[enhancement] Add output option for UNC path to stdout (#38)

* add default output of share in unc path form (copy/paste)

* add option to activate unc path output

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.13'
+
+      - name: Install dependencies from source
+        run: |
+          python -m pip install --upgrade pip
+          pip install -r requirements.txt
+
+      - name: Execute test command from source
+        run: |
+          python3 FindUncommonShares.py --help

FindUncommonShares.py

@@ -6,33 +6,31 @@
 
 
 from concurrent.futures import ThreadPoolExecutor
-from enum import Enum
-from impacket import version
 from impacket.smbconnection import SMBConnection, SMB2_DIALECT_002, SMB2_DIALECT_21, SMB_DIALECT, SessionError
-from impacket.spnego import SPNEGO_NegTokenInit, TypesMech
-from sectools.windows.ldap import raw_ldap_query, init_ldap_session
-from sectools.windows.crypto import nt_hash, parse_lm_nt_hashes
+from sectools.windows.ldap.wrappers import get_computers_from_domain, get_servers_from_domain, get_subnets
+from sectools.windows.ldap.ldap import raw_ldap_query, init_ldap_session
+from sectools.network.domains import is_fqdn
+from sectools.network.ip import is_ipv4_cidr, is_ipv4_addr, is_ipv6_addr, expand_cidr
+from sectools.windows.crypto import parse_lm_nt_hashes
 import argparse
-import binascii
 import dns.resolver
 import dns.exception
 import json
-import ldap3
-import logging
 import ntpath
 import os
 import random
 import re
 import sqlite3
 import socket
-import ssl
 import sys
 import threading
-import time
 import traceback
+import urllib.parse
 import xlsxwriter
 
-VERSION = "3.0"
+
+VERSION = "3.2"
+
 
 COMMON_SHARES = [
     "C$",
@@ -45,12 +43,22 @@ COMMON_SHARES = [
 
 class MicrosoftDNS(object):
     """
-    Documentation for class MicrosoftDNS
+    Class to interact with Microsoft DNS servers for resolving domain names to IP addresses.
+
+    Attributes:
+        dnsserver (str): The IP address of the DNS server.
+        verbose (bool): Flag to enable verbose mode.
+        auth_domain (str): The authentication domain.
+        auth_username (str): The authentication username.
+        auth_password (str): The authentication password.
+        auth_dc_ip (str): The IP address of the domain controller.
+        auth_lm_hash (str): The LM hash for authentication.
+        auth_nt_hash (str): The NT hash for authentication.
     """
 
     __wildcard_dns_cache = {}
 
-    def __init__(self, dnsserver, auth_domain, auth_username, auth_password, auth_dc_ip, auth_lm_hash, auth_nt_hash, verbose=False):
+    def __init__(self, dnsserver, auth_domain, auth_username, auth_password, auth_dc_ip, auth_lm_hash, auth_nt_hash, use_ldaps=False, verbose=False):
         super(MicrosoftDNS, self).__init__()
         self.dnsserver = dnsserver
         self.verbose = verbose
@@ -60,8 +68,22 @@ class MicrosoftDNS(object):
         self.auth_dc_ip = auth_dc_ip
         self.auth_lm_hash = auth_lm_hash
         self.auth_nt_hash = auth_nt_hash
+        self.use_ldaps = use_ldaps
 
     def resolve(self, target_name):
+        """
+        Documentation for class MicrosoftDNS
+
+        Attributes:
+            dnsserver (str): The IP address of the DNS server.
+            verbose (bool): Flag to enable verbose mode.
+            auth_domain (str): The authentication domain.
+            auth_username (str): The authentication username.
+            auth_password (str): The authentication password.
+            auth_dc_ip (str): The IP address of the domain controller.
+            auth_lm_hash (str): The LM hash for authentication.
+            auth_nt_hash (str): The NT hash for authentication.
+        """
         target_ips = []
         for rdtype in ["A", "AAAA"]:
             dns_answer = self.get_record(value=target_name, rdtype=rdtype)
@@ -73,6 +95,22 @@ class MicrosoftDNS(object):
         return target_ips
 
     def get_record(self, rdtype, value):
+        """
+        Retrieves DNS records for a specified value and record type using UDP and TCP protocols.
+
+        Parameters:
+            rdtype (str): The type of DNS record to retrieve.
+            value (str): The value for which the DNS record is to be retrieved.
+
+        Returns:
+            dns.resolver.Answer: The DNS answer containing the resolved records.
+
+        Raises:
+            dns.resolver.NXDOMAIN: If the domain does not exist.
+            dns.resolver.NoAnswer: If the domain exists but does not have the specified record type.
+            dns.resolver.NoNameservers: If no nameservers are found for the domain.
+            dns.exception.DNSException: For any other DNS-related exceptions.
+        """
         dns_resolver = dns.resolver.Resolver()
         dns_resolver.nameservers = [self.dnsserver]
         dns_answer = None
@@ -111,7 +149,17 @@ class MicrosoftDNS(object):
 
         return dns_answer
 
-    def check_wildcard_dns(self):
+    def check_presence_of_wildcard_dns(self):
+        """
+        Check the presence of wildcard DNS entries in the Microsoft DNS server.
+
+        This function queries the Microsoft DNS server to find wildcard DNS entries in the DomainDnsZones of the specified domain.
+        It retrieves information about wildcard DNS entries and prints a warning message if any are found.
+
+        Returns:
+            dict: A dictionary containing information about wildcard DNS entries found in the Microsoft DNS server.
+        """
+
         ldap_server, ldap_session = init_ldap_session(
             auth_domain=self.auth_domain,
             auth_dc_ip=self.auth_dc_ip,
@@ -119,7 +167,7 @@ class MicrosoftDNS(object):
             auth_password=self.auth_password,
             auth_lm_hash=self.auth_lm_hash,
             auth_nt_hash=self.auth_nt_hash,
-            use_ldaps=False
+            use_ldaps=self.use_ldaps
         )
 
         target_dn = "CN=MicrosoftDNS,DC=DomainDnsZones," + ldap_server.info.other["rootDomainNamingContext"][0]
@@ -188,9 +236,9 @@ def STYPE_MASK(stype_value):
         flags.append("STYPE_DEVICE")
     elif (stype_value & 0b11) == known_flags["STYPE_IPC"]:
         flags.append("STYPE_IPC")
-    if (stype_value & known_flags["STYPE_SPECIAL"]) == 0:
+    if (stype_value & known_flags["STYPE_SPECIAL"]) == known_flags["STYPE_SPECIAL"]:
         flags.append("STYPE_SPECIAL")
-    if (stype_value & known_flags["STYPE_TEMPORARY"]) == 0:
+    if (stype_value & known_flags["STYPE_TEMPORARY"]) == known_flags["STYPE_TEMPORARY"]:
         flags.append("STYPE_TEMPORARY")
     return flags
 
@@ -226,22 +274,58 @@ def export_xlsx(options, results):
     workbook = xlsxwriter.Workbook(path_to_file)
     worksheet = workbook.add_worksheet()
 
-    header_format = workbook.add_format({'bold': 1})
-    header_fields = ["Computer FQDN", "Computer IP", "Share name", "Share comment", "Is hidden"]
-    for k in range(len(header_fields)):
-        worksheet.set_column(k, k + 1, len(header_fields[k]) + 3)
-    worksheet.set_row(0, 20, header_format)
-    worksheet.write_row(0, 0, header_fields)
+    if options.check_user_access:
+        # Checking access rights
+        header_format = workbook.add_format({'bold': 1})
+        header_fields = ["Computer FQDN", "Computer IP", "Share name", "Share comment", "Is hidden", "UNC Path", "Readable", "Writable"]
+        for k in range(len(header_fields)):
+            worksheet.set_column(k, k + 1, len(header_fields[k]) + 3)
+        worksheet.set_row(0, 20, header_format)
+        worksheet.write_row(0, 0, header_fields)
 
