././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.096881 bloodhound-1.8.0/0000775000175000017500000000000014735533117012446 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/LICENSE0000644000175000017500000000204713646103213013442 0ustar00useruserMIT License Copyright (c) 2018 Fox-IT Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.096881 bloodhound-1.8.0/PKG-INFO0000644000175000017500000000171514735533117013545 0ustar00useruserMetadata-Version: 2.1 Name: bloodhound Version: 1.8.0 Summary: Python based ingestor for BloodHound Home-page: https://github.com/dirkjanm/bloodhound.py Author: Dirk-jan Mollema, Edwin van Vliet, Matthijs Gielen Author-email: dirkjan@dirkjanm.io, edwin.vanvliet@fox-it.com, matthijs.gielen@fox-it.com Maintainer: Dirk-jan Mollema Maintainer-email: dirkjan@dirkjanm.io License: MIT Classifier: Intended Audience :: Information Technology Classifier: License :: OSI Approved :: MIT License Classifier: Programming Language :: Python :: 3.7 Classifier: Programming Language :: Python :: 3.8 Classifier: Programming Language :: Python :: 3.9 Classifier: Programming Language :: Python :: 3.10 Classifier: Programming Language :: Python :: 3.11 Classifier: Programming Language :: Python :: 3.12 License-File: LICENSE Requires-Dist: dnspython Requires-Dist: impacket>=0.9.17 Requires-Dist: ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5 Requires-Dist: pyasn1>=0.4 Requires-Dist: pycryptodome ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832407.0 bloodhound-1.8.0/README.md0000664000175000017500000001164014735531527013732 0ustar00useruser# BloodHound.py ![Python 3 compatible](https://img.shields.io/badge/python-3.x-blue.svg) ![PyPI version](https://img.shields.io/pypi/v/bloodhound.svg) ![License: MIT](https://img.shields.io/pypi/l/bloodhound.svg) BloodHound.py is a Python based ingestor for [BloodHound](https://github.com/BloodHoundAD/BloodHound), based on [Impacket](https://github.com/CoreSecurity/impacket/). The code in this branch is **only compatible with BloodHound 4.2 and 4.3**. For BloodHound CE, check out the [bloodhound-ce branch](https://github.com/dirkjanm/BloodHound.py/tree/bloodhound-ce) ## Installation There are different install methods for BloodHound Community Edition (CE) and BloodHound legacy. You can only have one of the two tools installed at the same time, unless you use a virtual environment for both tools, or a package manager like pipx that automatically sets these up. ### BloodHound Legacy The following install methods are available: * Via pip: `pip install bloodhound` * Via pipx: `pipx install bloodhound` * By cloning this repository `git clone https://github.com/dirkjanm/BloodHound.py` and running `pip install .` from the project directory. The BloodHound.py Legacy installation will add a command line tool `bloodhound-python` to your PATH. ### BloodHound CE The following install methods are available: * Via pip: `pip install bloodhound-ce` * Via pipx: `pipx install bloodhound-ce` * By cloning this repository `git clone https://github.com/dirkjanm/BloodHound.py`, checking out the CE branch `git checkout bloodhound-ce` and running `pip install .` from the project directory. The BloodHound.py CE ingestor will add a command line tool `bloodhound-ce-python` to your PATH. ## Usage To use the ingestor, at a minimum you will need credentials of the domain you're logging in to. Credentials can be specified as username + password, NT hash or AES keys, or a Kerberos TGT in a ccache file. You will need to specify the `-u` option with a username of this domain (or `username@domain` for a user in a trusted domain). If you have your DNS set up properly and the AD domain is in your DNS search list, then BloodHound.py will automatically detect the domain for you. If not, you have to specify it manually with the `-d` option. By default BloodHound.py will query LDAP and the individual computers of the domain to enumerate users, computers, groups, trusts, sessions and local admins. If you want to restrict collection, specify the `--collectionmethod` parameter, which supports the following options (similar to SharpHound): - *Default* - Performs group membership collection, domain trust collection, local admin collection, and session collection - *Group* - Performs group membership collection - *LocalAdmin* - Performs local admin collection - *RDP* - Performs Remote Desktop Users collection - *DCOM* - Performs Distributed COM Users collection - *Container* - Performs container collection (GPO/Organizational Units/Default containers) - *PSRemote* - Performs Remote Management (PS Remoting) Users collection - *DCOnly* - Runs all collection methods that can be queried from the DC only, no connection to member hosts/servers needed. This is equal to Group,Acl,Trusts,ObjectProps,Container - *Session* - Performs session collection - *Acl* - Performs ACL collection - *Trusts* - Performs domain trust enumeration - *LoggedOn* - Performs privileged Session enumeration (requires local admin on the target) - *ObjectProps* - Performs Object Properties collection for properties such as LastLogon or PwdLastSet - *All* - Runs all methods above, except LoggedOn - *Experimental* - Connects to individual hosts to enumerate services and scheduled tasks that may have stored credentials Multiple collectionmethods should be separated by a comma, for example: `-c Group,LocalAdmin` You can override some of the automatic detection options, such as the hostname of the primary Domain Controller if you want to use a different Domain Controller with `-dc`, or specify your own Global Catalog with `-gc`. ## Limitations BloodHound.py currently has the following limitations: - Supports most, but not all BloodHound (SharpHound) features. Currently GPO local groups are not supported, all other collection methods are implemented. ## Docker usage 1. Build container ```docker build -t bloodhound .``` 2. Run container ```docker run -v ${PWD}:/bloodhound-data -it bloodhound``` After that you can run `bloodhound-python` inside the container, all data will be stored in the path from where you start the container. ## Credits BloodHound.py was originally written by Dirk-jan Mollema, Edwin van Vliet and Matthijs Gielen from [Fox-IT (NCC Group)](https://fox-it.com/). BloodHound.py is currently maintained by Dirk-jan Mollema from [Outsider Security](https://outsidersecurity.nl). The implementation and data model is based on the original tool from [SpecterOps](https://specterops.io). Many thanks to everyone who contributed by testing, submitting issues and pull requests over the years. ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.092881 bloodhound-1.8.0/bloodhound/0000775000175000017500000000000014735533117014603 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832010.0 bloodhound-1.8.0/bloodhound/__init__.py0000664000175000017500000004632514735530712016724 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import os, sys, logging, argparse, getpass, time, re, datetime from zipfile import ZipFile from bloodhound.ad.domain import AD, ADDC from bloodhound.ad.authentication import ADAuthentication from bloodhound.enumeration.computers import ComputerEnumerator from bloodhound.enumeration.memberships import MembershipEnumerator from bloodhound.enumeration.domains import DomainEnumerator """ BloodHound.py is a Python port of BloodHound, designed to run on Linux and Windows. """ class BloodHound(object): def __init__(self, ad): self.ad = ad self.ldap = None self.pdc = None self.sessions = [] def connect(self): if len(self.ad.dcs()) == 0: logging.error('Could not find a domain controller. Consider specifying a domain and/or DNS server.') sys.exit(1) if not self.ad.baseDN: logging.error('Could not figure out the domain to query. Please specify this manually with -d') sys.exit(1) pdc = self.ad.dcs()[0] logging.debug('Using LDAP server: %s', pdc) logging.debug('Using base DN: %s', self.ad.baseDN) if len(self.ad.kdcs()) > 0: kdc = self.ad.auth.kdc logging.debug('Using kerberos KDC: %s', kdc) logging.debug('Using kerberos realm: %s', self.ad.realm()) # Create a domain controller object self.pdc = ADDC(pdc, self.ad) # Create an object resolver self.ad.create_objectresolver(self.pdc) def run(self, collect, num_workers=10, disable_pooling=False, timestamp="", computerfile="", cachefile=None, exclude_dcs=False, fileNamePrefix=""): start_time = time.time() if cachefile: self.ad.load_cachefile(cachefile) # Check early if we should enumerate computers as well do_computer_enum = any(method in collect for method in ['localadmin', 'session', 'loggedon', 'experimental', 'rdp', 'dcom', 'psremote']) if 'group' in collect or 'objectprops' in collect or 'acl' in collect: # Fetch domains for later, computers if needed self.pdc.prefetch_info('objectprops' in collect, 'acl' in collect, cache_computers=do_computer_enum) # Initialize enumerator membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling) membership_enum.enumerate_memberships(timestamp=timestamp, fileNamePrefix=fileNamePrefix) elif 'container' in collect: # Fetch domains for later, computers if needed self.pdc.prefetch_info('objectprops' in collect, 'acl' in collect, cache_computers=do_computer_enum) # Initialize enumerator membership_enum = MembershipEnumerator(self.ad, self.pdc, collect, disable_pooling) membership_enum.do_container_collection(timestamp=timestamp) elif do_computer_enum: # We need to know which computers to query regardless # We also need the domains to have a mapping from NETBIOS -> FQDN for local admins self.pdc.prefetch_info('objectprops' in collect, 'acl' in collect, cache_computers=True) elif 'trusts' in collect: # Prefetch domains self.pdc.get_domains('acl' in collect) if 'trusts' in collect or 'acl' in collect or 'objectprops' in collect: trusts_enum = DomainEnumerator(self.ad, self.pdc) trusts_enum.dump_domain(collect,timestamp=timestamp,fileNamePrefix=fileNamePrefix) if do_computer_enum: # If we don't have a GC server, don't use it for deconflictation have_gc = len(self.ad.gcs()) > 0 computer_enum = ComputerEnumerator(self.ad, self.pdc, collect, do_gc_lookup=have_gc, computerfile=computerfile, exclude_dcs=exclude_dcs) computer_enum.enumerate_computers(self.ad.computers, num_workers=num_workers, timestamp=timestamp, fileNamePrefix=fileNamePrefix) end_time = time.time() minutes, seconds = divmod(int(end_time-start_time),60) logging.info('Done in %02dM %02dS' % (minutes, seconds)) def resolve_collection_methods(methods): """ Convert methods (string) to list of validated methods to resolve """ valid_methods = ['group', 'localadmin', 'session', 'trusts', 'default', 'all', 'loggedon', 'objectprops', 'experimental', 'acl', 'dcom', 'rdp', 'psremote', 'dconly', 'container'] default_methods = ['group', 'localadmin', 'session', 'trusts'] # Similar to SharpHound, All is not really all, it excludes loggedon all_methods = ['group', 'localadmin', 'session', 'trusts', 'objectprops', 'acl', 'dcom', 'rdp', 'psremote', 'container'] # DC only, does not collect to computers dconly_methods = ['group', 'trusts', 'objectprops', 'acl', 'container'] if ',' in methods: method_list = [method.lower() for method in methods.split(',')] validated_methods = [] for method in method_list: if method not in valid_methods: logging.error('Invalid collection method specified: %s', method) return False if method == 'default': validated_methods += default_methods elif method == 'all': validated_methods += all_methods elif method == 'dconly': validated_methods += dconly_methods else: validated_methods.append(method) return set(validated_methods) else: validated_methods = [] # It is only one method = methods.lower() if method in valid_methods: if method == 'default': validated_methods += default_methods elif method == 'all': validated_methods += all_methods elif method == 'dconly': validated_methods += dconly_methods else: validated_methods.append(method) return set(validated_methods) else: logging.error('Invalid collection method specified: %s', method) return False def main(): # logging.basicConfig(stream=sys.stderr, level=logging.INFO) logger = logging.getLogger() logger.setLevel(logging.INFO) stream = logging.StreamHandler(sys.stderr) stream.setLevel(logging.DEBUG) formatter = logging.Formatter('%(levelname)s: %(message)s') # formatter = logging.Formatter('%(asctime)s %(levelname)s: %(message)s') stream.setFormatter(formatter) logger.addHandler(stream) parser = argparse.ArgumentParser(add_help=True, description='Python based ingestor for BloodHound LEGACY\nFor help or reporting issues, visit https://github.com/dirkjanm/BloodHound.py', formatter_class=argparse.RawDescriptionHelpFormatter) parser.add_argument('-c', '--collectionmethod', action='store', default='Default', help='Which information to collect. Supported: Group, LocalAdmin, Session, ' 'Trusts, Default (all previous), DCOnly (no computer connections), DCOM, RDP,' 'PSRemote, LoggedOn, Container, ObjectProps, ACL, All (all except LoggedOn). ' 'You can specify more than one by separating them with a comma. (default: Default)') parser.add_argument('-d', '--domain', action='store', default='', help='Domain to query.') parser.add_argument('-v', action='store_true', help='Enable verbose output') helptext = 'Specify one or more authentication options. \n' \ 'By default Kerberos authentication is used and NTLM is used as fallback. \n' \ 'Kerberos tickets are automatically requested if a password or hashes are specified.' auopts = parser.add_argument_group('authentication options', description=helptext) auopts.add_argument('-u', '--username', action='store', help='Username. Format: username[@domain]; If the domain is unspecified, the current domain is used.') auopts.add_argument('-p', '--password', action='store', help='Password') auopts.add_argument('-k', '--kerberos', action='store_true', help='Use kerberos ccache file') auopts.add_argument('--hashes', action='store', help='LM:NLTM hashes') auopts.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)') auopts.add_argument('-aesKey', action="store", metavar="hex key", help='AES key to use for Kerberos Authentication (128 or 256 bits)') auopts.add_argument('--auth-method', choices=('auto','ntlm','kerberos'), default='auto', action='store', help='Authentication methods. Force Kerberos or NTLM only or use auto for Kerberos with NTLM fallback') coopts = parser.add_argument_group('collection options') coopts.add_argument('-ns', '--nameserver', action='store', help='Alternative name server to use for queries') coopts.add_argument('--dns-tcp', action='store_true', help='Use TCP instead of UDP for DNS queries') coopts.add_argument('--dns-timeout', action='store', type=int, default=3, help='DNS query timeout in seconds (default: 3)') coopts.add_argument('-dc', '--domain-controller', metavar='HOST', action='store', help='Override which DC to query (hostname)') coopts.add_argument('-gc', '--global-catalog', metavar='HOST', action='store', help='Override which GC to query (hostname)') coopts.add_argument('-w', '--workers', action='store', type=int, default=10, help='Number of workers for computer enumeration (default: 10)') coopts.add_argument('--exclude-dcs', action='store_true', help='Skip DCs during computer enumeration') coopts.add_argument('--disable-pooling', action='store_true', help='Don\'t use subprocesses for ACL parsing (only for debugging purposes)') coopts.add_argument('--disable-autogc', action='store_true', help='Don\'t automatically select a Global Catalog (use only if it gives errors)') coopts.add_argument('--zip', action='store_true', help='Compress the JSON output files into a zip archive') coopts.add_argument('--computerfile', action='store', help='File containing computer FQDNs to use as allowlist for any computer based methods') coopts.add_argument('--cachefile', action='store', help='Cache file (experimental)') coopts.add_argument('--ldap-channel-binding', action='store_true', help='Use LDAP Channel Binding (will force ldaps protocol to be used)') coopts.add_argument('--use-ldaps', action='store_true', help='Use LDAP over TLS on port 636 by default') coopts.add_argument('-op', '--outputprefix', metavar='PREFIX_NAME', action='store', help='String to prepend to output file names') args = parser.parse_args() logging.info('BloodHound.py for BloodHound LEGACY (BloodHound 4.2 and 4.3)') if args.v is True: logger.setLevel(logging.DEBUG) if args.username is not None and args.password is not None: logging.debug('Authentication: username/password') auth = ADAuthentication(username=args.username, password=args.password, domain=args.domain, auth_method=args.auth_method, ldap_channel_binding=args.ldap_channel_binding) elif args.username is not None and args.password is None and args.hashes is None and args.aesKey is None and not args.no_pass: args.password = getpass.getpass() auth = ADAuthentication(username=args.username, password=args.password, domain=args.domain, auth_method=args.auth_method, ldap_channel_binding=args.ldap_channel_binding) elif args.username is None and (args.password is not None or args.hashes is not None): logging.error('Authentication: password or hashes provided without username') sys.exit(1) elif args.hashes is not None and args.username is not None: logging.debug('Authentication: NT hash') lm, nt = args.hashes.split(":") auth = ADAuthentication(lm_hash=lm, nt_hash=nt, username=args.username, domain=args.domain, auth_method=args.auth_method, ldap_channel_binding=args.ldap_channel_binding) elif args.aesKey is not None and args.username is not None: logging.debug('Authentication: Kerberos AES') auth = ADAuthentication(username=args.username, domain=args.domain, aeskey=args.aesKey, auth_method=args.auth_method, ldap_channel_binding=args.ldap_channel_binding) else: if not args.kerberos: parser.print_help() sys.exit(1) else: if not args.username: logging.error('Specifying the username explicitly is required for Kerberos ccache authentication') sys.exit(1) logging.debug('Authentication: Kerberos ccache') args.auth_method = 'kerberos' auth = ADAuthentication(username=args.username, password=args.password, domain=args.domain, auth_method=args.auth_method, ldap_channel_binding=args.ldap_channel_binding) ad = AD(auth=auth, domain=args.domain, nameserver=args.nameserver, dns_tcp=args.dns_tcp, dns_timeout=args.dns_timeout, use_ldaps=args.use_ldaps) # Resolve collection methods collect = resolve_collection_methods(args.collectionmethod) if not collect: return logging.debug('Resolved collection methods: %s', ', '.join(list(collect))) logging.debug('Using DNS to retrieve domain information') ad.dns_resolve(domain=args.domain, options=args) # Override the detected DC / GC if specified if args.domain_controller: if re.match(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', args.domain_controller): logging.error('The specified domain controller %s looks like an IP address, but requires a hostname (FQDN).\n'\ 'Use the -ns flag to specify a DNS server IP if the hostname does not resolve on your default nameserver.', args.domain_controller) sys.exit(1) ad.override_dc(args.domain_controller) logging.debug('Using supplied domain controller as KDC') auth.set_kdc(args.domain_controller) if args.global_catalog: if re.match(r'\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}', args.global_catalog): logging.error('The specified global catalog server %s looks like an IP address, but requires a hostname (FQDN).\n'\ 'Use the -ns flag to specify a DNS server IP if the hostname does not resolve on your default nameserver.', args.global_catalog) sys.exit(1) ad.override_gc(args.global_catalog) if args.auth_method in ('auto', 'kerberos'): if args.kerberos is True: if not auth.load_ccache(): logging.debug('Could not load ticket from ccache, trying to request a TGT instead') auth.get_tgt() else: auth.get_tgt() # For adding timestamp prefix to the outputfiles timestamp = datetime.datetime.fromtimestamp(time.time()).strftime('%Y%m%d%H%M%S') + "_" bloodhound = BloodHound(ad) bloodhound.connect() bloodhound.run(collect=collect, num_workers=args.workers, disable_pooling=args.disable_pooling, timestamp=timestamp, computerfile=args.computerfile, cachefile=args.cachefile, exclude_dcs=args.exclude_dcs, fileNamePrefix=args.outputprefix) #If args --zip is true, the compress output if args.zip: logging.info("Compressing output into " + timestamp + "bloodhound.zip") # Get a list of files in the current dir list_of_files = os.listdir(os.getcwd()) # Create handle to zip file with timestamp prefix if(args.outputprefix!=None): with ZipFile(args.outputprefix + "_" + timestamp + "bloodhound.zip",'w') as zip: # For each of those files we fetched for each_file in list_of_files: # If the files starts with the current timestamp and ends in json if each_file.startswith(args.outputprefix) and each_file.endswith("json"): # Write it to the zip zip.write(each_file) # Remove it from disk os.remove(each_file) else: with ZipFile(timestamp + "bloodhound.zip",'w') as zip: # For each of those files we fetched for each_file in list_of_files: # If the files starts with the current timestamp and ends in json if each_file.startswith(timestamp) and each_file.endswith("json"): # Write it to the zip zip.write(each_file) # Remove it from disk os.remove(each_file) if __name__ == '__main__': main() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/bloodhound/__main__.py0000644000175000017500000000007513646103213016663 0ustar00useruser#! /usr/bin/env python import bloodhound bloodhound.main() ././@PaxHeader0000000000000000000000000000003400000000000010212 xustar0028 mtime=1735833167.0948808 bloodhound-1.8.0/bloodhound/ad/0000775000175000017500000000000014735533117015167 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/bloodhound/ad/__init__.py0000644000175000017500000000215313646103213017265 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735829645.0 bloodhound-1.8.0/bloodhound/ad/authentication.py0000664000175000017500000004732714735524215020574 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import ssl import os import traceback from hashlib import sha256, md5 from bloodhound.ad.utils import CollectionException from binascii import unhexlify from cryptography import x509 from cryptography.hazmat.backends import default_backend from cryptography.hazmat.primitives import hashes import ldap3 from ldap3 import Server, Connection, NTLM, ALL, SASL, KERBEROS, Tls from ldap3.core.results import RESULT_STRONGER_AUTH_REQUIRED from ldap3.operation.bind import bind_operation from impacket.krb5.ccache import CCache from impacket.krb5.types import Principal, KerberosTime, Ticket from pyasn1.codec.der import decoder, encoder from impacket.krb5.asn1 import AP_REQ, AS_REP, TGS_REQ, Authenticator, TGS_REP, seq_set, seq_set_iter, PA_FOR_USER_ENC, \ Ticket