badldap 0.6.0__tar.gz

badldap-0.6.0/LICENSE

@@ -0,0 +1,97 @@
+This projects contains two other project written by a 3rd party. 
+All code is licensed under MIT.
+
+License for badldap:
+MIT License
+
+Copyright (c) 2018 Tamas Jos (@skelsec)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+
+License for "asciitree":
+
+Copyright (c) 2015 Marc Brinkmann
+
+Permission is hereby granted, free of charge, to any person obtaining a
+copy of this software and associated documentation files (the "Software"),
+to deal in the Software without restriction, including without limitation
+the rights to use, copy, modify, merge, publish, distribute, sublicense,
+and/or sell copies of the Software, and to permit persons to whom the
+Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING
+FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+
+
+License for "aiocmd":
+
+MIT License
+
+Copyright (c) 2019 Dor Green
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+License for "Bloodhound.py":
+
+MIT License
+
+Copyright (c) 2018 Fox-IT
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

badldap-0.6.0/MANIFEST.in

@@ -0,0 +1,2 @@
+include LICENSE
+include README.md

badldap-0.6.0/PKG-INFO

@@ -0,0 +1,37 @@
+Metadata-Version: 2.4
+Name: badldap
+Version: 0.6.0
+Summary: Python library to play with MS LDAP
+Home-page: https://github.com/CravateRouge/badldap
+Author: Tamas Jos
+Author-email: info@skelsecprojects.com
+Maintainer: Baptiste Crépin
+Maintainer-email: baptiste@cravaterouge.com
+Classifier: Programming Language :: Python :: 3.7
+Classifier: Programming Language :: Python :: 3.8
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Operating System :: OS Independent
+Requires-Python: >=3.7
+License-File: LICENSE
+Requires-Dist: unicrypto>=0.0.10
+Requires-Dist: badauth>=0.1.0
+Requires-Dist: asysocks>=0.2.11
+Requires-Dist: asn1crypto>=1.3.0
+Requires-Dist: winacl>=0.1.8
+Requires-Dist: prompt-toolkit>=3.0.2
+Requires-Dist: tqdm
+Requires-Dist: wcwidth
+Requires-Dist: tabulate
+Dynamic: author
+Dynamic: author-email
+Dynamic: classifier
+Dynamic: description
+Dynamic: home-page
+Dynamic: license-file
+Dynamic: maintainer
+Dynamic: maintainer-email
+Dynamic: requires-dist
+Dynamic: requires-python
+Dynamic: summary
+
+Python library to play with MS LDAP

badldap-0.6.0/README.md

@@ -0,0 +1,102 @@
+# badldap
+LDAP library for MS AD
+
+# Documentation
+[Awesome documentation here!](https://msldap.readthedocs.io/en/latest/)
+
+# Features
+ - Comes with a built-in console LDAP client
+ - All parameters can be conrolled via a conveinent URL (see below)
+ - Supports integrated windows authentication (SSPI) both with NTLM and with KERBEROS
+ - Supports channel binding (for ntlm and kerberos not SSPI)
+ - Supports encryption (for NTLM/KERBEROS/SSPI)
+ - Supports LDAPS (TODO: actually verify certificate)
+ - Supports SOCKS5 proxy withot the need of extra proxifyer
+ - Minimal footprint
+ - A lot of pre-built queries for convenient information polling
+ - Easy to integrate to your project
+ - No testing suite
+
+# Installation
+Via GIT  
+`python3 setup.py install`  
+OR  
+`pip install badldap`
+
+# Prerequisites
+ - `asn1crypto` module. Some LDAP queries incorporate ASN1 structures to be sent on top of the ASN1 transport XD
+ - `asysocks` module. To support socks proxying.
+ - `aiocmd` For the interactive client
+ - `asciitree` For plotting nice trees in the interactive client
+ 
+# Usage
+Please note that this is a library, and was not intended to be used as a command line program.  
+Whit this noted, the projects packs a fully functional LDAP interactive client. When installing the `badldap` module with `setup.py install` a new binary will appear called `badldap`.
+
+# LDAP connection URL
+The major change was needed in version 0.2.0 to unify different connection options as one single string, without the need for additional command line switches.  
+The new connection string is composed in the following manner:  
+`<protocol>+<auth_method>://<domain>\<username>:<password>@<ip>:<port>/?<param>=<value>&<param>=<value>&...`  
+
+WARNING: URL special chars (@, :, /, ?, &, =) must be URL encoded!
+
+Detailed explanation with examples:  
+```	
+<protocol>+<auth>://<username>:<password>@<ip_or_host>:<port>/<tree>/?<param>=<value>
+
+
+	<protocol> sets the ldap protocol following values supported:
+		- ldap
+		- ldaps
+		- gc
+		- gc_ssl
+		
+	<auth> can be omitted if plaintext authentication is to be performed (in that case it default to ntlm-password), otherwise:
+		- ntlm-password
+		- ntlm-nt
+		- kerberos-password (dc option param must be used)
+		- kerberos-rc4 / kerberos-nt (dc option param must be used)
+		- kerberos-aes (dc option param must be used)
+		- kerberos-keytab (dc option param must be used)
+		- kerberos-ccache (dc option param must be used)
+		- kerberos-pfx (dc option param must be used)
+		- kerberos-pem (dc option param must be used)
+		- kerberos-certstore (dc option param must be used, windows only)
+		- sspi-ntlm (windows only!)
+		- sspi-kerberos (windows only!)
+		- anonymous
+		- plain
+		- simple
+		- sicily (same format as ntlm-nt but using the SICILY authentication)
+		
+	<tree>:
+		OPTIONAL. Specifies the root tree of all queries
+		
+	<param> can be:
+		- timeout : connection timeout in seconds
+		- proxytype: currently only socks5 proxy is supported
+		- proxyhost: Ip or hostname of the proxy server
+		- proxyport: port of the proxy server
+		- proxytimeout: timeout ins ecodns for the proxy connection
+		- dc: the IP address of the domain controller, MUST be used for kerberos authentication
+
+	Examples:
+	ldap://10.10.10.2 (anonymous bind)
+	ldaps://test.corp (anonymous bind)
+	ldap+sspi-ntlm://test.corp
+	ldap+sspi-kerberos://test.corp
+	ldap://TEST\\victim:<password>@10.10.10.2 (defaults to SASL GSSAPI NTLM)
+	ldap+simple://TEST\\victim:<password>@10.10.10.2 (SASL SIMPLE auth)
+	ldap+plain://TEST\\victim:<password>@10.10.10.2 (SASL SIMPLE auth)
+	ldap+ntlm-password://TEST\\victim:<password>@10.10.10.2
+	ldap+ntlm-nt://TEST\\victim:<nthash>@10.10.10.2
+	ldap+kerberos-password://TEST\\victim:<password>@<hostname>/?dc=10.10.10.2
+	ldap+kerberos-rc4://TEST\\victim:<rc4key>@<hostname>/?dc=10.10.10.2
+	ldap+kerberos-aes://TEST\\victim:<aes>@<hostname>/?dc=10.10.10.2
+	ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/
+	ldap://TEST\\victim:password@10.10.10.2/DC=test,DC=corp/?timeout=99&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080&proxytimeout=44
+```
+
+# Kudos
+Certificate services functionality was based on [certi](https://github.com/zer1t0/certi) created by @zer1t0
+AC-RN