-    row_id = 1
-    for computername in results.keys():
-        computer = results[computername]
-        for share in computer:
-            data = [share["computer"]["fqdn"], share["computer"]["ip"], share["share"]["name"], share["share"]["comment"], share["share"]["hidden"]]
-            worksheet.write_row(row_id, 0, data)
-            row_id += 1
-    worksheet.autofilter(0, 0, row_id, len(header_fields) - 1)
-    workbook.close()
+        row_id = 1
+        for computername in results.keys():
+            computer = results[computername]
+            for share in computer:
+                data = [
+                    share["computer"]["fqdn"],
+                    share["computer"]["ip"],
+                    share["share"]["name"],
+                    share["share"]["comment"],
+                    share["share"]["hidden"],
+                    share["share"]["uncpath"],
+                    share["share"]["access_rights"]["readable"],
+                    share["share"]["access_rights"]["writable"]
+                ]
+                worksheet.write_row(row_id, 0, data)
+                row_id += 1
+        worksheet.autofilter(0, 0, row_id, len(header_fields) - 1)
+        workbook.close()
+    else:
+        # Not checking access rights
+        header_format = workbook.add_format({'bold': 1})
+        header_fields = ["Computer FQDN", "Computer IP", "Share name", "Share comment", "Is hidden", "UNC Path"]
+        for k in range(len(header_fields)):
+            worksheet.set_column(k, k + 1, len(header_fields[k]) + 3)
+        worksheet.set_row(0, 20, header_format)
+        worksheet.write_row(0, 0, header_fields)
+
+        row_id = 1
+        for computername in results.keys():
+            computer = results[computername]
+            for share in computer:
+                data = [
+                    share["computer"]["fqdn"],
+                    share["computer"]["ip"],
+                    share["share"]["name"],
+                    share["share"]["comment"],
+                    share["share"]["hidden"],
+                    share["share"]["uncpath"],
+                ]
+                worksheet.write_row(row_id, 0, data)
+                row_id += 1
+        worksheet.autofilter(0, 0, row_id, len(header_fields) - 1)
+        workbook.close()
     print("done.")
 
 
@@ -291,7 +375,7 @@ def dns_resolve(options, target_name):
     if options.nameserver is not None:
         dns_resolver.nameservers = [options.nameserver]
     else:
-        dns_resolver.nameservers = [options.dc_ip]
+        dns_resolver.nameservers = [options.auth_dc_ip]
     dns_answer = None
 
     # Try UDP
@@ -333,46 +417,57 @@ def dns_resolve(options, target_name):
         return None
 
 
-def parse_args():
-    print("FindUncommonShares v%s - by @podalirius_\n" % VERSION)
+def parseArgs():
+    print("FindUncommonShares v%s - by Remi GASCOU (Podalirius)\n" % VERSION)
 
-    parser = argparse.ArgumentParser(add_help=True, description='Find uncommon SMB shares on remote machines.')
+    parser = argparse.ArgumentParser(add_help=True, description="Find uncommon SMB shares on remote machines.")
 
     parser.add_argument("-v", "--verbose", action="store_true", help="Verbose mode. (default: False).")
+    parser.add_argument("--print-unc", action="store_true", default=False, help="Print the corresponding UNC path.")
 
-    parser.add_argument("--use-ldaps", default=False, action="store_true", help="Use LDAPS instead of LDAP.")
     parser.add_argument("-q", "--quiet", dest="quiet", action="store_true", default=False, help="Show no information at all.")
     parser.add_argument("--debug", dest="debug", action="store_true", default=False, help="Debug mode. (default: False).")
     parser.add_argument("-no-colors", dest="colors", action="store_false", default=True, help="Disables colored output mode.")
     parser.add_argument("-t", "--threads", dest="threads", action="store", type=int, default=20, required=False, help="Number of threads (default: 20).")
-    parser.add_argument("-l", "--ldap-query", dest="ldap_query", type=str, default="(objectCategory=computer)", required=False, help="LDAP query to use to extract computers from the domain.")
     parser.add_argument("-ns", "--nameserver", dest="nameserver", default=None, required=False, help="IP of the DNS server to use, instead of the --dc-ip.")
 
-    # Shares
-    parser.add_argument("--check-user-access", default=False, action="store_true", help="Check if current user can access the share.")
-    parser.add_argument("--readable", default=False, action="store_true", help="Only list shares that current user has READ access to.")
-    parser.add_argument("--writable", default=False, action="store_true", help="Only list shares that current user has WRITE access to.")
-    parser.add_argument("-I", "--ignore-hidden-shares", dest="ignore_hidden_shares", action="store_true", default=False, help="Ignores hidden shares (shares ending with $)")
-    parser.add_argument("-i", "--ignore-share", default=[], dest="ignored_shares", action="append", required=False, help="Specify shares to ignore explicitly. (e.g., --ignore-share 'C$' --ignore-share 'Backup')")
-    parser.add_argument("-s", "--show-share", default=[], dest="accepted_shares", action="append", required=False, help="Specify shares to show explicitly. (e.g., --show-share 'C$' --show-share 'Backup')")
-
-    output = parser.add_argument_group('Output files')
-    output.add_argument("--export-xlsx", dest="export_xlsx", type=str, default=None, required=False, help="Output XLSX file to store the results in.")
-    output.add_argument("--export-json", dest="export_json", type=str, default=None, required=False, help="Output JSON file to store the results in.")
-    output.add_argument("--export-sqlite", dest="export_sqlite", type=str, default=None, required=False, help="Output SQLITE3 file to store the results in.")
-
-    authconn = parser.add_argument_group('Authentication & connection')
-    authconn.add_argument('--dc-ip', required=True, action='store', metavar="ip address", help='IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN) specified in the identity parameter')
-    authconn.add_argument("-d", "--domain", dest="auth_domain", metavar="DOMAIN", action="store", default="", help="(FQDN) domain to authenticate to")
-    authconn.add_argument("-u", "--user", dest="auth_username", metavar="USER", action="store", default="", help="user to authenticate with")
+    group_targets_source = parser.add_argument_group("Targets")
+    group_targets_source.add_argument("-tf", "--targets-file", default=None, type=str, help="Path to file containing a line by line list of targets.")
+    group_targets_source.add_argument("-tt", "--target", default=[], type=str, action='append', help="Target IP, FQDN or CIDR.")
+    group_targets_source.add_argument("-tu", "--target-url", default=[], type=str, action='append', help="Target URL to the tomcat manager.")
+    group_targets_source.add_argument("-tU", "--targets-urls-file", default=None, type=str, help="Path to file containing a line by line list of target URLs.")
+    group_targets_source.add_argument("-tp", "--target-ports", default="80,443,8080,8081,8180,9080,9081,10080", type=str, help="Target ports to scan top search for Apache Tomcat servers.")
+    group_targets_source.add_argument("-ad", "--auth-domain", default="", type=str, help="Windows domain to authenticate to.")
+    group_targets_source.add_argument("-ai", "--auth-dc-ip", default=None, type=str, help="IP of the domain controller.")
+    group_targets_source.add_argument("-au", "--auth-user", default=None, type=str, help="Username of the domain account.")
+    group_targets_source.add_argument("--ldaps", default=False, action="store_true", help="Use LDAPS (default: False)")
+    group_targets_source.add_argument("--no-ldap", default=False, action="store_true", help="Do not perform LDAP queries.")
+    group_targets_source.add_argument("--subnets", default=False, action="store_true", help="Get all subnets from the domain and use them as targets (default: False)")
+    group_targets_source.add_argument("-tl", "--target-ldap-query", dest="target_ldap_query", type=str, default=None, required=False, help="LDAP query to use to extract computers from the domain.")
 