as TicketAsn1, EncTGSRepPart from impacket.krb5 import constants from impacket.krb5.kerberosv5 import getKerberosTGT, getKerberosTGS, sendReceive from impacket.krb5.gssapi import CheckSumField, GSS_C_SEQUENCE_FLAG, GSS_C_REPLAY_FLAG, GSS_C_MUTUAL_FLAG import datetime from pyasn1.type.univ import noValue from impacket.spnego import SPNEGO_NegTokenInit, TypesMech """ Active Directory authentication helper """ class ADAuthentication(object): def __init__(self, username='', password='', domain='', lm_hash='', nt_hash='', aeskey='', kdc=None, auth_method='auto', ldap_channel_binding=False): self.username = username # Assume user domain and enum domain are same self.domain = domain.lower() self.userdomain = domain.lower() # If not, override userdomain if '@' in self.username: self.username, self.userdomain = self.username.lower().rsplit('@', 1) self.password = password self.lm_hash = lm_hash self.nt_hash = nt_hash self.aeskey = aeskey # KDC for domain we query self.kdc = kdc # KDC for domain of the user - fill with domain first, will be resolved later self.userdomain_kdc = self.domain self.auth_method = auth_method self.ldap_channel_binding = ldap_channel_binding # Kerberos self.tgt = None def set_aeskey(self, aeskey): self.aeskey = aeskey def set_kdc(self, kdc): # Set KDC self.kdc = kdc if self.userdomain == self.domain: # Also set it for user domain if this is equal self.userdomain_kdc = kdc def getLDAPConnection(self, hostname='', ip='', baseDN='', protocol='ldaps', gc=False): if gc: # Global Catalog connection if protocol == 'ldaps' or self.ldap_channel_binding is True: if self.ldap_channel_binding is True: if not hasattr(ldap3, 'TLS_CHANNEL_BINDING'): raise Exception("To use LDAP channel binding, install the patched ldap3 module: pip3 install git+https://github.com/ly4k/ldap3 or pip3 install ldap3-bleeding-edge") logging.debug("Using LDAPS channel binding") protocol = 'ldaps' version=ssl.PROTOCOL_TLSv1_2 tls = Tls(validate=ssl.CERT_NONE, version=version, ciphers='ALL:@SECLEVEL=0') server = Server( "%s://%s:3269" % (protocol,ip), use_ssl=True, get_info=ALL, tls=tls ) else: # Ldap SSL (no channel binding) server = Server("%s://%s:3269" % (protocol, ip), get_info=ALL) else: # Plain LDAP server = Server("%s://%s:3268" % (protocol, ip), get_info=ALL) else: # no GC specified if self.ldap_channel_binding is True: if not hasattr(ldap3, 'TLS_CHANNEL_BINDING'): raise Exception("To use LDAP channel binding, install the patched ldap3 module: pip3 install git+https://github.com/ly4k/ldap3 or pip3 install ldap3-bleeding-edge") logging.debug("Using LDAPS channel binding") protocol = 'ldaps' version=ssl.PROTOCOL_TLSv1_2 tls = Tls(validate=ssl.CERT_NONE, version=version, ciphers='ALL:@SECLEVEL=0') server = Server( "%s://%s" % (protocol,ip), use_ssl=True, get_info=ALL, tls=tls ) else: # No LDAP Channel Binding server = Server("%s://%s" % (protocol, ip), get_info=ALL) # ldap3 supports auth with the NT hash. LM hash is actually ignored since only NTLMv2 is used. if self.nt_hash != '': if self.lm_hash != '': ldappass = self.lm_hash + ':' + self.nt_hash else: # ldap3 requires a 32-character long string for LM hash in order to use the NT hash ldappass = 'aad3b435b51404eeaad3b435b51404ee:' + self.nt_hash else: ldappass = self.password ldaplogin = '%s\\%s' % (self.userdomain, self.username) bound = False if self.tgt is not None and self.auth_method in ('kerberos', 'auto'): conn = Connection(server, user=ldaplogin, auto_referrals=False, password=ldappass, authentication=SASL, sasl_mechanism=KERBEROS, receive_timeout=60, auto_range=True) logging.debug('Authenticating to LDAP server with Kerberos') try: bound = self.ldap_kerberos(conn, hostname) except Exception as exc: if self.auth_method == 'auto': logging.debug(traceback.format_exc()) logging.warning('Kerberos auth to LDAP failed, trying NTLM') bound = False else: logging.debug(traceback.format_exc()) logging.critical('Kerberos auth to LDAP failed, no authentication methods left') raise CollectionException('Could not authenticate to LDAP. Check your credentials and LDAP server requirements.') if not bound: conn = Connection(server, user=ldaplogin, auto_referrals=False, password=ldappass, authentication=NTLM, receive_timeout=60, auto_range=True) logging.debug('Authenticating to LDAP server with NTLM') if self.ldap_channel_binding: from ldap3 import TLS_CHANNEL_BINDING logging.debug("Using LDAPS channel binding") protocol = 'ldaps' channel_binding = {"channel_binding": TLS_CHANNEL_BINDING} conn = Connection(server, user=ldaplogin, password=ldappass, authentication=NTLM, auto_referrals=False, receive_timeout=60, auto_range=True, **channel_binding) else: conn = Connection(server, user=ldaplogin, auto_referrals=False, password=ldappass, authentication=NTLM, receive_timeout=60, auto_range=True) bound = conn.bind() if not bound: result = conn.result if result['result'] == RESULT_STRONGER_AUTH_REQUIRED and protocol == 'ldaps': logging.warning('LDAP Authentication is refused because LDAP Channel Binding is likely enabled. ' 'Trying to connect using LDAP Channel Binding') self.ldap_channel_binding = True return self.getLDAPConnection(hostname, ip, baseDN, 'ldaps') if result['result'] == RESULT_STRONGER_AUTH_REQUIRED and protocol == 'ldap': logging.warning('LDAP Authentication is refused because LDAP signing is enabled. ' 'Trying to connect over LDAPS instead...') return self.getLDAPConnection(hostname, ip, baseDN, 'ldaps') else: logging.error('Failure to authenticate with LDAP! Error %s : Code: %s' % (result['message'], result['result'])) raise CollectionException('Could not authenticate to LDAP. Check your credentials and LDAP server requirements.') return conn def ldap_kerberos(self, connection, hostname): # Hackery to authenticate with ldap3 using impacket Kerberos stack # Open ldap3 socket because we need it connection.open(read_server_info=False) username = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) servername = Principal('ldap/%s' % hostname, type=constants.PrincipalNameType.NT_SRV_INST.value) tgs, cipher, _, sessionkey = getKerberosTGS(servername, self.domain, self.kdc, self.tgt['KDC_REP'], self.tgt['cipher'], self.tgt['sessionKey']) # Let's build a NegTokenInit with a Kerberos AP_REQ blob = SPNEGO_NegTokenInit() # Kerberos blob['MechTypes'] = [TypesMech['MS KRB5 - Microsoft Kerberos 5']] # Let's extract the ticket from the TGS tgs = decoder.decode(tgs, asn1Spec=TGS_REP())[0] ticket = Ticket() ticket.from_asn1(tgs['ticket']) # Now let's build the AP_REQ apReq = AP_REQ() apReq['pvno'] = 5 apReq['msg-type'] = int(constants.ApplicationTagNumbers.AP_REQ.value) opts = [] apReq['ap-options'] = constants.encodeFlags(opts) seq_set(apReq, 'ticket', ticket.to_asn1) authenticator = Authenticator() authenticator['authenticator-vno'] = 5 authenticator['crealm'] = self.userdomain seq_set(authenticator, 'cname', username.components_to_asn1) now = datetime.datetime.utcnow() authenticator['cusec'] = now.microsecond authenticator['ctime'] = KerberosTime.to_asn1(now) peercert = None bindings = None try: peercert = connection.socket.getpeercert(binary_form=True) except AttributeError: # No TLS, skip pass if peercert: # Do TLS channel binding # The logic here is heavly inspired by "msldap", "minikerberos" and "asysocks" projects by @skelsec. # Adapted from ldap3 contributions by ThePirateWhoSmellsOfSunflowers peer_certificate = x509.load_der_x509_certificate(peercert, default_backend()) peer_certificate_hash_algorithm = peer_certificate.signature_hash_algorithm # RFC 5929 section 4.1 hashes list rfc5929_hashes_list = (hashes.MD5, hashes.SHA1) # section 4.1 hash function selection if isinstance(peer_certificate_hash_algorithm, rfc5929_hashes_list): digest = hashes.Hash(hashes.SHA256(), default_backend()) else: digest = hashes.Hash(peer_certificate_hash_algorithm, default_backend()) digest.update(peercert) peer_certificate_digest = digest.finalize() # https://datatracker.ietf.org/doc/html/rfc2744#section-3.11 channel_binding_struct = bytes() initiator_address = b'\x00'*8 acceptor_address = b'\x00'*8 # https://datatracker.ietf.org/doc/html/rfc5929#section-4 application_data_raw = b'tls-server-end-point:' + peer_certificate_digest len_application_data = len(application_data_raw).to_bytes(4, byteorder='little', signed = False) application_data = len_application_data application_data += application_data_raw channel_binding_struct += initiator_address channel_binding_struct += acceptor_address channel_binding_struct += application_data bindings = md5(channel_binding_struct).digest() # Add checksum to authenticator authenticator['cksum'] = noValue authenticator['cksum']['cksumtype'] = 0x8003 chkField = CheckSumField() chkField['Lgth'] = 16 if bindings: chkField['Bnd'] = bindings chkField['Flags'] = 0 authenticator['cksum']['checksum'] = chkField.getData() encodedAuthenticator = encoder.encode(authenticator) # Key Usage 11 # AP-REQ Authenticator (includes application authenticator # subkey), encrypted with the application session key # (Section 5.5.1) encryptedEncodedAuthenticator = cipher.encrypt(sessionkey, 11, encodedAuthenticator, None) apReq['authenticator'] = noValue apReq['authenticator']['etype'] = cipher.enctype apReq['authenticator']['cipher'] = encryptedEncodedAuthenticator blob['MechToken'] = encoder.encode(apReq) # From here back to ldap3 request = bind_operation(connection.version, SASL, None, None, connection.sasl_mechanism, blob.getData()) response = connection.post_send_single_response(connection.send('bindRequest', request, None))[0] connection.result = response if response['result'] == 0: connection.bound = True connection.refresh_server_info() return response['result'] == 0 def get_tgt(self): """ Request a Kerberos TGT given our provided inputs. """ username = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) logging.info('Getting TGT for user') try: tgt, cipher, _, session_key = getKerberosTGT(username, self.password, self.userdomain, unhexlify(self.lm_hash), unhexlify(self.nt_hash), self.aeskey, self.userdomain_kdc) except Exception as exc: logging.debug(traceback.format_exc()) if self.auth_method == 'auto': logging.warning('Failed to get Kerberos TGT. Falling back to NTLM authentication. Error: %s', str(exc)) return else: # No other auth methods, so raise exception logging.error('Failed to get Kerberos TGT.') raise if self.userdomain != self.domain: # Try to get inter-realm TGT username = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) servername = Principal('krbtgt/%s' % self.domain, type=constants.PrincipalNameType.NT_SRV_INST.value) # Get referral TGT tgs, cipher, _, sessionkey = getKerberosTGS(servername, self.userdomain, self.userdomain_kdc, tgt, cipher, session_key) # See if this is a ticket for the correct domain refneeded = True while refneeded: decoded_tgs = decoder.decode(tgs, asn1Spec = TGS_REP())[0] next_realm = str(decoded_tgs['ticket']['sname']['name-string'][1]) if next_realm.upper() == self.domain.upper(): refneeded = False else: # Get next referral TGT logging.debug('Following referral across trust to get next TGT') servername = Principal('krbtgt/%s' % self.domain, type=constants.PrincipalNameType.NT_SRV_INST.value) tgs, cipher, _, sessionkey = getKerberosTGS(servername, next_realm, next_realm, tgs, cipher, sessionkey) # Get foreign domain TGT servername = Principal('krbtgt/%s' % self.domain, type=constants.PrincipalNameType.NT_SRV_INST.value) tgs, cipher, _, sessionkey = getKerberosTGS(servername, self.domain, self.kdc, tgs, cipher, sessionkey) # Store this as our TGT self.tgt = { 'KDC_REP': tgs, 'cipher': cipher, 'sessionKey': sessionkey } else: TGT = dict() TGT['KDC_REP'] = tgt TGT['cipher'] = cipher TGT['sessionKey'] = session_key self.tgt = TGT def get_tgs_for_smb(self, hostname): """ Get a TGS for use with SMB Connection. We do this here to make sure the realms are correct, since impacket doesn't support cross-realm TGT usage and we don't want it to do its own Kerberos """ username = Principal(self.username, type=constants.PrincipalNameType.NT_PRINCIPAL.value) servername = Principal('cifs/%s' % hostname, type=constants.PrincipalNameType.NT_SRV_INST.value) tgs, cipher, _, sessionkey = getKerberosTGS(servername, self.domain, self.kdc, self.tgt['KDC_REP'], self.tgt['cipher'], self.tgt['sessionKey']) return { 'KDC_REP': tgs, 'cipher': cipher, 'sessionKey': sessionkey } def load_ccache(self): """ Extract a TGT from a ccache file. """ # If the kerberos credential cache is known, use that. krb5cc = os.getenv('KRB5CCNAME') # Otherwise, guess it. if krb5cc is None: try: krb5cc = '/tmp/krb5cc_%u' % os.getuid() except AttributeError: # This fails on Windows krb5cc = 'nonexistingfile' if os.path.isfile(krb5cc): logging.debug('Using kerberos credential cache: %s', krb5cc) else: logging.debug('No Kerberos credential cache file found, manually requesting TGT') return False # Load TGT for our domain ccache = CCache.loadFile(krb5cc) principal = 'krbtgt/%s@%s' % (self.domain.upper(), self.domain.upper()) creds = ccache.getCredential(principal, anySPN=False) if creds is not None: TGT = creds.toTGT() # This we store for later self.tgt = TGT tgt, cipher, session_key = TGT['KDC_REP'], TGT['cipher'], TGT['sessionKey'] logging.info('Using TGT from cache') else: logging.debug("No valid credentials found in cache. ") return False # Verify if this ticket is actually for the specified user ticket = Ticket() decoded_tgt = decoder.decode(tgt, asn1Spec = AS_REP())[0] ticket.from_asn1(decoded_tgt['ticket']) tgt_principal = Principal() tgt_principal.from_asn1(decoded_tgt, 'crealm', 'cname') expected_principal = '%s@%s' % (self.username.lower(), self.domain.upper()) if expected_principal.upper() != str(tgt_principal).upper(): logging.warning('Username in ccache file does not match supplied username! %s != %s', tgt_principal, expected_principal) return False else: logging.info('Found TGT with correct principal in ccache file.') return True ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832038.0 bloodhound-1.8.0/bloodhound/ad/computer.py0000664000175000017500000011463314735530746017414 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import traceback import calendar import time import re from impacket.dcerpc.v5 import transport, samr, srvs, lsat, lsad, nrpc, wkst, scmr, tsch, rrp from impacket.dcerpc.v5.rpcrt import DCERPCException, RPC_C_AUTHN_LEVEL_PKT_INTEGRITY from impacket.dcerpc.v5.ndr import NULL from impacket.dcerpc.v5.dtypes import RPC_SID, MAXIMUM_ALLOWED from impacket.nmb import NetBIOSTimeout, NetBIOSError from bloodhound.ad.utils import ADUtils, AceResolver from bloodhound.enumeration.acls import parse_binary_acl from bloodhound.ad.structures import LDAP_SID from impacket.smb3 import SMB3 from impacket.smb import SMB from impacket.smbconnection import SessionError from impacket import smb from impacket.smb3structs import SMB2_DIALECT_21 # Try to import exceptions here, if this does not succeed, then impacket version is too old try: HostnameValidationExceptions = (SMB3.HostnameValidationException, SMB.HostnameValidationException) except AttributeError: HostnameValidationExceptions = () class ADComputer(object): """ Computer connected to Active Directory """ def __init__(self, hostname=None, samname=None, ad=None, addc=None, objectsid=None): self.ad = ad self.addc = addc self.samname = samname self.rpc = None self.dce = None self.admins = [] self.dcom = [] self.rdp = [] self.psremote = [] self.trusts = [] self.services = [] self.sessions = [] self.loggedon = [] self.registry_sessions = [] self.addr = None self.smbconnection = None self.TGS = None # The SID of the local domain self.sid = None # The SID within the domain self.objectsid = objectsid self.primarygroup = None if addc: self.aceresolver = AceResolver(ad, ad.objectresolver) # Which auth methods to try for this host self.auth_method = self.ad.auth.auth_method # Did connecting to this host fail before? self.permanentfailure = False # Process invalid hosts if not hostname: self.hostname = '%s.%s' % (samname[:-1].upper(), self.ad.domain.upper()) else: self.hostname = hostname def get_bloodhound_data(self, entry, collect, skip_acl=False): data = { 'ObjectIdentifier': self.objectsid, 'AllowedToAct': [], 'PrimaryGroupSID': self.primarygroup, 'LocalAdmins': { 'Collected': 'localadmin' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.admins, }, 'PSRemoteUsers': { 'Collected': 'psremote' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.psremote }, 'Properties': { 'name': self.hostname.upper(), 'domainsid': self.ad.domain_object.sid, 'domain': self.ad.domain.upper(), 'distinguishedname': ADUtils.get_entry_property(entry, 'distinguishedName').upper() }, 'RemoteDesktopUsers': { 'Collected': 'rdp' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.rdp }, 'DcomUsers': { 'Collected': 'dcom' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.dcom }, 'AllowedToDelegate': [], 'Sessions': { 'Collected': 'session' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.sessions }, 'PrivilegedSessions': { 'Collected': 'loggedon' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.loggedon }, 'RegistrySessions': { 'Collected': 'loggedon' in collect and not self.permanentfailure, 'FailureReason': None, 'Results': self.registry_sessions }, 'Aces': [], 'HasSIDHistory': [], 'IsDeleted': ADUtils.get_entry_property(entry, 'isDeleted', default=False), 'Status': None } props = data['Properties'] # via the TRUSTED_FOR_DELEGATION (0x00080000) flag in UAC props['unconstraineddelegation'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00080000 == 0x00080000 props['enabled'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 2 == 0 props['trustedtoauth'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x01000000 == 0x01000000 props['samaccountname'] = ADUtils.get_entry_property(entry, 'sAMAccountName') if 'objectprops' in collect or 'acl' in collect: props['haslaps'] = bool(ADUtils.get_entry_property(entry, 'ms-mcs-admpwdexpirationtime', 0) or ADUtils.get_entry_property(entry, 'mslaps-passwordexpirationtime', 0)) if 'objectprops' in collect: props['lastlogon'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'lastlogon', default=0, raw=True) ) props['lastlogontimestamp'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'lastlogontimestamp', default=0, raw=True) ) if props['lastlogontimestamp'] == 0: props['lastlogontimestamp'] = -1 props['pwdlastset'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'pwdLastSet', default=0, raw=True) ) whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) if not isinstance(whencreated, int): whencreated = calendar.timegm(whencreated.timetuple()) props['whencreated'] = whencreated props['serviceprincipalnames'] = ADUtils.get_entry_property(entry, 'servicePrincipalName', []) props['description'] = ADUtils.get_entry_property(entry, 'description') props['operatingsystem'] = ADUtils.get_entry_property(entry, 'operatingSystem') # Add SP to OS if specified servicepack = ADUtils.get_entry_property(entry, 'operatingSystemServicePack') if servicepack: props['operatingsystem'] = '%s %s' % (props['operatingsystem'], servicepack) props['sidhistory'] = [LDAP_SID(bsid).formatCanonical() for bsid in ADUtils.get_entry_property(entry, 'sIDHistory', [])] delegatehosts = ADUtils.get_entry_property(entry, 'msDS-AllowedToDelegateTo', []) delegatehosts_cache = [] for host in delegatehosts: try: target = host.split('/')[1].split(':')[0] except IndexError: logging.warning('Invalid delegation target: %s', host) continue try: object_sid = self.ad.computersidcache.get(target.lower()) data['AllowedToDelegate'].append({ 'ObjectIdentifier': object_sid, 'ObjectType': ADUtils.resolve_ad_entry( self.ad.objectresolver.resolve_sid(object_sid) )['type'], }) except KeyError: object_sam = target.upper().split(".")[0].split("\\")[0] if object_sam in delegatehosts_cache: continue delegatehosts_cache.append(object_sam) object_entry = self.ad.objectresolver.resolve_samname(object_sam + '*', allow_filter=True) if object_entry: if len(object_entry) > 1: object_resolved = None for object_entry_instance in object_entry: sam = ADUtils.get_entry_property(object_entry_instance, 'sAMAccountName') if not sam: continue if sam.lower() == object_sam.lower() or f"{sam}$".lower() == object_sam.lower(): # Best match object_resolved = ADUtils.resolve_ad_entry(object_entry_instance) break # No match? Then pick first one and hope for the best if not object_resolved: object_resolved = ADUtils.resolve_ad_entry(object_entry[0]) else: object_resolved = ADUtils.resolve_ad_entry(object_entry[0]) data['AllowedToDelegate'].append({ 'ObjectIdentifier': object_resolved['objectid'], 'ObjectType': object_resolved['type'], }) if len(delegatehosts) > 0: props['allowedtodelegate'] = delegatehosts # Process resource-based constrained delegation _, aces = parse_binary_acl(data, 'computer', ADUtils.get_entry_property(entry, 'msDS-AllowedToActOnBehalfOfOtherIdentity', raw=True), self.addc.objecttype_guid_map) outdata = self.aceresolver.resolve_aces(aces) for delegated in outdata: if delegated['RightName'] == 'Owner': continue if delegated['RightName'] == 'GenericAll': data['AllowedToAct'].append({'ObjectIdentifier': delegated['PrincipalSID'], 'ObjectType': delegated['PrincipalType']}) # Run ACL collection if this was not already done centrally if 'acl' in collect and not skip_acl: _, aces = parse_binary_acl(data, 'computer', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map) # Parse aces data['Aces'] = self.aceresolver.resolve_aces(aces) return data def try_connect(self): addr = None try: addr = self.ad.dnscache.get(self.hostname) except KeyError: try: q = self.ad.dnsresolver.query(self.hostname, 'A', tcp=self.ad.dns_tcp) for r in q: addr = r.address if addr == None: return False # Do exit properly on keyboardinterrupts except KeyboardInterrupt: raise except Exception as e: # Doesn't exist if "None of DNS query names exist" in str(e): logging.info('Skipping enumeration for %s since it could not be resolved.', self.hostname) else: logging.warning('Could not resolve: %s: %s', self.hostname, e) return False logging.debug('Resolved: %s' % addr) self.ad.dnscache.put(self.hostname, addr) self.addr = addr logging.debug('Trying connecting to computer: %s', self.hostname) # We ping the host here, this adds a small overhead for setting up an extra socket # but saves us from constructing RPC Objects for non-existing hosts. Also RPC over # SMB does not support setting a connection timeout, so we catch this here. return ADUtils.tcp_ping(addr, 445) def dce_rpc_connect(self, binding, uuid, integrity=False): if self.permanentfailure: logging.debug('Skipping connection because of previous failure') return None logging.debug('DCE/RPC binding: %s', binding) try: self.rpc = transport.DCERPCTransportFactory(binding) self.rpc.set_connect_timeout(1.0) # Set name/host explicitly self.rpc.setRemoteName(self.hostname) self.rpc.setRemoteHost(self.addr) # Use Kerberos if we have a TGT if hasattr(self.rpc, 'set_kerberos') and self.ad.auth.tgt and self.auth_method in ('auto', 'kerberos'): self.rpc.set_kerberos(True, self.ad.auth.kdc) if not self.TGS: try: self.TGS = self.ad.auth.get_tgs_for_smb(self.hostname) except Exception as exc: logging.debug(traceback.format_exc()) if self.auth_method == 'auto': logging.warning('Failed to get service ticket for %s, falling back to NTLM auth', self.hostname) self.auth_method = 'ntlm' else: logging.warning('Failed to get service ticket for %s, skipping host', self.hostname) self.permanentfailure = True return None if hasattr(self.rpc, 'set_credentials'): if self.auth_method == 'auto': # Set all we have self.rpc.set_credentials(self.ad.auth.username, self.ad.auth.password, domain=self.ad.auth.userdomain, lmhash=self.ad.auth.lm_hash, nthash=self.ad.auth.nt_hash, aesKey=self.ad.auth.aeskey, TGS=self.TGS) elif self.auth_method == 'kerberos': # Kerberos only self.rpc.set_credentials(self.ad.auth.username, '', domain=self.ad.auth.userdomain, TGS=self.TGS) else: # NTLM fallback triggered self.rpc.set_credentials(self.ad.auth.username, self.ad.auth.password, domain=self.ad.auth.userdomain, lmhash=self.ad.auth.lm_hash, nthash=self.ad.auth.nt_hash) # Else set the required stuff for NTLM elif hasattr(self.rpc, 'set_credentials'): self.rpc.set_credentials(self.ad.auth.username, self.ad.auth.password, domain=self.ad.auth.userdomain, lmhash=self.ad.auth.lm_hash, nthash=self.ad.auth.nt_hash) # Use strict validation if possible if hasattr(self.rpc, 'set_hostname_validation'): self.rpc.set_hostname_validation(True, False, self.hostname) # Uncomment to force SMB2 (especially for development to prevent encryption) # will break clients only supporting SMB1 ofc # self.rpc.preferred_dialect(smb3structs.SMB2_DIALECT_21) # Re-use the SMB connection if possible if self.smbconnection: self.rpc.set_smb_connection(self.smbconnection) dce = self.rpc.get_dce_rpc() # Some interfaces require integrity (such as scheduled tasks) # others don't support it at all and error out. if integrity: dce.set_auth_level(RPC_C_AUTHN_LEVEL_PKT_INTEGRITY) # Try connecting, catch hostname validation try: dce.connect() except HostnameValidationExceptions as exc: logging.info('Ignoring host %s since its hostname does not match: %s', self.hostname, str(exc)) self.permanentfailure = True return None except SessionError as exc: if ('STATUS_PIPE_NOT_AVAILABLE' in str(exc) or 'STATUS_OBJECT_NAME_NOT_FOUND' in str(exc)) and 'winreg' in binding.lower(): # This can happen, silently ignore return None if 'STATUS_MORE_PROCESSING_REQUIRED' in str(exc): if self.auth_method == 'kerberos': logging.warning('Kerberos auth failed and no more auth methods to try.') elif self.auth_method == 'auto': logging.debug('Kerberos auth failed. Falling back to NTLM') self.auth_method = 'ntlm' # Close connection and retry try: self.rpc.get_smb_connection().close() except: pass # Try again! return self.dce_rpc_connect(binding, uuid, integrity) # Else, just log it logging.debug(traceback.format_exc()) logging.warning('DCE/RPC connection failed: %s', str(exc)) return None if self.smbconnection is None: self.smbconnection = self.rpc.get_smb_connection() # We explicity set the smbconnection back to the rpc object # this way it won't be closed when we call disconnect() self.rpc.set_smb_connection(self.smbconnection) # Hostname validation authname = self.smbconnection.getServerName() if authname and authname.lower() != self.hostname.split('.')[0].lower(): logging.info('Ignoring host %s since its reported name %s does not match', self.hostname, authname) self.permanentfailure = True return None dce.bind(uuid) except DCERPCException as e: logging.debug(traceback.format_exc()) logging.warning('DCE/RPC connection failed: %s', str(e)) return None except KeyboardInterrupt: raise except Exception as e: logging.debug(traceback.format_exc()) logging.warning('DCE/RPC connection failed: %s', e) return None except: logging.warning('DCE/RPC connection failed (unknown error)') return None return dce def rpc_get_loggedon(self): """ Query logged on users via RPC. Requires admin privs """ binding = r'ncacn_np:%s[\PIPE\wkssvc]' % self.addr loggedonusers = set() dce = self.dce_rpc_connect(binding, wkst.MSRPC_UUID_WKST) if dce is None: logging.warning('Connection failed: %s', binding) return try: # 1 means more detail, including the domain resp = wkst.hNetrWkstaUserEnum(dce, 1) for record in resp['UserInfo']['WkstaUserInfo']['Level1']['Buffer']: # Skip computer accounts if record['wkui1_username'][-2] == '$': continue # Skip sessions for local accounts if record['wkui1_logon_domain'][:-1].upper() == self.samname[:-1].upper(): continue domain = record['wkui1_logon_domain'][:-1].upper() domain_entry = self.ad.get_domain_by_name(domain) if domain_entry is not None: domain = ADUtils.ldap2domain(domain_entry['attributes']['distinguishedName']) logging.debug('Found logged on user at %s: %s@%s' % (self.hostname, record['wkui1_username'][:-1], domain)) loggedonusers.add((record['wkui1_username'][:-1], domain)) except DCERPCException as e: if 'rpc_s_access_denied' in str(e): logging.debug('Access denied while enumerating LoggedOn on %s, probably no admin privs', self.hostname) else: logging.debug('Exception connecting to RPC: %s', e) except Exception as e: if 'connection reset' in str(e): logging.debug('Connection was reset: %s', e) else: raise e dce.disconnect() return list(loggedonusers) def rpc_close(self): if self.smbconnection: self.smbconnection.logoff() def rpc_get_sessions(self): binding = r'ncacn_np:%s[\PIPE\srvsvc]' % self.addr dce = self.dce_rpc_connect(binding, srvs.MSRPC_UUID_SRVS) if dce is None: return try: resp = srvs.hNetrSessionEnum(dce, '\x00', NULL, 10) except DCERPCException as e: if 'rpc_s_access_denied' in str(e): logging.debug('Access denied while enumerating Sessions on %s, likely a patched OS', self.hostname) return [] else: raise except Exception as e: if str(e).find('Broken pipe') >= 0: return else: raise sessions = [] for session in resp['InfoStruct']['SessionInfo']['Level10']['Buffer']: userName = session['sesi10_username'][:-1] ip = session['sesi10_cname'][:-1] # Strip \\ from IPs if ip[:2] == '\\\\': ip = ip[2:] # Skip empty IPs if ip == '': continue # Skip our connection if userName == self.ad.auth.username: continue # Skip empty usernames if len(userName) == 0: continue # Skip machine accounts if userName[-1] == '$': continue # Skip local connections if ip in ['127.0.0.1', '[::1]']: continue # IPv6 address if ip[0] == '[' and ip[-1] == ']': ip = ip[1:-1] logging.info('User %s is logged in on %s from %s' % (userName, self.hostname, ip)) sessions.append({'user': userName, 'source': ip, 'target': self.hostname}) dce.disconnect() return sessions def rpc_get_registry_sessions(self): binding = r'ncacn_np:%s[\pipe\winreg]' % self.addr # Try to bind to the Remote Registry RPC interface, if it fails try again once. binding_attempts = 2 while binding_attempts > 0: dce = self.dce_rpc_connect(binding, rrp.MSRPC_UUID_RRP) if dce is None: # If the Remote Registry is not yet started, the named pipe '\pipe\winreg' does not # exist and therefore the following exception is expected: STATUS_PIPE_NOT_AVAILABLE. # But this initial attempt should trigger it. Wait 1s and hope the service had enough # time to start. time.sleep(1) else: # We could connect to the Remote Registry, so exit the loop. break binding_attempts -= 1 # If the two binding attempts failed, silently return. if dce is None: logging.debug('Failed opening remote registry after 2 attempts') return registry_sessions = [] # Impacket's 'hOpenUsers' will allow us to open the remote HKU hive. try: resp = rrp.hOpenUsers(dce) except DCERPCException as e: if 'rpc_s_access_denied' in str(e): logging.debug('Access denied while enumerating Registry Sessions on %s', self.hostname) return [] else: logging.debug('Exception connecting to RPC: %s', e) except Exception as e: if str(e).find('Broken pipe') >= 0: return else: raise # Once we have a handle on the remote HKU hive, we can call 'BaseRegEnumKey' in a loop in # order to enumerate the subkeys which names are the SIDs of the logged in users. key_handle = resp['phKey'] index = 1 sid_filter = "^S-1-5-21-[0-9]+-[0-9]+-[0-9]+-[0-9]+$" while True: try: resp = rrp.hBaseRegEnumKey(dce, key_handle, index) sid = resp['lpNameOut'].rstrip('\0') if re.match(sid_filter, sid): logging.info('User with SID %s is logged in on %s' % (sid, self.hostname)) # Ignore local accounts (best effort, self.sid is only # populated if we enumerated a group before) if self.sid and sid.startswith(self.sid): index += 1 continue registry_sessions.append({'user': sid}) index += 1 except: break rrp.hBaseRegCloseKey(dce, key_handle) dce.disconnect() return registry_sessions """ """ def rpc_get_domain_trusts(self): binding = r'ncacn_np:%s[\PIPE\netlogon]' % self.addr dce = self.dce_rpc_connect(binding, nrpc.MSRPC_UUID_NRPC) if dce is None: return try: req = nrpc.DsrEnumerateDomainTrusts() req['ServerName'] = NULL req['Flags'] = 1 resp = dce.request(req) except Exception as e: raise e for domain in resp['Domains']['Domains']: logging.info('Found domain trust from %s to %s', self.hostname, domain['NetbiosDomainName']) self.trusts.append({'domain': domain['DnsDomainName'], 'type': domain['TrustType'], 'flags': domain['Flags']}) dce.disconnect() def rpc_get_services(self): """ Query services with stored credentials via RPC. These credentials can be dumped with mimikatz via lsadump::secrets or via secretsdump.py """ binding = r'ncacn_np:%s[\PIPE\svcctl]' % self.addr serviceusers = [] dce = self.dce_rpc_connect(binding, scmr.MSRPC_UUID_SCMR) if dce is None: return serviceusers try: resp = scmr.hROpenSCManagerW(dce) scManagerHandle = resp['lpScHandle'] # TODO: Figure out if filtering out service types makes sense resp = scmr.hREnumServicesStatusW(dce, scManagerHandle, dwServiceType=scmr.SERVICE_WIN32_OWN_PROCESS, dwServiceState=scmr.SERVICE_STATE_ALL) # TODO: Skip well-known services to save on traffic for i in range(len(resp)): try: ans = scmr.hROpenServiceW(dce, scManagerHandle, resp[i]['lpServiceName'][:-1]) serviceHandle = ans['lpServiceHandle'] svcresp = scmr.hRQueryServiceConfigW(dce, serviceHandle) svc_user = svcresp['lpServiceConfig']['lpServiceStartName'][:-1] if '@' in svc_user: logging.info("Found user service: %s running as %s on %s", resp[i]['lpServiceName'][:-1], svc_user, self.hostname) serviceusers.append(svc_user) except DCERPCException as e: if 'rpc_s_access_denied' not in str(e): logging.debug('Exception querying service %s via RPC: %s', resp[i]['lpServiceName'][:-1], e) except DCERPCException as e: logging.debug('Exception connecting to RPC: %s', e) except Exception as e: if 'connection reset' in str(e): logging.debug('Connection was reset: %s', e) else: raise e dce.disconnect() return serviceusers def rpc_get_schtasks(self): """ Query the scheduled tasks via RPC. Requires admin privileges. These credentials can be dumped with mimikatz via vault::cred """ # Blacklisted folders (Default ones) blacklist = [u'Microsoft\x00'] # Start with the root folder folders = ['\\'] tasks = [] schtaskusers = [] binding = r'ncacn_np:%s[\PIPE\atsvc]' % self.addr try: dce = self.dce_rpc_connect(binding, tsch.MSRPC_UUID_TSCHS, True) if dce is None: return schtaskusers # Get root folder resp = tsch.hSchRpcEnumFolders(dce, '\\') for item in resp['pNames']: data = item['Data'] if data not in blacklist: folders.append('\\'+data) # Enumerate the folders we found # subfolders not supported yet for folder in folders: try: resp = tsch.hSchRpcEnumTasks(dce, folder) for item in resp['pNames']: data = item['Data'] if folder != '\\': # Make sure to strip the null byte tasks.append(folder[:-1]+'\\'+data) else: tasks.append(folder+data) except DCERPCException as e: logging.debug('Error enumerating task folder %s: %s', folder, e) for task in tasks: try: resp = tsch.hSchRpcRetrieveTask(dce, task) # This returns a tuple (sid, logontype) or None userinfo = ADUtils.parse_task_xml(resp['pXml']) if userinfo: if userinfo[1] == u'Password': # Convert to byte string because our cache format is in bytes schtaskusers.append(str(userinfo[0])) logging.info('Found scheduled task %s on %s with stored credentials for SID %s', task, self.hostname, userinfo[0]) except DCERPCException as e: logging.debug('Error querying task %s: %s', task, e) except DCERPCException as e: logging.debug('Exception enumerating scheduled tasks: %s', e) dce.disconnect() return schtaskusers """ This magic is mostly borrowed from impacket/examples/netview.py """ def rpc_get_group_members(self, group_rid, resultlist): binding = r'ncacn_np:%s[\PIPE\samr]' % self.addr unresolved = [] dce = self.dce_rpc_connect(binding, samr.MSRPC_UUID_SAMR) if dce is None: return try: resp = samr.hSamrConnect(dce) serverHandle = resp['ServerHandle'] # Attempt to get the SID from this computer to filter local accounts later try: resp = samr.hSamrLookupDomainInSamServer(dce, serverHandle, self.samname[:-1]) self.sid = resp['DomainId'].formatCanonical() # This doesn't always work (for example on DCs) except DCERPCException as e: # Make it a string which is guaranteed not to match a SID self.sid = 'UNKNOWN' # Enumerate the domains known to this computer resp = samr.hSamrEnumerateDomainsInSamServer(dce, serverHandle) domains = resp['Buffer']['Buffer'] # Query the builtin domain (derived from this SID) sid = RPC_SID() sid.fromCanonical('S-1-5-32') logging.debug('Opening domain handle') # Open a handle to this domain resp = samr.hSamrOpenDomain(dce, serverHandle=serverHandle, desiredAccess=samr.DOMAIN_LOOKUP | MAXIMUM_ALLOWED, domainId=sid) domainHandle = resp['DomainHandle'] try: resp = samr.hSamrOpenAlias(dce, domainHandle, desiredAccess=samr.ALIAS_LIST_MEMBERS | MAXIMUM_ALLOWED, aliasId=group_rid) except samr.DCERPCSessionError as error: # Group does not exist if 'STATUS_NO_SUCH_ALIAS' in str(error): logging.debug('No group with RID %d exists', group_rid) return resp = samr.hSamrGetMembersInAlias(dce, aliasHandle=resp['AliasHandle']) for member in resp['Members']['Sids']: sid_string = member['SidPointer'].formatCanonical() logging.debug('Found %d SID: %s', group_rid, sid_string) if not sid_string.startswith(self.sid): # If the sid is known, we can add the admin value directly try: siddata = self.ad.sidcache.get(sid_string) if siddata is None: unresolved.append(sid_string) else: logging.debug('Sid is cached: %s', siddata['principal']) resultlist.append({'ObjectIdentifier': sid_string, 'ObjectType': siddata['type'].capitalize()}) except KeyError: # Append it to the list of unresolved SIDs unresolved.append(sid_string) else: logging.debug('Ignoring local group %s', sid_string) except DCERPCException as e: if 'rpc_s_access_denied' in str(e): logging.debug('Access denied while enumerating groups on %s, likely a patched OS', self.hostname) else: raise except Exception as e: if 'connection reset' in str(e): logging.debug('Connection was reset: %s', e) else: raise e dce.disconnect() return unresolved def rpc_resolve_sids(self, sids, resultlist): """ Resolve any remaining unknown SIDs for local accounts. """ # If all sids were already cached, we can just return if sids is None or len(sids) == 0: return binding = r'ncacn_np:%s[\PIPE\lsarpc]' % self.addr dce = self.dce_rpc_connect(binding, lsat.MSRPC_UUID_LSAT) if dce is None: return try: resp = lsad.hLsarOpenPolicy2(dce, lsat.POLICY_LOOKUP_NAMES | MAXIMUM_ALLOWED) except Exception as e: if str(e).find('Broken pipe') >= 0: return else: raise policyHandle = resp['PolicyHandle'] # We could look up the SIDs all at once, but if not all SIDs are mapped, we don't know which # ones were resolved and which not, making it impossible to map them in the cache. # Therefor we use more SAMR calls at the start, but after a while most SIDs will be reliable # in our cache and this function doesn't even need to get called anymore. for sid_string in sids: try: resp = lsat.hLsarLookupSids(dce, policyHandle, [sid_string], lsat.LSAP_LOOKUP_LEVEL.enumItems.LsapLookupWksta) except DCERPCException as e: if str(e).find('STATUS_NONE_MAPPED') >= 0: logging.warning('SID %s lookup failed, return status: STATUS_NONE_MAPPED', sid_string) # Try next SID continue elif str(e).find('STATUS_SOME_NOT_MAPPED') >= 0: # Not all could be resolved, work with the ones that could resp = e.get_packet() else: raise except NetBIOSTimeout as e: logging.warning('Connection timed out while resolving sids') continue domains = [] for entry in resp['ReferencedDomains']['Domains']: domains.append(entry['Name']) for entry in resp['TranslatedNames']['Names']: domain = domains[entry['DomainIndex']] domain_entry = self.ad.get_domain_by_name(domain) if domain_entry is not None: domain = ADUtils.ldap2domain(domain_entry['attributes']['distinguishedName']) # TODO: what if it isn't? Should we fall back to LDAP? if entry['Name'] != '': resolved_entry = ADUtils.resolve_sid_entry(entry, domain) logging.debug('Resolved SID to name: %s', resolved_entry['principal']) resultlist.append({'ObjectIdentifier': sid_string, 'ObjectType': resolved_entry['type'].capitalize()}) # Add it to our cache self.ad.sidcache.put(sid_string, resolved_entry) else: logging.warning('Resolved name is empty [%s]', entry) try: dce.disconnect() except NetBIOSError: pass ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832010.0 bloodhound-1.8.0/bloodhound/ad/domain.py0000664000175000017500000010702214735530712017010 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import traceback import codecs import json from uuid import UUID from dns import resolver from ldap3 import ALL_ATTRIBUTES, BASE, SUBTREE, LEVEL from ldap3.core.exceptions import LDAPKeyError, LDAPAttributeError, LDAPCursorError, LDAPNoSuchObjectResult, LDAPSocketReceiveError, LDAPSocketSendError, LDAPCommunicationError from ldap3.protocol.microsoft import security_descriptor_control from bloodhound.ad.utils import ADUtils, DNSCache, SidCache, SamCache, CollectionException from bloodhound.ad.computer import ADComputer from bloodhound.enumeration.objectresolver import ObjectResolver """ Active Directory Domain Controller """ class ADDC(ADComputer): def __init__(self, hostname=None, ad=None): ADComputer.__init__(self, hostname) self.ad = ad # Primary LDAP connection self.ldap = None # Secondary LDAP connection self.resolverldap = None # GC LDAP connection self.gcldap = None # Initialize GUID map self.objecttype_guid_map = dict() def ldap_connect(self, protocol=None, resolver=False): """ Connect to the LDAP service """ if not protocol: protocol = self.ad.ldap_default_protocol logging.info('Connecting to LDAP server: %s' % self.hostname) logging.debug('Using protocol %s' % protocol) # Convert the hostname to an IP, this prevents ldap3 from doing it # which doesn't use our custom nameservers q = self.ad.dnsresolver.query(self.hostname, tcp=self.ad.dns_tcp) for r in q: ip = r.address ldap = self.ad.auth.getLDAPConnection(hostname=self.hostname, ip=ip, baseDN=self.ad.baseDN, protocol=protocol) if resolver: self.resolverldap = ldap else: self.ldap = ldap return ldap is not None def gc_connect(self, protocol='ldap'): """ Connect to the global catalog """ if self.hostname in self.ad.gcs(): # This server is a Global Catalog initial_server = self.hostname else: # Pick the first GC server try: initial_server = self.ad.gcs()[0] except IndexError: logging.error('Could not find a Global Catalog in this domain!'\ ' Resolving will be unreliable in forests with multiple domains') return False try: # Convert the hostname to an IP, this prevents ldap3 from doing it # which doesn't use our custom nameservers logging.info('Connecting to GC LDAP server: %s' % initial_server) q = self.ad.dnsresolver.query(initial_server, tcp=self.ad.dns_tcp) for r in q: ip = r.address except (resolver.NXDOMAIN, resolver.Timeout): for server in self.ad.gcs(): # Skip the one we already tried if server == initial_server: continue try: # Convert the hostname to an IP, this prevents ldap3 from doing it # which doesn't use our custom nameservers logging.info('Connecting to GC LDAP server: %s' % server) q = self.ad.dnsresolver.query(server, tcp=self.ad.dns_tcp) for r in q: ip = r.address break except (resolver.NXDOMAIN, resolver.Timeout): continue self.gcldap = self.ad.auth.getLDAPConnection(hostname=self.hostname, ip=ip, gc=True, baseDN=self.ad.baseDN, protocol=protocol) return self.gcldap is not None def search(self, search_filter='(objectClass=*)',attributes=None, search_base=None, generator=True, use_gc=False, use_resolver=False, query_sd=False, is_retry=False, search_scope=SUBTREE,): """ Search for objects in LDAP or Global Catalog LDAP. """ if self.ldap is None and not use_resolver: self.ldap_connect(resolver=use_resolver) if self.resolverldap is None and use_resolver: self.ldap_connect(resolver=use_resolver) if search_base is None: search_base = self.ad.baseDN if attributes is None or attributes == []: attributes = ALL_ATTRIBUTES if query_sd: # Set SD flags to only query for DACL and Owner controls = security_descriptor_control(sdflags=0x05) else: controls = None # If we don't query the GC, don't accept an empty search base if search_base == "" and not use_gc: search_base = self.ad.baseDN # Use the GC if this is requested if use_gc: searcher = self.gcldap else: # If this request comes from the resolver thread, use that if use_resolver: searcher = self.resolverldap else: searcher = self.ldap hadresults = False sresult = searcher.extend.standard.paged_search(search_base, search_filter, attributes=attributes, paged_size=200, search_scope=search_scope, controls=controls, generator=generator) try: # Use a generator for the result regardless of if the search function uses one for e in sresult: if e['type'] != 'searchResEntry': continue if not hadresults: hadresults = True yield e except LDAPNoSuchObjectResult: # This may indicate the object doesn't exist or access is denied logging.warning('LDAP Server reported that the search in %s for %s does not exist.', search_base, search_filter) except (LDAPSocketReceiveError, LDAPSocketSendError, LDAPCommunicationError) as e: if is_retry: logging.error('Connection to LDAP server lost during data gathering - reconnect failed - giving up on query %s', search_filter) else: if hadresults: logging.error('Connection to LDAP server lost during data gathering. Query was cut short. Data may be inaccurate for query %s', search_filter) if use_gc: self.gc_connect() else: self.ldap_connect(resolver=use_resolver) else: logging.warning('Re-establishing connection with server') if use_gc: self.gc_connect() else: self.ldap_connect(resolver=use_resolver) # Try