Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Improve LDAP dc-list flag #476

Merged
merged 7 commits into from
Jan 1, 2025
Merged
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
59 changes: 43 additions & 16 deletions nxc/protocols/ldap.py
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@
import hashlib
import hmac
import os
import socket
import dns.resolver
from binascii import hexlify
from datetime import datetime, timedelta
from re import sub, I
Expand Down Expand Up @@ -790,27 +790,54 @@ def groups(self):

def dc_list(self):
# Building the search filter
resolver = dns.resolver.Resolver()
resolver.nameservers = [self.host]

search_filter = "(&(objectCategory=computer)(primaryGroupId=516))"
attributes = ["dNSHostName"]
resp = self.search(search_filter, attributes, 0)
resp_parse = parse_result_attributes(resp)

for item in resp:
if isinstance(item, ldapasn1_impacket.SearchResultEntry) is not True:
continue
name = ""
for item in resp_parse:
name = item.get("dNSHostName", "") # Get dNSHostName attribute or empty string
try:
for attribute in item["attributes"]:
if str(attribute["type"]) == "dNSHostName":
name = str(attribute["vals"][0])
try:
ip_address = socket.gethostbyname(name.split(".")[0])
if ip_address is not True and name != "":
self.logger.highlight(f"{name} = {colored(ip_address, host_info_colors[0])}")
except socket.gaierror:
self.logger.fail(f"{name} = Connection timeout")
# Resolve using DNS server for A, AAAA, CNAME, PTR, and NS records
if name:
found_record = False # Flag to check if any record is found

for record_type in ["A", "AAAA", "CNAME", "PTR", "NS"]:
if found_record:
break # If a record has been found, stop checking further

try:
answers = resolver.resolve(name, record_type)
for rdata in answers:
if record_type in ["A", "AAAA"]:
ip_address = rdata.to_text()
self.logger.highlight(f"{name} = {colored(ip_address, host_info_colors[0])}")
found_record = True # Set flag to true since a record is found
elif record_type == "CNAME":
self.logger.highlight(f"{name} CNAME = {colored(rdata.to_text(), host_info_colors[0])}")
found_record = True
elif record_type == "PTR":
self.logger.highlight(f"{name} PTR = {colored(rdata.to_text(), host_info_colors[0])}")
found_record = True
elif record_type == "NS":
self.logger.highlight(f"{name} NS = {colored(rdata.to_text(), host_info_colors[0])}")
found_record = True
except dns.resolver.NXDOMAIN:
self.logger.fail(f"{name} = Host not found (NXDOMAIN)")
except dns.resolver.Timeout:
self.logger.fail(f"{name} = Connection timed out")
except dns.resolver.NoAnswer:
self.logger.fail(f"{name} = DNS server did not respond")
except Exception as e:
self.logger.fail(f"{name} encountered an unexpected error: {e}")
else:
self.logger.fail("dNSHostName value is empty, unable to process.")
except Exception as e:
self.logger.fail("Exception:", exc_info=True)
self.logger.fail(f"Skipping item, cannot process due to error {e}")
self.logger.fail("General Error:", exc_info=True)
self.logger.fail(f"Skipping item(dNSHostName) {name}, error: {e}")

def active_users(self):
if len(self.args.active_users) > 0:
Expand Down