     secret = parser.add_argument_group("Credentials")
     cred = secret.add_mutually_exclusive_group()
     cred.add_argument("--no-pass", default=False, action="store_true", help="Don't ask for password (useful for -k)")
-    cred.add_argument("-p", "--password", dest="auth_password", metavar="PASSWORD", action="store", default="", help="Password to authenticate with")
-    cred.add_argument("-H", "--hashes", dest="auth_hashes", action="store", metavar="[LMHASH:]NTHASH", help='NT/LM hashes, format is LMhash:NThash')
-    cred.add_argument("--aes-key", dest="auth_key", action="store", metavar="hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)')
-    secret.add_argument("-k", "--kerberos", dest="use_kerberos", action="store_true", help='Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line')
+    cred.add_argument("-ap", "--auth-password", default=None, type=str, help="Password of the domain account.")
+    cred.add_argument("-ah", "--auth-hashes", default=None, type=str, help="LM:NT hashes to pass the hash for this user.")
+    cred.add_argument("--aes-key", dest="auth_key", action="store", metavar="hex key", help="AES key to use for Kerberos Authentication (128 or 256 bits)")
+    secret.add_argument("-k", "--kerberos", dest="auth_use_kerberos", action="store_true", help="Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line")
+    secret.add_argument("--kdcHost", dest="auth_kdcHost", default=None, type=str, help="IP of the domain controller.")
+
+    # Shares
+    shares = parser.add_argument_group("Shares")
+    shares.add_argument("--check-user-access", dest="check_user_access", default=False, action="store_true", help="Check if current user can access the share.")
+    shares.add_argument("--readable", default=False, action="store_true", help="Only list shares that current user has READ access to.")
+    shares.add_argument("--writable", default=False, action="store_true", help="Only list shares that current user has WRITE access to.")
+    shares.add_argument("-iH", "--ignore-hidden-shares", dest="ignore_hidden_shares", action="store_true", default=False, help="Ignores hidden shares (shares ending with $)")
+    shares.add_argument("-iP", "--ignore-print-queues", dest="ignore_print_queues", action="store_true", default=False, help="Ignores print queues (shares of STYPE_PRINTQ)")
+    shares.add_argument("-i", "--ignore-share", default=[], dest="ignored_shares", action="append", required=False, help="Specify shares to ignore explicitly. (e.g., --ignore-share \"C$\" --ignore-share \"Backup\")")
+    shares.add_argument("-s", "--show-share", default=[], dest="accepted_shares", action="append", required=False, help="Specify shares to show explicitly. (e.g., --show-share \"C$\" --show-share \"Backup\")")
+
+    output = parser.add_argument_group("Output files")
+    output.add_argument("--export-xlsx", dest="export_xlsx", type=str, default=None, required=False, help="Output XLSX file to store the results in.")
+    output.add_argument("--export-json", dest="export_json", type=str, default=None, required=False, help="Output JSON file to store the results in.")
+    output.add_argument("--export-sqlite", dest="export_sqlite", type=str, default=None, required=False, help="Output SQLITE3 file to store the results in.")
 
     if len(sys.argv) == 1:
         parser.print_help()
@@ -380,9 +475,13 @@ def parse_args():
 
     options = parser.parse_args()
 
-    if options.auth_password is None and options.no_pass == False:
+    if options.auth_password is None and options.no_pass == False and options.auth_hashes is None:
+        print("[+] No password or hashes provided and --no-pass is '%s'" % options.no_pass)
         from getpass import getpass
-        options.auth_password = getpass("Password:")
+        if options.auth_domain is not None:
+            options.auth_password = getpass("  | Provide a password for '%s\\%s':" % (options.auth_domain, options.auth_user))
+        else:
+            options.auth_password = getpass("  | Provide a password for '%s':" % options.auth_user)
 
     if options.readable == True or options.writable == True:
         options.check_user_access = True
@@ -390,134 +489,164 @@ def parse_args():
     return options
 
 
-def print_results(options, sharename, address, sharecomment, access_rights):
-    # Share is not a common share
+def print_results(options, shareData):
+    try:
+        str_access_readable, str_colored_access_readable = "", ""
+        str_access_writable, str_colored_access_writable = "", ""
+        str_access, str_colored_access = "", ""
+        if options.check_user_access:
+            if shareData["share"]["access_rights"]["readable"] == True:
+                str_access_readable = "READ"
+                str_colored_access_readable = "\x1b[1;92mREAD\x1b[0m"
+            if shareData["share"]["access_rights"]["writable"] == True:
+                str_access_writable = "WRITE"
+                str_colored_access_writable = "\x1b[1;92mWRITE\x1b[0m"
+            if shareData["share"]["access_rights"]["readable"] == False and shareData["share"]["access_rights"]["writable"] == False:
+                str_access = "access: DENIED"
+                str_colored_access = "access: \x1b[1;91mDENIED\x1b[0m"
+            elif shareData["share"]["access_rights"]["readable"] == True and shareData["share"]["access_rights"]["writable"] == True:
+                str_access = "access: %s, %s" % (str_access_readable, str_access_writable)
+                str_colored_access = "access: %s, %s" % (str_colored_access_readable, str_colored_access_writable)
+            elif shareData["share"]["access_rights"]["readable"] == False and shareData["share"]["access_rights"]["writable"] == True:
+                str_access = "access: %s" % str_access_writable
+                str_colored_access = "access: %s" % str_colored_access_writable
+            elif shareData["share"]["access_rights"]["readable"] == True and shareData["share"]["access_rights"]["writable"] == False:
+                str_access = "access: %s" % str_access_readable
+                str_colored_access = "access: %s" % str_colored_access_readable
 
-    str_access_readable, str_colored_access_readable = "", ""
-    str_access_writable, str_colored_access_writable = "", ""
-    str_access, str_colored_access = "", ""
-    if options.check_user_access:
-        if access_rights["readable"] == True:
-            str_access_readable = "READ"
-            str_colored_access_readable = "\x1b[1;92mREAD\x1b[0m"
-        if access_rights["writable"] == True:
-            str_access_writable = "WRITE"
-            str_colored_access_writable = "\x1b[1;92mWRITE\x1b[0m"
-        if access_rights["readable"] == False and access_rights["writable"] == False:
-            str_access = "access: DENIED"
-            str_colored_access = "access: \x1b[1;91mDENIED\x1b[0m"
-        elif access_rights["readable"] == True and access_rights["writable"] == True:
-            str_access = "access: %s, %s" % (str_access_readable, str_access_writable)
-            str_colored_access = "access: %s, %s" % (str_colored_access_readable, str_colored_access_writable)
-        elif access_rights["readable"] == False and access_rights["writable"] == True:
-            str_access = "access: %s" % str_access_writable
-            str_colored_access = "access: %s" % str_colored_access_writable
-        elif access_rights["readable"] == True and access_rights["writable"] == False:
-            str_access = "access: %s" % str_access_readable
-            str_colored_access = "access: %s" % str_colored_access_readable
 
-    # Specific use cases
-    do_print_results = False
-    # Print all results
-    if options.readable == False and options.writable == False:
-        do_print_results = True
-    # print results for readable shares
-    if options.readable == True:
-        if access_rights["readable"] == True:
+        do_print_results = False
+        # Print all results
+        if options.readable == False and options.writable == False:
             do_print_results = True
-        else:
+        # Print results for readable shares
+        if options.readable == True:
+            if shareData["share"]["access_rights"]["readable"] == True:
+                do_print_results = True
+            else:
+                do_print_results = False
+        # Print results for writable shares
+        if options.writable == True:
+            if shareData["share"]["access_rights"]["writable"] == True:
+                do_print_results = True
+            else:
+                do_print_results = False
+
+        if (shareData["share"]["name"] in COMMON_SHARES):
+            # Ignore this common share
             do_print_results = False
-    # print results for writable shares
-    if options.writable == True:
-        if access_rights["writable"] == True:
+        if shareData["share"]["name"].endswith('$') and options.ignore_hidden_shares:
+            # Do not print hidden shares
+            do_print_results = False
+        if ("STYPE_PRINTQ" in shareData["share"]["type"]["stype_flags"]) and options.ignore_hidden_shares:
+            # Do not print hidden shares
+            do_print_results = False
+        if (shareData["share"]["name"] in options.ignored_shares):
+            # Ignore this specific share from the deny list
+            do_print_results = False
+        if (shareData["share"]["name"] in options.accepted_shares):
+            # Accept this specific share from the deny list
             do_print_results = True
-        else:
-            do_print_results = False
 