again yield from self.search(search_filter, attributes, search_base, generator, use_gc, use_resolver, query_sd, is_retry=True) def ldap_get_single(self, qobject, attributes=None, use_gc=False, use_resolver=False, is_retry=False): """ Get a single object, requires full DN to object. This function supports searching both in the local directory and the Global Catalog. The connection to the GC should already be established before calling this function. """ if use_gc: searcher = self.gcldap else: # If this request comes from the resolver thread, use that if use_resolver: searcher = self.resolverldap else: searcher = self.ldap if attributes is None or attributes == []: attributes = ALL_ATTRIBUTES try: sresult = searcher.extend.standard.paged_search(qobject, '(objectClass=*)', search_scope=BASE, attributes=attributes, paged_size=10, generator=False) except (LDAPSocketReceiveError, LDAPSocketSendError, LDAPCommunicationError) as e: if is_retry: logging.error('Connection to LDAP server lost during object resolving - reconnect failed - giving up on resolving %s', qobject) return None else: logging.warning('Re-establishing connection with server') if use_gc: self.gc_connect() else: self.ldap_connect(resolver=use_resolver) # Try again return self.ldap_get_single(qobject, attributes, use_gc, use_resolver, is_retry=True) except LDAPNoSuchObjectResult: # This may indicate the object doesn't exist or access is denied logging.warning('LDAP Server reported that the object %s does not exist.', qobject) return None for e in sresult: if e['type'] != 'searchResEntry': continue return e def get_domain_controllers(self): entries = self.search('(userAccountControl:1.2.840.113556.1.4.803:=8192)', ['dnshostname', 'samaccounttype', 'samaccountname', 'serviceprincipalname', 'objectSid']) return entries def get_netbios_name(self, context): try: entries = self.search('(ncname=%s)' % context, ['nETBIOSName'], search_base="CN=Partitions,%s" % self.ldap.server.info.other['configurationNamingContext'][0]) except (LDAPAttributeError, LDAPCursorError) as e: logging.warning('Could not determine NetBiosname of the domain: %s', str(e)) return next(entries) def get_objecttype(self): """ Function to get objecttype GUID """ self.objecttype_guid_map = dict() if self.ldap is None: self.ldap_connect() sresult = self.ldap.extend.standard.paged_search(self.ldap.server.info.other['schemaNamingContext'][0], '(objectClass=*)', attributes=['name', 'schemaidguid']) for res in sresult: if res['attributes']['schemaIDGUID']: guid = str(UUID(bytes_le=res['attributes']['schemaIDGUID'])) self.objecttype_guid_map[res['attributes']['name'].lower()] = guid if 'ms-mcs-admpwdexpirationtime' in self.objecttype_guid_map: logging.debug('Found LAPS attributes in schema') self.ad.has_laps = True if 'ms-laps-passwordexpirationtime' in self.objecttype_guid_map: logging.debug('Found LAPSv2 attributes in schema') self.ad.has_lapsv2 = True if not self.ad.has_laps and not self.ad.has_lapsv2: logging.debug('No LAPS attributes found in schema') if 'ms-ds-key-credential-link' in self.objecttype_guid_map: logging.debug('Found KeyCredentialLink attributes in schema') self.ad.has_keycredlink = True else: logging.debug('No KeyCredentialLink attributes found in schema') def get_domains(self, acl=False): """ Function to get domains. This should only return the current domain. """ entries = self.search('(objectClass=domain)', [], generator=True, query_sd=acl) entriesNum = 0 for entry in entries: entriesNum += 1 # Todo: actually use these objects instead of discarding them # means rewriting other functions domain_object = ADDomain.fromLDAP(entry['attributes']['distinguishedName'], entry['attributes']['objectSid']) self.ad.domain_object = domain_object self.ad.domains[entry['attributes']['distinguishedName']] = entry try: nbentry = self.get_netbios_name(entry['attributes']['distinguishedName']) self.ad.nbdomains[nbentry['attributes']['nETBIOSName']] = entry except IndexError: pass if entriesNum == 0: # Raise exception if we somehow managed to authenticate but the domain is wrong # prevents confusing exceptions later actualdn = self.ldap.server.info.other['defaultNamingContext'][0] actualdomain = ADUtils.ldap2domain(actualdn) logging.error('Could not find the requested domain %s on this DC, LDAP server reports is domain as %s (you may want to try that?)', self.ad.domain, actualdomain) raise CollectionException("Specified domain was not found in LDAP") logging.info('Found %u domains', entriesNum) return entries def get_forest_domains(self): """ Function which searches the LDAP references in order to find domains. I'm not sure if this is the best function but couldn't find anything better. This searches the configuration, which is present only once in the forest but is replicated to every DC. """ entries = self.search('(objectClass=crossRef)', ['nETBIOSName', 'systemFlags', 'nCName', 'name'], search_base="CN=Partitions,%s" % self.ldap.server.info.other['configurationNamingContext'][0], generator=True) entriesNum = 0 for entry in entries: # Ensure systemFlags entry is not empty before running the naming context check. if not entry['attributes']['systemFlags']: continue # This is a naming context, but not a domain if not entry['attributes']['systemFlags'] & 2: continue entry['attributes']['distinguishedName'] = entry['attributes']['nCName'] entriesNum += 1 # Todo: actually use these objects instead of discarding them # means rewriting other functions d = ADDomain.fromLDAP(entry['attributes']['nCName']) # We don't want to add our own domain since this entry doesn't contain the sid # which we need later on if entry['attributes']['nCName'] not in self.ad.domains: self.ad.domains[entry['attributes']['nCName']] = entry self.ad.nbdomains[entry['attributes']['nETBIOSName']] = entry # Store this number so we can easily determine if we are in a multi-domain # forest later on. self.ad.num_domains = entriesNum logging.info('Found %u domains in the forest', entriesNum) def get_cache_items(self): self.get_objecttype() self.get_forest_domains() self.gc_connect() sidcache = {} dncache = {} for nc, domain in self.ad.domains.items(): logging.info('Processing domain %s', domain['attributes']['name']) query = '(|(&(objectCategory=person)(objectClass=user))(objectClass=group)(&(sAMAccountType=805306369)(!(UserAccountControl:1.2.840.113556.1.4.803:=2))))' entries = self.search(query, use_gc=True, use_resolver=True, attributes=['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'objectSid', 'name'], search_base=nc, generator=True) for lentry in entries: resolved_entry = ADUtils.resolve_ad_entry(lentry) cacheitem = { "ObjectIdentifier": resolved_entry['objectid'], "ObjectType": resolved_entry['type'].capitalize() } sidcache[resolved_entry['objectid']] = cacheitem dncache[ADUtils.get_entry_property(lentry, 'distinguishedName').upper()] = cacheitem return dncache, sidcache def get_groups(self, include_properties=False, acl=False): properties = ['distinguishedName', 'samaccountname', 'samaccounttype', 'objectsid', 'member'] if include_properties: properties += ['adminCount', 'description', 'whencreated'] if acl: properties += ['nTSecurityDescriptor'] entries = self.search('(objectClass=group)', properties, generator=True, query_sd=acl) return entries def get_gpos(self, include_properties=False, acl=False): properties = ['distinguishedName', 'name', 'objectGUID', 'gPCFileSysPath', 'displayName'] if include_properties: properties += ['description', 'whencreated'] if acl: properties += ['nTSecurityDescriptor'] entries = self.search('(objectCategory=groupPolicyContainer)', properties, generator=True, query_sd=acl) return entries def get_ous(self, include_properties=False, acl=False): properties = ['distinguishedName', 'name', 'objectGUID', 'gPLink', 'gPOptions'] if include_properties: properties += ['description', 'whencreated'] if acl: properties += ['nTSecurityDescriptor'] entries = self.search('(objectCategory=organizationalUnit)', properties, generator=True, query_sd=acl) return entries def get_containers(self, include_properties=False, acl=False, dn=''): properties = ['distinguishedName', 'name', 'objectGUID', 'isCriticalSystemObject','objectClass', 'objectCategory'] if include_properties: properties += ['description', 'whencreated'] if acl: properties += ['nTSecurityDescriptor'] entries = self.search('(&(objectCategory=container)(objectClass=container))', properties, generator=True, query_sd=acl, search_base=dn) return entries def get_users(self, include_properties=False, acl=False): properties = ['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'objectSid', 'primaryGroupID', 'isDeleted', 'objectClass'] if 'ms-DS-GroupMSAMembership'.lower() in self.objecttype_guid_map: properties.append('msDS-GroupMSAMembership') if include_properties: properties += ['servicePrincipalName', 'userAccountControl', 'displayName', 'lastLogon', 'lastLogonTimestamp', 'pwdLastSet', 'mail', 'title', 'homeDirectory', 'description', 'userPassword', 'adminCount', 'msDS-AllowedToDelegateTo', 'sIDHistory', 'whencreated', 'unicodepwd', 'scriptpath'] if 'unixuserpassword' in self.objecttype_guid_map: properties.append('unixuserpassword') if acl: properties.append('nTSecurityDescriptor') # Query for MSA only if server supports it if 'msDS-GroupManagedServiceAccount' in self.ldap.server.schema.object_classes: gmsa_filter = '(objectClass=msDS-GroupManagedServiceAccount)' else: logging.debug('No support for GMSA, skipping in query') gmsa_filter = '' if 'msDS-ManagedServiceAccount' in self.ldap.server.schema.object_classes: smsa_filter = '(objectClass=msDS-ManagedServiceAccount)' else: logging.debug('No support for SMSA, skipping in query') smsa_filter = '' if gmsa_filter or smsa_filter: query = '(|(&(objectCategory=person)(objectClass=user)){}{})'.format(gmsa_filter, smsa_filter) else: query = '(&(objectCategory=person)(objectClass=user))' entries = self.search(query, properties, generator=True, query_sd=acl) return entries def get_computers(self, include_properties=False, acl=False): """ Get all computer objects. This purely gets them using LDAP. This function is used directly in case of DCOnly enum, or used to create a cache in case of computer enumeration later on. """ properties = ['samaccountname', 'userAccountControl', 'distinguishedname', 'dnshostname', 'samaccounttype', 'objectSid', 'primaryGroupID', 'isDeleted'] if include_properties: properties += ['servicePrincipalName', 'msDS-AllowedToDelegateTo', 'sIDHistory', 'whencreated', 'lastLogon', 'lastLogonTimestamp', 'pwdLastSet', 'operatingSystem', 'description', 'operatingSystemServicePack'] # Difference between guid map which maps the lowercase schema object name and the property name itself if 'ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity'.lower() in self.objecttype_guid_map: properties.append('msDS-AllowedToActOnBehalfOfOtherIdentity') if self.ad.has_laps: properties.append('ms-mcs-admpwdexpirationtime') if self.ad.has_lapsv2: properties.append('mslaps-passwordexpirationtime') if acl: # Also collect LAPS expiration time since this matters for reporting (no LAPS = no ACL reported) if self.ad.has_laps: properties.append('ms-mcs-admpwdexpirationtime') if self.ad.has_lapsv2: properties.append('mslaps-passwordexpirationtime') properties.append('nTSecurityDescriptor') # Exclude MSA only if server supports it if 'msDS-GroupManagedServiceAccount' in self.ldap.server.schema.object_classes: gmsa_filter = '(!