badldap-0.6.0/badldap/__init__.py

@@ -0,0 +1,15 @@
+#!/usr/bin/env python3
+#
+# Author:
+#  Tamas Jos (@skelsec)
+#
+
+import logging
+
+logger = logging.getLogger(__name__)
+handler = logging.StreamHandler()
+formatter = logging.Formatter(
+        '%(asctime)s %(name)-12s %(levelname)-8s %(message)s')
+handler.setFormatter(formatter)
+logger.addHandler(handler)
+logger.setLevel(logging.INFO)

badldap-0.6.0/badldap/__main__.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python3
+#
+# Author:
+#  Tamas Jos (@skelsec)
+#
+
+import logging
+import csv
+from badldap.connection import MSLDAPClientConnection
+from badldap.commons.factory import LDAPConnectionFactory
+from badldap.ldap_objects import MSADUser, MSADMachine
+
+
+def run():
+	import argparse
+	parser = argparse.ArgumentParser(description='MS LDAP library')
+	parser.add_argument('-v', '--verbose', action='count', default=0, help='Verbosity, can be stacked')
+	parser.add_argument('connection', help='Connection string in URL format.')
+	parser.add_argument('--tree', help='LDAP tree to perform the searches on')
+	
+	subparsers = parser.add_subparsers(help = 'commands')
+	subparsers.required = True
+	subparsers.dest = 'command'
+	
+	dump_group = subparsers.add_parser('dump', help='Dump all user objects to TSV file')
+	dump_group.add_argument('outfile', help='output file')
+
+	spn_group = subparsers.add_parser('spn', help='Dump all users with servicePrincipalName attribute set to TSV file')
+	spn_group.add_argument('outfile', help='output file')
+
+	dsa_group = subparsers.add_parser('dsa', help='Grab basic info about the AD')
+
+	args = parser.parse_args()
+	
+	
+	###### VERBOSITY
+	if args.verbose == 0:
+		logging.basicConfig(level=logging.INFO)
+	else:
+		logging.basicConfig(level=logging.DEBUG)
+
+	url_dec = LDAPConnectionFactory.from_url(args.connection)
+	creds = url_dec.get_credential()
+	target = url_dec.get_target()
+	print(str(creds))
+	print(str(target))
+	connection = MSLDAPClientConnection(creds, target)
+
+	if args.command == 'dsa':
+		print(connection.get_server_info())
+
+	elif args.command == 'dump':
+		connection.connect()
+		adinfo = connection.get_ad_info()
+		with open(args.outfile, 'w', newline='', encoding = 'utf8') as f:
+			writer = csv.writer(f, delimiter = '\t')
+			writer.writerow(MSADUser.TSV_ATTRS)
+			for user in connection.get_all_user_objects():
+				writer.writerow(user.get_row(MSADUser.TSV_ATTRS))
+				
+		with open(args.outfile + '_comp', 'w', newline='', encoding = 'utf8') as f:
+			writer = csv.writer(f, delimiter = '\t')
+			writer.writerow(MSADMachine.TSV_ATTRS)
+			for comp in connection.get_all_machine_objects():
+				writer.writerow(comp.get_row(MSADMachine.TSV_ATTRS))
+
+	elif args.command == 'spn':
+		connection.connect()
+		adinfo, err = connection.get_ad_info()
+		with open(args.outfile, 'w', newline='', encoding = 'utf8') as f:
+			for user in connection.get_all_service_user_objects():
+				f.write(user.sAMAccountName + '\r\n')
+
+if __name__ == '__main__':
+	run()

badldap-0.6.0/badldap/_version.py

@@ -0,0 +1,8 @@
+
+__version__ = "0.6.0"
+__banner__ = \
+"""
+# badldap %s 
+# Original Author: Tamas Jos (@skelsec)
+# Current Maintainer: Baptiste Crépin (baptiste@cravaterouge.com)
+""" % __version__