-    if not do_print_results:
-        return
+        if do_print_results:
+            if not options.quiet:
+                # Share has a comment
+                if len(shareData["share"]["comment"]) != 0:
+                    if options.colors:
+                        # Hidden share
+                        if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                            print("[>] Found '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_colored_access))
+                        # Not hidden share
+                        else:
+                            print("[>] Found '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_colored_access))
+                    else:
+                        # Default uncolored print
+                        print("[>] Found '%s' on '%s' (comment: '%s') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_access))
+                    
+                    if options.print_unc:
+                        print(f"[>] \\\\{shareData['computer']['fqdn']}\\{shareData['share']['name']}")
 
-    if ((sharename not in COMMON_SHARES) or (sharename in options.accepted_shares)) and (sharename not in options.ignored_shares):
-        if not options.quiet:
-            if len(sharecomment) != 0:
+                # Share has no comment
+                else:
+                    if options.colors:
+                        # Hidden share
+                        if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                            print("[>] Found '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_colored_access))
+                        # Not hidden share
+                        else:
+                            # Default uncolored print
+                            print("[>] Found '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_colored_access))
+                    else:
+                        # Hidden share
+                        if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                            print("[>] Found '%s' on '%s' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_access))
+                        # Not hidden share
+                        else:
+                            # Default uncolored print
+                            print("[>] Found '%s' on '%s' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_access))
+                    
+                    if options.print_unc:
+                        print(f"[>] \\\\{shareData['computer']['fqdn']}\\{shareData['share']['name']}")
+
+            else:
+                # Quiet mode, do not print anything
+                pass
+
+        # Debug mode in case of a common share
+        elif options.debug and not options.quiet:
+            # Share has a comment
+            if len(shareData["share"]["comment"]) != 0:
+                # Colored output
                 if options.colors:
                     # Hidden share
-                    if sharename.endswith('$') and not options.ignore_hidden_shares:
-                        print("[>] Found '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (sharename, address, sharecomment, str_colored_access))
+                    if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                        print("[>] Skipping common share '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_colored_access))
                     # Not hidden share
                     else:
-                        print("[>] Found '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (sharename, address, sharecomment, str_colored_access))
+                        # Default uncolored print
+                        print("[>] Skipping common share '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_colored_access))
+                # Not colored output
                 else:
-                    print("[>] Found '%s' on '%s' (comment: '%s') %s" % (sharename, address, sharecomment, str_access))
+                    # Default uncolored print
+                    print("[>] Skipping common share '%s' on '%s' (comment: '%s') %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], shareData["share"]["comment"], str_access))
+
+            # Share has no comment
             else:
+                # Colored output
                 if options.colors:
                     # Hidden share
-                    if sharename.endswith('$') and not options.ignore_hidden_shares:
-                        print("[>] Found '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (sharename, address, str_colored_access))
+                    if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                        print("[>] Skipping hidden share '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_colored_access))
                     # Not hidden share
                     else:
-                        print("[>] Found '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (sharename, address, str_colored_access))
+                        # Default uncolored print
+                        print("[>] Skipping common share '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_colored_access))
+
+                # Not colored output
                 else:
                     # Hidden share
-                    if sharename.endswith('$') and not options.ignore_hidden_shares:
-                        print("[>] Found '%s' on '%s' %s" % (sharename, address, str_access))
+                    if shareData["share"]["name"].endswith('$') and not options.ignore_hidden_shares:
+                        print("[>] Skipping hidden share '%s' on '%s' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_access))
                     # Not hidden share
                     else:
-                        print("[>] Found '%s' on '%s' %s" % (sharename, address, str_access))
-        else:
-            # Quiet mode, do not print anything
-            pass
-    # Debug mode in case of a common share
-    elif options.debug and not options.quiet:
+                        # Default uncolored print
+                        print("[>] Skipping common share '%s' on '%s' %s" % (shareData["share"]["name"], shareData["computer"]["fqdn"], str_access))
 
-        # Share has a comment
-        if len(sharecomment) != 0:
-
-            # Colored output
-            if options.colors:
-                # Hidden share
-                if sharename.endswith('$') and not options.ignore_hidden_shares:
-                    print("[>] Skipping common share '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (sharename, address, sharecomment, str_colored_access))
-                # Not hidden share
-                else:
-                    print("[>] Skipping common share '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' (comment: '\x1b[95m%s\x1b[0m') %s" % (sharename, address, sharecomment, str_colored_access))
-
-            # Not colored output
-            else:
-                print("[>] Skipping common share '%s' on '%s' (comment: '%s') %s" % (sharename, address, sharecomment, str_access))
-
-        # Share has no comment
-        else:
-            # Colored output
-            if options.colors:
-                # Hidden share
-                if sharename.endswith('$') and not options.ignore_hidden_shares:
-                    print("[>] Skipping common share '\x1b[94m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (sharename, address, str_colored_access))
-                # Not hidden share
-                else:
-                    print("[>] Skipping common share '\x1b[93m%s\x1b[0m' on '\x1b[96m%s\x1b[0m' %s" % (sharename, address, str_colored_access))
-
-            # Not colored output
-            else:
-                # Hidden share
-                if sharename.endswith('$'):
-                    if not options.ignore_hidden_shares:
-                        print("[>] Skipping common share '%s' on '%s' %s" % (sharename, address, str_access))
-                # Not hidden share
-                else:
-                    print("[>] Skipping common share '%s' on '%s' %s" % (sharename, address, str_access))
+    except Exception as e:
+        if options.debug:
+            traceback.print_exc()
 
 
 def get_machine_name(options, domain):
-    if options.dc_ip is not None:
-        s = SMBConnection(options.dc_ip, options.dc_ip)
+    if options.auth_dc_ip is not None:
+        s = SMBConnection(options.auth_dc_ip, options.auth_dc_ip)
     else:
         s = SMBConnection(domain, domain)
     try:
         s.login('', '')
     except Exception:
         if s.getServerName() == '':
-            raise Exception('Error while anonymous logging into %s' % domain)
+            raise Exception("Error while anonymous logging into %s" % domain)
     else:
         s.logoff()
     return s.getServerName()
@@ -557,10 +686,12 @@ def init_smb_session(options, target_ip, domain, username, password, address, lm
     else:
         if debug:
             print("[debug] SMBv3.0 dialect used")
-    if options.use_kerberos is True:
-        smbClient.kerberosLogin(username, password, domain, lmhash, nthash, options.aesKey, options.dc_ip)
+    #
+    if options.auth_use_kerberos is True:
+        smbClient.kerberosLogin(username, password, domain, lmhash, nthash, options.auth_key, options.auth_dc_ip)
     else:
         smbClient.login(username, password, domain, lmhash, nthash)
+    #
     if smbClient.isGuestSession() > 0:
         if debug:
             print("[debug] GUEST Session Granted")
@@ -570,129 +701,281 @@ def init_smb_session(options, target_ip, domain, username, password, address, lm
     return smbClient
 
 
-def worker(options, target_name, domain, username, password, address, lmhash, nthash, results, lock):
-    target_ip = dns_resolve(options, target_name)
+def worker(options, target, domain, username, password, lmhash, nthash, results, lock):
+    target_type, target_data = target
+
+    target_ip = None
+    target_name = ""
+    if target_type.lower() in ["ip", "ipv4", "ipv6"]:
+        target_name = target_data
+        target_ip = target_data
+
+    elif target_type.lower() in ["fqdn"]:
+        target_name = target_data
+        target_ip = dns_resolve(options, target_data)
+        if target_ip is not None:
+            if options.debug:
+                lock.acquire()
+                print("[+] Resolved '%s' to %s" % (target_name, target_ip))
+                lock.release()
+
     if target_ip is not None:
         if is_port_open(target_ip, 445):
             try:
-                smbClient = init_smb_session(options, target_ip, domain, username, password, address, lmhash, nthash)
+                smbClient = init_smb_session(options, target_ip, domain, username, password, target_ip, lmhash, nthash)
+
                 resp = smbClient.listShares()
+
                 for share in resp:
                     # SHARE_INFO_1 structure (lmshare.h)
                     # https://docs.microsoft.com/en-us/windows/win32/api/lmshare/ns-lmshare-share_info_1
-                    sharename = share['shi1_netname'][:-1]
-                    sharecomment = share['shi1_remark'][:-1]
-                    sharetype = share['shi1_type']
+                    sharename = share["shi1_netname"][:-1]
+                    sharecomment = share["shi1_remark"][:-1]
+                    sharetype = share["shi1_type"]
 
