223372036854775807
  container-hierarchy-parent    : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
  relativeDistinguishedName     : CN=Administrator
  distinguishedName             : CN=Administrator,CN=Users,DC=lab,DC=local

[06/05 17:10:53] [+] received output:
[*] Object 2
  logonCount                    : 44
  codePage                      : 0
  objectCategory                : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
  dSCorePropagationData         : 20260423165034.0Z
  dSCorePropagationData         : 16010101000000.0Z
  uSNChanged                    : 66772
  instanceType                  : 4
  name                          : domainuser1
  badPasswordTime               : 134237718550978880
  pwdLastSet                    : 134177141599763086
  objectClass                   : top
  objectClass                   : person
  objectClass                   : organizationalPerson
  objectClass                   : user
  badPwdCount                   : 0
  sAMAccountType                : 805306368
  lastLogonTimestamp            : 134246849608723280
  uSNCreated                    : 16429
  objectGUID                    : {6DEB9A5E-3ADA-4E21-93FA-5F7DB6EFAA7B}
  memberOf                      : CN=Domain Admins,CN=Users,DC=lab,DC=local
  whenCreated                   : 20260311144919.0Z
  userAccountControl            : 66048
  cn                            : domainuser1
  countryCode                   : 0
  primaryGroupID                : 513
  whenChanged                   : 20260531070920.0Z
  lastLogon                     : 134248849202713069
  distinguishedName             : CN=domainuser1,CN=Users,DC=lab,DC=local
  adminCount                    : 1
  sAMAccountName                : domainuser1
  objectSid                     : S-1-5-21-1063646002-3733688200-3763894859-1106
  lastLogoff                    : 0
  displayName                   : domainuser1
  accountExpires                : 9223372036854775807
  userPrincipalName             : domainuser1@lab.local
  container-hierarchy-parent    : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
  relativeDistinguishedName     : CN=domainuser1
  distinguishedName             : CN=domainuser1,CN=Users,DC=lab,DC=local

[06/05 17:10:53] [+] received output:
[*] Object 3
  logonCount                    : 0
  codePage                      : 0
  objectCategory                : CN=Person,CN=Schema,CN=Configuration,DC=lab,DC=local
  dSCorePropagationData         : 20260603152410.0Z
  dSCorePropagationData         : 16010101000000.0Z
  uSNChanged                    : 69679
  instanceType                  : 4
  name                          : labadmin
  badPasswordTime               : 0
  pwdLastSet                    : 134249731714679835
  objectClass                   : top
  objectClass                   : person
  objectClass                   : organizationalPerson
  objectClass                   : user
  badPwdCount                   : 0
  sAMAccountType                : 805306368
  lastLogonTimestamp            : 134249732251991876
  uSNCreated                    : 69659
  objectGUID                    : {95A0188B-C2DC-4C73-8628-EA786216A967}
  memberOf                      : CN=Domain Admins,CN=Users,DC=lab,DC=local
  whenCreated                   : 20260603151251.0Z
  userAccountControl            : 66048
  cn                            : labadmin
  countryCode                   : 0
  primaryGroupID                : 513
  whenChanged                   : 20260603152410.0Z
  lastLogon                     : 0
  distinguishedName             : CN=labadmin,CN=Users,DC=lab,DC=local
  adminCount                    : 1
  sAMAccountName                : labadmin
  objectSid                     : S-1-5-21-1063646002-3733688200-3763894859-1111
  lastLogoff                    : 0
  displayName                   : labadmin
  accountExpires                : 9223372036854775807
  userPrincipalName             : labadmin@lab.local
  container-hierarchy-parent    : 32b63b29-6ec4-4d64-9c73-da0cc9e026a6
  relativeDistinguishedName     : CN=labadmin
  distinguishedName             : CN=labadmin,CN=Users,DC=lab,DC=local

TODO

• Dervice DN from user provided domain (its currently hardcoded to my lab domain)
• Authenticate with current access token
• Specify FQDN or ip
• Add feature to allow operator to specify * in attributes with other attributes (example: *,ntsecuritydescriptor)
• Look into making output better
• Create complimentary Python script to convert output into BH JSON for ingestion
• Test and implement features like configuring RBCD, etc
• Cleanup code