-                    access_rights = {}
+                    access_rights = {"readable": False, "writable": False}
                     if options.check_user_access:
                         access_rights = get_access_rights(smbClient, sharename)
 
+                    shareData = {
+                        "computer": {
+                            "fqdn": target_name,
+                            "ip": target_ip
+                        },
+                        "share": {
+                            "name": sharename,
+                            "comment": sharecomment,
+                            "hidden": (True if sharename.endswith('$') else False),
+                            "uncpath": "\\".join(['', '', target_name, sharename, '']),
+                            "type": {
+                                "stype_value": sharetype,
+                                "stype_flags": STYPE_MASK(sharetype)
+                            },
+                            "access_rights": access_rights
+                        }
+                    }
+
                     lock.acquire()
+
                     if target_name not in results.keys():
                         results[target_name] = []
-                    results[target_name].append(
-                        {
-                            "computer": {
-                                "fqdn": target_name,
-                                "ip": target_ip
-                            },
-                            "share": {
-                                "name": sharename,
-                                "comment": sharecomment,
-                                "hidden": (True if sharename.endswith('$') else False),
-                                "uncpath": "\\".join(['', '', target_ip, sharename, '']),
-                                "type": {
-                                    "stype_value": sharetype,
-                                    "stype_flags": STYPE_MASK(sharetype)
-                                },
-                                "access_rights": access_rights
-                            }
-                        }
-                    )
+                    results[target_name].append(shareData)
 
-                    print_results(options, sharename, address, sharecomment, access_rights)
+                    print_results(options=options, shareData=shareData)
 
                     lock.release()
 
             except Exception as err:
                 if options.debug:
                     lock.acquire()
-                    print(err)
+                    if options.debug:
+                        traceback.print_exc()
                     lock.release()
+        else:
+            if options.debug:
+                lock.acquire()
+                print("[!] Could not connect to '%s:445'" % target_ip)
+                lock.release()
 
     # DNS Resolution failed
     else:
         if options.debug:
             lock.acquire()
-            print("[!] Could not resolve")
+            print("[!] Could not resolve '%s'" % target_name)
             lock.release()
 
 
+def load_targets(options):
+    targets = []
+
+    # Loading targets from domain computers
+    if not options.no_ldap:
+        if options.auth_dc_ip is not None and options.auth_user is not None and (options.auth_password is not None or options.auth_hashes is not None) and options.target_ldap_query is None:
+            if options.debug:
+                print("[debug] Loading targets from computers in the domain '%s'" % options.auth_domain)
+            targets += get_computers_from_domain(
+                auth_domain=options.auth_domain,
+                auth_dc_ip=options.auth_dc_ip,
+                auth_username=options.auth_user,
+                auth_password=options.auth_password,
+                auth_hashes=options.auth_hashes,
+                auth_key=None,
+                use_ldaps=options.ldaps,
+                __print=False
+            )
+
+    # Loading targets from domain computers
+    if not options.no_ldap:
+        if options.auth_dc_ip is not None and options.auth_user is not None and (options.auth_password is not None or options.auth_hashes is not None) and options.target_ldap_query is not None:
+            if options.debug:
+                print("[debug] Loading targets from specfic LDAP query '%s'" % options.target_ldap_query)
+            computers = raw_ldap_query(
+                auth_domain=options.auth_domain,
+                auth_dc_ip=options.auth_dc_ip,
+                auth_username=options.auth_username,
+                auth_password=options.auth_password,
+                auth_hashes=options.auth_hashes,
+                query=options.target_ldap_query,
+                use_ldaps=options.use_ldaps,
+                attributes=["dNSHostName"]
+            )
+            for _, computer in computers:
+                targets.append(computer["dNSHostName"])
+
+    # Loading targets from subnetworks of the domain
+    if not options.no_ldap:
+        if options.subnets and options.auth_dc_ip is not None and options.auth_user is not None and (options.auth_password is not None or options.auth_hashes is not None):
+            if options.debug:
+                print("[debug] Loading targets from subnetworks of the domain '%s'" % options.auth_domain)
+            targets += get_subnets(
+                auth_domain=options.auth_domain,
+                auth_dc_ip=options.auth_dc_ip,
+                auth_username=options.auth_user,
+                auth_password=options.auth_password,
+                auth_hashes=options.auth_hashes,
+                auth_key=None,
+                use_ldaps=options.ldaps,
+                __print=True
+            )
+
+    # Loading targets line by line from a targets file
+    if options.targets_file is not None:
+        if os.path.exists(options.targets_file):
+            if options.debug:
+                print("[debug] Loading targets line by line from targets file '%s'" % options.targets_file)
+            f = open(options.targets_file, "r")
+            for line in f.readlines():
+                targets.append(line.strip())
+            f.close()
+        else:
+            print("[!] Could not open targets file '%s'" % options.targets_file)
+
+    # Loading targets from a single --target option
+    if len(options.target) != 0:
+        if options.debug:
+            print("[debug] Loading targets from --target options")
+        for target in options.target:
+            targets.append(target)
+
+    # Loading targets from a single --target-url option
+    if len(options.target_url) != 0:
+        if options.debug:
+            print("[debug] Loading targets from --target-url options")
+        for target in options.target_url:
+            targets.append(target)
+
+    # Loading target URLs line by line from a targets urls file
+    if options.targets_urls_file is not None:
+        if os.path.exists(options.targets_urls_file):
+            if options.debug:
+                print("[debug] Loading target URLs line by line from targets urls file '%s'" % options.targets_urls_file)
+            f = open(options.targets_urls_file, "r")
+            for line in f.readlines():
+                targets.append(line.strip())
+            f.close()
+        else:
+            print("[!] Could not open targets urls file '%s'" % options.targets_file)
+
+    # Sort uniq on targets list
+    targets = sorted(list(set(targets)))
+
+    final_targets = []
+    # Parsing target to filter IP/DNS/CIDR
+    for target in targets:
+        if target.startswith("http://") or target.startswith("https://"):
+            target = urllib.parse.urlparse(target).netloc
+        #
+        if is_ipv4_cidr(target):
+            final_targets += [("ip", ip) for ip in expand_cidr(target)]
+        elif is_ipv4_addr(target):
+            final_targets.append(("ipv4", target))
+        elif is_ipv6_addr(target):
+            final_targets.append(("ipv6", target))
+        elif is_fqdn(target):
+            final_targets.append(("fqdn", target))
+        else:
+            if options.debug:
+                print("[debug] Target '%s' was not added." % target)
+
+    final_targets = sorted(list(set(final_targets)))
+
+    return final_targets
+
+
 if __name__ == '__main__':
-    options = parse_args()
+    options = parseArgs()
+
+    # Parse hashes
+    if options.auth_hashes is not None:
+        if ":" not in options.auth_hashes:
+            options.auth_hashes = ":" + options.auth_hashes
     auth_lm_hash, auth_nt_hash = parse_lm_nt_hashes(options.auth_hashes)
 
-    mdns = MicrosoftDNS(
-        dnsserver=options.dc_ip,
-        auth_domain=options.auth_domain,
-        auth_username=options.auth_username,
-        auth_password=options.auth_password,
-        auth_dc_ip=options.dc_ip,
-        auth_lm_hash=auth_lm_hash,
-        auth_nt_hash=auth_nt_hash,
-        verbose=options.verbose
-    )
-    mdns.check_wildcard_dns()
+    # Use AES Authentication key if available
+    if options.auth_key is not None:
+        options.auth_use_kerberos = True
+    if options.auth_use_kerberos is True and options.auth_kdcHost is None:
+        print("[!] Specify KDC's Hostname of FQDN using the argument --kdcHost")
+        exit()
 
-    if not options.quiet:
-        print("[>] Extracting all computers ...")
+    try:
+        if options.auth_dc_ip is not None and options.auth_user is not None and (options.auth_password is not None or options.auth_hashes is not None):
+            mdns = MicrosoftDNS(
+                dnsserver=options.auth_dc_ip,
+                auth_domain=options.auth_domain,
+                auth_username=options.auth_user,
+                auth_password=options.auth_password,
+                auth_dc_ip=options.auth_dc_ip,
+                auth_lm_hash=auth_lm_hash,
+                auth_nt_hash=auth_nt_hash,
+                use_ldaps=options.ldaps,
+                verbose=options.verbose
+            )
+            mdns.check_presence_of_wildcard_dns()
 
-    computers = raw_ldap_query(
-        auth_domain=options.auth_domain,
-        auth_dc_ip=options.dc_ip,
-        auth_username=options.auth_username,
-        auth_password=options.auth_password,
-        auth_hashes=options.auth_hashes,
-        query=options.ldap_query,
-        attributes=["dNSHostName", "sAMAccountName"]
-    )
+        if not options.quiet:
+            print("[>] Parsing targets ...")
+            sys.stdout.flush()
 
-    if not options.quiet:
-        print("[+] Found %d computers in the domain. \n" % len(computers.keys()))
-        print("[>] Enumerating shares ...")
+        targets = load_targets(options)
 
-    results = {}
+        if not options.quiet:
+            print("[+] Found %d computers in the domain. \n" % len(targets))
+            print("[>] Enumerating shares ...")
 
-    if len(computers.keys()) != 0:
-        # Setup thread lock to properly write in the file
-        lock = threading.Lock()
-        # Waits for all the threads to be completed
-        with ThreadPoolExecutor(max_workers=min(options.threads, len(computers.keys()))) as tp:
-            for ck in computers.keys():
-                computer = computers[ck]
-                tp.submit(
-                    worker,
-                    options,
-                    computer['dNSHostName'],
-                    options.auth_domain,
-                    options.auth_username,
-                    options.auth_password,
-                    computer['dNSHostName'],
-                    auth_lm_hash,
-                    auth_nt_hash,
-                    results,
-                    lock
-                )
+        results = {}
+        if len(targets) != 0:
+            # Setup thread lock to properly write in the file
+            lock = threading.Lock()
+            # Waits for all the threads to be completed
+            with ThreadPoolExecutor(max_workers=min(options.threads, len(targets))) as tp:
+                for t in targets:
+                    tp.submit(
+                        worker,
+                        options,
+                        t,
+                        options.auth_domain,
+                        options.auth_user,
+                        options.auth_password,
+                        auth_lm_hash,
+                        auth_nt_hash,
+                        results,
+                        lock
+                    )
 
-        if options.export_json is not None:
-            export_json(options, results)
+            if options.export_json is not None:
+                export_json(options, results)
 
-        if options.export_xlsx is not None:
-            export_xlsx(options, results)
+            if options.export_xlsx is not None:
+                export_xlsx(options, results)
 
-        if options.export_sqlite is not None:
-            export_sqlite(options, results)
-    else:
-        print("[!] No computers in the domain found matching filter '%s'" % options.ldap_query)
-    print("[+] Bye Bye!")
+            if options.export_sqlite is not None:
+                export_sqlite(options, results)
+        else:
+            print("[!] No computers parsed from the targets.")
+        print("[+] Bye Bye!")
+
+    except Exception as e:
+        if options.debug:
+            traceback.print_exc()
+        print("[!] Error: %s" % str(e))

LICENSE

@@ -0,0 +1,339 @@
+                    GNU GENERAL PUBLIC LICENSE
+                       Version 2, June 1991
+
+ Copyright (C) 1989, 1991 Free Software Foundation, Inc.,
+ 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The licenses for most software are designed to take away your
+freedom to share and change it.  By contrast, the GNU General Public
+License is intended to guarantee your freedom to share and change free
+software--to make sure the software is free for all its users.  This
+General Public License applies to most of the Free Software
+Foundation's software and to any other program whose authors commit to
+using it.  (Some other Free Software Foundation software is covered by
+the GNU Lesser General Public License instead.)  You can apply it to
+your programs, too.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+this service if you wish), that you receive source code or can get it
+if you want it, that you can change the software or use pieces of it
+in new free programs; and that you know you can do these things.
+
+  To protect your rights, we need to make restrictions that forbid
+anyone to deny you these rights or to ask you to surrender the rights.
+These restrictions translate to certain responsibilities for you if you
+distribute copies of the software, or if you modify it.
+
+  For example, if you distribute copies of such a program, whether
+gratis or for a fee, you must give the recipients all the rights that
+you have.  You must make sure that they, too, receive or can get the
+source code.  And you must show them these terms so they know their
+rights.
+
+  We protect your rights with two steps: (1) copyright the software, and
+(2) offer you this license which gives you legal permission to copy,
+distribute and/or modify the software.
+
+  Also, for each author's protection and ours, we want to make certain
+that everyone understands that there is no warranty for this free
+software.  If the software is modified by someone else and passed on, we
+want its recipients to know that what they have is not the original, so
+that any problems introduced by others will not reflect on the original
+authors' reputations.
+
+  Finally, any free program is threatened constantly by software
+patents.  We wish to avoid the danger that redistributors of a free
+program will individually obtain patent licenses, in effect making the
+program proprietary.  To prevent this, we have made it clear that any
+patent must be licensed for everyone's free use or not licensed at all.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                    GNU GENERAL PUBLIC LICENSE
+   TERMS AND CONDITIONS FOR COPYING, DISTRIBUTION AND MODIFICATION
+
+  0. This License applies to any program or other work which contains
+a notice placed by the copyright holder saying it may be distributed
+under the terms of this General Public License.  The "Program", below,
+refers to any such program or work, and a "work based on the Program"
+means either the Program or any derivative work under copyright law:
+that is to say, a work containing the Program or a portion of it,
+either verbatim or with modifications and/or translated into another
+language.  (Hereinafter, translation is included without limitation in
+the term "modification".)  Each licensee is addressed as "you".
+
+Activities other than copying, distribution and modification are not
+covered by this License; they are outside its scope.  The act of
+running the Program is not restricted, and the output from the Program
+is covered only if its contents constitute a work based on the
+Program (independent of having been made by running the Program).
+Whether that is true depends on what the Program does.
+
+  1. You may copy and distribute verbatim copies of the Program's
+source code as you receive it, in any medium, provided that you
+conspicuously and appropriately publish on each copy an appropriate
+copyright notice and disclaimer of warranty; keep intact all the
+notices that refer to this License and to the absence of any warranty;
+and give any other recipients of the Program a copy of this License
+along with the Program.
+
+You may charge a fee for the physical act of transferring a copy, and
+you may at your option offer warranty protection in exchange for a fee.
+
+  2. You may modify your copy or copies of the Program or any portion
+of it, thus forming a work based on the Program, and copy and
+distribute such modifications or work under the terms of Section 1
+above, provided that you also meet all of these conditions:
+
+    a) You must cause the modified files to carry prominent notices
+    stating that you changed the files and the date of any change.
+
+    b) You must cause any work that you distribute or publish, that in
+    whole or in part contains or is derived from the Program or any
+    part thereof, to be licensed as a whole at no charge to all third
+    parties under the terms of this License.
+
+    c) If the modified program normally reads commands interactively
+    when run, you must cause it, when started running for such
+    interactive use in the most ordinary way, to print or display an
+    announcement including an appropriate copyright notice and a
+    notice that there is no warranty (or else, saying that you provide
+    a warranty) and that users may redistribute the program under
+    these conditions, and telling the user how to view a copy of this
+    License.  (Exception: if the Program itself is interactive but
+    does not normally print such an announcement, your work based on
+    the Program is not required to print an announcement.)
+
+These requirements apply to the modified work as a whole.  If
+identifiable sections of that work are not derived from the Program,
+and can be reasonably considered independent and separate works in
+themselves, then this License, and its terms, do not apply to those
+sections when you distribute them as separate works.  But when you
+distribute the same sections as part of a whole which is a work based
+on the Program, the distribution of the whole must be on the terms of
+this License, whose permissions for other licensees extend to the
+entire whole, and thus to each and every part regardless of who wrote it.
+
+Thus, it is not the intent of this section to claim rights or contest
+your rights to work written entirely by you; rather, the intent is to
+exercise the right to control the distribution of derivative or
+collective works based on the Program.
+
+In addition, mere aggregation of another work not based on the Program
+with the Program (or with a work based on the Program) on a volume of
+a storage or distribution medium does not bring the other work under
+the scope of this License.
+
+  3. You may copy and distribute the Program (or a work based on it,
+under Section 2) in object code or executable form under the terms of
+Sections 1 and 2 above provided that you also do one of the following:
+
+    a) Accompany it with the complete corresponding machine-readable
+    source code, which must be distributed under the terms of Sections
+    1 and 2 above on a medium customarily used for software interchange; or,
+
+    b) Accompany it with a written offer, valid for at least three
+    years, to give any third party, for a charge no more than your
+    cost of physically performing source distribution, a complete
+    machine-readable copy of the corresponding source code, to be
+    distributed under the terms of Sections 1 and 2 above on a medium
+    customarily used for software interchange; or,
+
+    c) Accompany it with the information you received as to the offer
+    to distribute corresponding source code.  (This alternative is
+    allowed only for noncommercial distribution and only if you
+    received the program in object code or executable form with such
+    an offer, in accord with Subsection b above.)
+
+The source code for a work means the preferred form of the work for
+making modifications to it.  For an executable work, complete source
+code means all the source code for all modules it contains, plus any
+associated interface definition files, plus the scripts used to
+control compilation and installation of the executable.  However, as a
+special exception, the source code distributed need not include
+anything that is normally distributed (in either source or binary
+form) with the major components (compiler, kernel, and so on) of the
+operating system on which the executable runs, unless that component
+itself accompanies the executable.
+
+If distribution of executable or object code is made by offering
+access to copy from a designated place, then offering equivalent
+access to copy the source code from the same place counts as
+distribution of the source code, even though third parties are not
+compelled to copy the source along with the object code.
+
+  4. You may not copy, modify, sublicense, or distribute the Program
+except as expressly provided under this License.  Any attempt
+otherwise to copy, modify, sublicense or distribute the Program is
+void, and will automatically terminate your rights under this License.
+However, parties who have received copies, or rights, from you under
+this License will not have their licenses terminated so long as such
+parties remain in full compliance.
+
+  5. You are not required to accept this License, since you have not
+signed it.  However, nothing else grants you permission to modify or
+distribute the Program or its derivative works.  These actions are
+prohibited by law if you do not accept this License.  Therefore, by
+modifying or distributing the Program (or any work based on the
+Program), you indicate your acceptance of this License to do so, and
+all its terms and conditions for copying, distributing or modifying
+the Program or works based on it.
+
+  6. Each time you redistribute the Program (or any work based on the
+Program), the recipient automatically receives a license from the
+original licensor to copy, distribute or modify the Program subject to
+these terms and conditions.  You may not impose any further
+restrictions on the recipients' exercise of the rights granted herein.
+You are not responsible for enforcing compliance by third parties to
+this License.
+
+  7. If, as a consequence of a court judgment or allegation of patent
+infringement or for any other reason (not limited to patent issues),
+conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot
+distribute so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you
+may not distribute the Program at all.  For example, if a patent
+license would not permit royalty-free redistribution of the Program by
+all those who receive copies directly or indirectly through you, then
+the only way you could satisfy both it and this License would be to
+refrain entirely from distribution of the Program.
+
+If any portion of this section is held invalid or unenforceable under
+any particular circumstance, the balance of the section is intended to
+apply and the section as a whole is intended to apply in other
+circumstances.
+
+It is not the purpose of this section to induce you to infringe any
+patents or other property right claims or to contest validity of any
+such claims; this section has the sole purpose of protecting the
+integrity of the free software distribution system, which is
+implemented by public license practices.  Many people have made
+generous contributions to the wide range of software distributed
+through that system in reliance on consistent application of that
+system; it is up to the author/donor to decide if he or she is willing
+to distribute software through any other system and a licensee cannot
+impose that choice.
+
+This section is intended to make thoroughly clear what is believed to
+be a consequence of the rest of this License.
+
+  8. If the distribution and/or use of the Program is restricted in
+certain countries either by patents or by copyrighted interfaces, the
+original copyright holder who places the Program under this License
+may add an explicit geographical distribution limitation excluding
+those countries, so that distribution is permitted only in or among
+countries not thus excluded.  In such case, this License incorporates
+the limitation as if written in the body of this License.
+
+  9. The Free Software Foundation may publish revised and/or new versions
+of the General Public License from time to time.  Such new versions will
+be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+Each version is given a distinguishing version number.  If the Program
+specifies a version number of this License which applies to it and "any
+later version", you have the option of following the terms and conditions
+either of that version or of any later version published by the Free
+Software Foundation.  If the Program does not specify a version number of
+this License, you may choose any version ever published by the Free Software
+Foundation.
+
+  10. If you wish to incorporate parts of the Program into other free
+programs whose distribution conditions are different, write to the author
+to ask for permission.  For software which is copyrighted by the Free
+Software Foundation, write to the Free Software Foundation; we sometimes
+make exceptions for this.  Our decision will be guided by the two goals
+of preserving the free status of all derivatives of our free software and
+of promoting the sharing and reuse of software generally.
+
+                            NO WARRANTY
+
+  11. BECAUSE THE PROGRAM IS LICENSED FREE OF CHARGE, THERE IS NO WARRANTY
+FOR THE PROGRAM, TO THE EXTENT PERMITTED BY APPLICABLE LAW.  EXCEPT WHEN
+OTHERWISE STATED IN WRITING THE COPYRIGHT HOLDERS AND/OR OTHER PARTIES
+PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESSED
+OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF
+MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE.  THE ENTIRE RISK AS
+TO THE QUALITY AND PERFORMANCE OF THE PROGRAM IS WITH YOU.  SHOULD THE
+PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF ALL NECESSARY SERVICING,
+REPAIR OR CORRECTION.
+
+  12. IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MAY MODIFY AND/OR
+REDISTRIBUTE THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES,
+INCLUDING ANY GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING
+OUT OF THE USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED
+TO LOSS OF DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY
+YOU OR THIRD PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER
+PROGRAMS), EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGES.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+convey the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software; you can redistribute it and/or modify
+    it under the terms of the GNU General Public License as published by
+    the Free Software Foundation; either version 2 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU General Public License for more details.
+
+    You should have received a copy of the GNU General Public License along
+    with this program; if not, write to the Free Software Foundation, Inc.,
+    51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
+
+Also add information on how to contact you by electronic and paper mail.
+
+If the program is interactive, make it output a short notice like this
+when it starts in an interactive mode:
+
+    Gnomovision version 69, Copyright (C) year name of author
+    Gnomovision comes with ABSOLUTELY NO WARRANTY; for details type `show w'.
+    This is free software, and you are welcome to redistribute it
+    under certain conditions; type `show c' for details.
+
+The hypothetical commands `show w' and `show c' should show the appropriate
+parts of the General Public License.  Of course, the commands you use may
+be called something other than `show w' and `show c'; they could even be
+mouse-clicks or menu items--whatever suits your program.
+
+You should also get your employer (if you work as a programmer) or your
+school, if any, to sign a "copyright disclaimer" for the program, if
+necessary.  Here is a sample; alter the names:
+
+  Yoyodyne, Inc., hereby disclaims all copyright interest in the program
+  `Gnomovision' (which makes passes at compilers) written by James Hacker.
+
+  <signature of Ty Coon>, 1 April 1989
+  Ty Coon, President of Vice
+
+This General Public License does not permit incorporating your program into
+proprietary programs.  If your program is a subroutine library, you may
+consider it more useful to permit linking proprietary applications with the
+library.  If this is what you want to do, use the GNU Lesser General
+Public License instead of this License.

README.md

@@ -1,4 +1,4 @@
-![](.github/banner.png)
+![](./.github/banner.png)
 
 <p align="center">
     The script <a href="https://github.com/p0dalirius/FindUncommonShares/blob/main/FindUncommonShares.py">FindUncommonShares.py</a> is a Python equivalent of <a href="https://github.com/darkoperator/Veil-PowerView/">PowerView</a>'s <a href="https://github.com/darkoperator/Veil-PowerView/blob/master/PowerView/functions/Invoke-ShareFinder.ps1">Invoke-ShareFinder.ps1</a> allowing to quickly find uncommon shares in vast Windows Active Directory Domains.
@@ -29,54 +29,91 @@
 
  + List all shares where your current user has WRITE access:
     ```
-    ./FindUncommonShares.py -u user -p 'Podalirius123!' -d DOMAIN --dc-ip 192.168.1.71 --writable
+    ./FindUncommonShares.py -au user -ap 'Podalirius123!' -ad DOMAIN --auth-dc-ip 192.168.1.71 --writable
     ```
  
  + Export list of shares in the domain to an Excel file for the client:
    ```
-   ./FindUncommonShares.py -u user -p 'Podalirius123!' -d DOMAIN --dc-ip 192.168.1.71 --export-xlsx ./examples/results.xlsx
+   ./FindUncommonShares.py -au user -ap 'Podalirius123!' -ad DOMAIN --auth-dc-ip 192.168.1.71 --export-xlsx ./examples/results.xlsx
    ```
 
  + List all shares with access rights for your current user:
     ```
-    ./FindUncommonShares.py -u user -p 'Podalirius123!' -d DOMAIN --dc-ip 192.168.1.71 --check-user-access
+    ./FindUncommonShares.py -au user -ap 'Podalirius123!' -ad DOMAIN --auth-dc-ip 192.168.1.71 --check-user-access
     ```
    
 ## Usage
 
 ```              
 $ ./FindUncommonShares.py -h
-FindUncommonShares v3.0 - by @podalirius_
+FindUncommonShares v3.2 - by Remi GASCOU (Podalirius)
 
-usage: FindUncommonShares.py [-h] [-v] [--use-ldaps] [-q] [--debug] [-no-colors] [-t THREADS] [-l LDAP_QUERY] [-ns NAMESERVER]
-                             [--check-user-access] [--readable] [--writable] [-I] [-i IGNORED_SHARES] [-s ACCEPTED_SHARES]
-                             [--export-xlsx EXPORT_XLSX] [--export-json EXPORT_JSON] [--export-sqlite EXPORT_SQLITE] --dc-ip ip
-                             address [-d DOMAIN] [-u USER] [--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key] [-k]
+usage: FindUncommonShares.py [-h] [-v] [-q] [--debug] [-no-colors] [-t THREADS] [-ns NAMESERVER] [-tf TARGETS_FILE] [-tt TARGET] [-tu TARGET_URL]
+                             [-tU TARGETS_URLS_FILE] [-tp TARGET_PORTS] [-ad AUTH_DOMAIN] [-ai AUTH_DC_IP] [-au AUTH_USER] [--ldaps] [--no-ldap] [--subnets]
+                             [-tl TARGET_LDAP_QUERY] [--no-pass | -ap AUTH_PASSWORD | -ah AUTH_HASHES | --aes-key hex key] [-k] [--kdcHost AUTH_KDCHOST]
+                             [--check-user-access] [--readable] [--writable] [-iH] [-iP] [-i IGNORED_SHARES] [-s ACCEPTED_SHARES] [--export-xlsx EXPORT_XLSX]
+                             [--export-json EXPORT_JSON] [--export-sqlite EXPORT_SQLITE]
 
 Find uncommon SMB shares on remote machines.
 
 options:
   -h, --help            show this help message and exit
   -v, --verbose         Verbose mode. (default: False).
-  --use-ldaps           Use LDAPS instead of LDAP.
   -q, --quiet           Show no information at all.
   --debug               Debug mode. (default: False).
   -no-colors            Disables colored output mode.
   -t THREADS, --threads THREADS
                         Number of threads (default: 20).
-  -l LDAP_QUERY, --ldap-query LDAP_QUERY
-                        LDAP query to use to extract computers from the domain.
   -ns NAMESERVER, --nameserver NAMESERVER
                         IP of the DNS server to use, instead of the --dc-ip.
+
+Targets:
+  -tf TARGETS_FILE, --targets-file TARGETS_FILE
+                        Path to file containing a line by line list of targets.
+  -tt TARGET, --target TARGET
+                        Target IP, FQDN or CIDR.
+  -tu TARGET_URL, --target-url TARGET_URL
+                        Target URL to the tomcat manager.
+  -tU TARGETS_URLS_FILE, --targets-urls-file TARGETS_URLS_FILE
+                        Path to file containing a line by line list of target URLs.
+  -tp TARGET_PORTS, --target-ports TARGET_PORTS
+                        Target ports to scan top search for Apache Tomcat servers.
+  -ad AUTH_DOMAIN, --auth-domain AUTH_DOMAIN
+                        Windows domain to authenticate to.
+  -ai AUTH_DC_IP, --auth-dc-ip AUTH_DC_IP
+                        IP of the domain controller.
+  -au AUTH_USER, --auth-user AUTH_USER
+                        Username of the domain account.
+  --ldaps               Use LDAPS (default: False)
+  --no-ldap             Do not perform LDAP queries.
+  --subnets             Get all subnets from the domain and use them as targets (default: False)
+  -tl TARGET_LDAP_QUERY, --target-ldap-query TARGET_LDAP_QUERY
+                        LDAP query to use to extract computers from the domain.
+
+Credentials:
+  --no-pass             Don't ask for password (useful for -k)
+  -ap AUTH_PASSWORD, --auth-password AUTH_PASSWORD
+                        Password of the domain account.
+  -ah AUTH_HASHES, --auth-hashes AUTH_HASHES
+                        LM:NT hashes to pass the hash for this user.
+  --aes-key hex key     AES key to use for Kerberos Authentication (128 or 256 bits)
+  -k, --kerberos        Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot
+                        be found, it will use the ones specified in the command line
+  --kdcHost AUTH_KDCHOST
+                        IP of the domain controller.
+
+Shares:
   --check-user-access   Check if current user can access the share.
   --readable            Only list shares that current user has READ access to.
   --writable            Only list shares that current user has WRITE access to.
-  -I, --ignore-hidden-shares
+  -iH, --ignore-hidden-shares
                         Ignores hidden shares (shares ending with $)
+  -iP, --ignore-print-queues
+                        Ignores print queues (shares of STYPE_PRINTQ)
   -i IGNORED_SHARES, --ignore-share IGNORED_SHARES
-                        Specify shares to ignore explicitly. (e.g., --ignore-share 'C$' --ignore-share 'Backup')
+                        Specify shares to ignore explicitly. (e.g., --ignore-share "C$" --ignore-share "Backup")
   -s ACCEPTED_SHARES, --show-share ACCEPTED_SHARES
-                        Specify shares to show explicitly. (e.g., --show-share 'C$' --show-share 'Backup')
+                        Specify shares to show explicitly. (e.g., --show-share "C$" --show-share "Backup")
 
 Output files:
   --export-xlsx EXPORT_XLSX
@@ -85,23 +122,6 @@ Output files:
                         Output JSON file to store the results in.
   --export-sqlite EXPORT_SQLITE
                         Output SQLITE3 file to store the results in.
-
-Authentication & connection:
-  --dc-ip ip address    IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the
-                        domain part (FQDN) specified in the identity parameter
-  -d DOMAIN, --domain DOMAIN
-                        (FQDN) domain to authenticate to
-  -u USER, --user USER  user to authenticate with
-
-Credentials:
-  --no-pass             Don't ask for password (useful for -k)
-  -p PASSWORD, --password PASSWORD
-                        Password to authenticate with
-  -H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH
-                        NT/LM hashes, format is LMhash:NThash
-  --aes-key hex key     AES key to use for Kerberos Authentication (128 or 256 bits)
-  -k, --kerberos        Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If
-                        valid credentials cannot be found, it will use the ones specified in the command line
 ```
 
 ## Exported results

requirements.txt

@@ -1,3 +1,5 @@
 impacket
 xlsxwriter
-sectools
+sectools>=1.5.1
+pycryptodome
+dnspython