(objectClass=msDS-GroupManagedServiceAccount))' else: gmsa_filter = '' if 'msDS-ManagedServiceAccount' in self.ldap.server.schema.object_classes: smsa_filter = '(!(objectClass=msDS-ManagedServiceAccount))' else: smsa_filter = '' if gmsa_filter or smsa_filter: query = '(&(sAMAccountType=805306369){}{})'.format(gmsa_filter, smsa_filter) else: query = '(&(sAMAccountType=805306369))' entries = self.search(query, properties, generator=True, query_sd=acl) return entries def get_computers_withcache(self, include_properties=False, acl=False): """ Get all computer objects. This is the function used when we do computer enumeration, in which case these items are cached first. Calls the function with generator above to create the list. """ entries = self.get_computers(include_properties, acl) entriesNum = 0 for entry in entries: entriesNum += 1 # Resolve it first for DN cache resolved_entry = ADUtils.resolve_ad_entry(entry) cacheitem = { "ObjectIdentifier": resolved_entry['objectid'], "ObjectType": resolved_entry['type'].capitalize() } self.ad.dncache[ADUtils.get_entry_property(entry, 'distinguishedName', '').upper()] = cacheitem # This list is used to process computers later on self.ad.computers[ADUtils.get_entry_property(entry, 'distinguishedName', '')] = entry self.ad.computersidcache.put(ADUtils.get_entry_property(entry, 'dNSHostname', '').lower(), entry['attributes']['objectSid']) logging.info('Found %u computers', entriesNum) return entries def get_memberships(self): entries = self.search('(|(memberof=*)(primarygroupid=*))', ['samaccountname', 'distinguishedname', 'dnshostname', 'samaccounttype', 'primarygroupid', 'memberof'], generator=False) return entries def get_sessions(self): entries = self.search('(&(samAccountType=805306368)(!(userAccountControl:1.2.840.113556.1.4.803:=2))(|(homedirectory=*)(scriptpath=*)(profilepath=*)))', ['homedirectory', 'scriptpath', 'profilepath']) return entries def get_childobjects(self, dn, use_resolver=True): entries = self.search('(|(objectClass=container)(objectClass=organizationalUnit)(sAMAccountType=805306369)(objectClass=group)(&(objectCategory=person)(objectClass=user)))', attributes=['objectSid', 'objectClass', 'objectGUID', 'distinguishedName', 'sAMAccountName', 'sAMAccountType'], search_base=dn, search_scope=LEVEL, use_resolver=use_resolver) return entries def get_trusts(self): entries = self.search('(objectClass=trustedDomain)', attributes=['flatName', 'name', 'securityIdentifier', 'trustAttributes', 'trustDirection', 'trustType'], generator=True) return entries def prefetch_info(self, props=False, acls=False, cache_computers=False): self.get_objecttype() self.get_domains(acl=acls) self.get_forest_domains() if cache_computers: self.get_computers_withcache(include_properties=props, acl=acls) def get_root_domain(self): return ADUtils.ldap2domain(self.ldap.server.info.other['configurationNamingContext'][0]) """ Active Directory data and cache """ class AD(object): def __init__(self, domain=None, auth=None, nameserver=None, dns_tcp=False, dns_timeout=3.0, use_ldaps=False): self.domain = domain # Object of type ADDomain, added later self.domain_object = None self.auth = auth # List of DCs for this domain. Contains just one DC since # we query for the primary DC specifically self._dcs = [] # Kerberos servers self._kdcs = [] # Global catalog servers self._gcs = [] self.domains = {} self.nbdomains = {} self.groups = {} # Groups by DN self.groups_dnmap = {} # Group mapping from gid to DN self.computers = {} self.users = {} # Users by DN # Create a resolver object self.dnsresolver = resolver.Resolver() if nameserver: self.dnsresolver.nameservers = [nameserver] # Resolve DNS over TCP? self.dns_tcp = dns_tcp # Give it a cache to prevent duplicate lookups self.dnsresolver.cache = resolver.Cache() # Default timeout after 3 seconds if the DNS servers # do not come up with an answer self.dnsresolver.timeout = float(dns_timeout) self.dnsresolver.lifetime = float(dns_timeout) # Also create a custom cache for both forward and backward lookups # this cache is thread-safe self.dnscache = DNSCache() # Create a thread-safe SID lookup cache self.sidcache = SidCache() # Create a thread-safe SAM lookup cache self.samcache = SamCache() # DN cache dict - use generic cache for all objects # holds only direct bloodhound output self.dncache = {} self.newsidcache = SidCache() # Create SID cache for computer accounts self.computersidcache = SidCache() # Object Resolver, initialized later self.objectresolver = None # Number of domains within the forest self.num_domains = 1 # Does the schema have laps properties self.has_laps = False # Does the schema have lapsv2 properties self.has_lapsv2 = False # Does the schema have msDS-KeyCredentialLink self.has_keycredlink = False if domain is not None: self.baseDN = ADUtils.domain2ldap(domain) else: self.baseDN = None if use_ldaps: self.ldap_default_protocol = 'ldaps' else: self.ldap_default_protocol = 'ldap' def realm(self): if self.domain is not None: return self.domain.upper() else: return None def override_dc(self, dcname): self._dcs = [dcname] def override_gc(self, gcname): self._gcs = [gcname] def dcs(self): return self._dcs def gcs(self): return self._gcs def kdcs(self): return self._kdcs def create_objectresolver(self, addc): self.objectresolver = ObjectResolver(addomain=self, addc=addc) def load_cachefile(self, cachefile): with codecs.open(cachefile, 'r', 'utf-8') as cfile: cachedata = json.load(cfile) self.dncache = cachedata['dncache'] self.newsidcache.load(cachedata['sidcache']) logging.info('Loaded cached DNs and SIDs from cachefile') def save_cachefile(self, cachefile): pass def dns_resolve(self, domain=None, options=None): logging.debug('Querying domain controller information from DNS') basequery = '_ldap._tcp.pdc._msdcs' ad_domain = None if domain is not None: logging.debug('Using domain hint: %s' % str(domain)) query = '_ldap._tcp.pdc._msdcs.%s' % domain else: # Assume a DNS search domain is (correctly) configured on the host # in which case the resolver will autocomplete our request query = basequery try: q = self.dnsresolver.query(query, 'SRV', tcp=self.dns_tcp) if str(q.qname).lower().startswith('_ldap._tcp.pdc._msdcs'): ad_domain = str(q.qname).lower()[len(basequery):].strip('.') logging.info('Found AD domain: %s' % ad_domain) self.domain = ad_domain if self.auth.domain is None: self.auth.domain = ad_domain self.baseDN = ADUtils.domain2ldap(ad_domain) for r in q: dc = str(r.target).rstrip('.') logging.debug('Found primary DC: %s' % dc) if dc not in self._dcs: self._dcs.append(dc) except resolver.NXDOMAIN: pass try: q = self.dnsresolver.query(query.replace('pdc','gc'), 'SRV', tcp=self.dns_tcp) for r in q: gc = str(r.target).rstrip('.') logging.debug('Found Global Catalog server: %s' % gc) if gc not in self._gcs: self._gcs.append(gc) except resolver.NXDOMAIN: # Only show warning if we don't already have a GC specified manually if options and not options.global_catalog: if not options.disable_autogc: logging.warning('Could not find a global catalog server, assuming the primary DC has this role\n' 'If this gives errors, either specify a hostname with -gc or disable gc resolution with --disable-autogc') self._gcs = self._dcs else: logging.warning('Could not find a global catalog server. Please specify one with -gc') try: kquery = query.replace('pdc','dc').replace('_ldap','_kerberos') q = self.dnsresolver.query(kquery, 'SRV', tcp=self.dns_tcp) # TODO: Get the additional records here to get the DC ip immediately for r in q: kdc = str(r.target).rstrip('.') logging.debug('Found KDC for enumeration domain: %s' % str(r.target).rstrip('.')) if kdc not in self._kdcs: self._kdcs.append(kdc) self.auth.kdc = self._kdcs[0] except resolver.NXDOMAIN: pass # Fix for below in case domain was not found via DNS if not ad_domain: if domain: ad_domain = domain else: ad_domain = 'unknown' if self.auth.userdomain.lower() != ad_domain.lower(): # Resolve KDC for user auth domain kquery = '_kerberos._tcp.dc._msdcs.%s' % self.auth.userdomain q = self.dnsresolver.query(kquery, 'SRV', tcp=self.dns_tcp) for r in q: kdc = str(r.target).rstrip('.') logging.debug('Found KDC for user: %s' % str(r.target).rstrip('.')) self.auth.userdomain_kdc = kdc else: self.auth.userdomain_kdc = self.auth.kdc return True def get_domain_by_name(self, name): for domain, entry in self.domains.items(): if 'name' in entry['attributes']: if entry['attributes']['name'].upper() == name.upper(): return entry # Also try domains by NETBIOS definition for domain, entry in self.nbdomains.items(): if domain.upper() == name.upper(): return entry return None def get_dn_from_cache_or_ldap(self, distinguishedname): try: linkentry = self.dncache[distinguishedname.upper()] except KeyError: use_gc = ADUtils.ldap2domain(distinguishedname).lower() != self.domain.lower() qobject = self.objectresolver.resolve_distinguishedname(distinguishedname, use_gc=use_gc) if qobject is None: return None resolved_entry = ADUtils.resolve_ad_entry(qobject) linkentry = { "ObjectIdentifier": resolved_entry['objectid'], "ObjectType": resolved_entry['type'].capitalize() } self.dncache[distinguishedname.upper()] = linkentry return linkentry """ Active Directory Domain """ class ADDomain(object): def __init__(self, name=None, netbios_name=None, sid=None, distinguishedname=None): self.name = name self.netbios_name = netbios_name self.sid = sid self.distinguishedname = distinguishedname @staticmethod def fromLDAP(identifier, sid=None): dns_name = ADUtils.ldap2domain(identifier) return ADDomain(name=dns_name, sid=sid, distinguishedname=identifier) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1669655377.0 bloodhound-1.8.0/bloodhound/ad/dumpntlm.py0000664000175000017500000004533614341165521017405 0ustar00useruser#!/usr/bin/env python # Impacket - Collection of Python classes for working with network protocols. # # SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. All rights reserved. # # This software is provided under a slightly modified version # of the Apache Software License. See the accompanying LICENSE file # for more information. # # Description: # Dump remote host information in ntlm authentication model, without credentials. # For SMB protocols (1 and 2/3), it's easy to use SMBConnection class (thanks to @agsolino), # but since negotiate response is not available in original classes, # we made out custom classes based on them. # The usefull information in negotiate response are "Dialect Version", "Signing Options", # "Maximum bytes allowed per smb request" and "Servers time information". # The point is sometimes server dosn't include "boot time" in response. But we show it, # when available, in this script. # # It's very easy to use: # python dumpntlm.py 192.168.1.63 # # Author: # Alex Romero (@NtAlexio2) # # Reference for: # [MS-SMB2] # [MS-RPCE] # # NOTE: # This is modified version of original dumpntlm.py here: # https://github.com/NtAlexio2/impacket/blob/master/examples/dumpntlm.py # The relevant pull request (https://github.com/SecureAuthCorp/impacket/pull/1404) # to Impacket is not accepted at the time of adding this file to BloodHound.py repo. # import os import socket import string, random from impacket import nmb, ntlm from impacket.smb import SMB, NewSMBPacket, SMBCommand, SMBNTLMDialect_Parameters,\ SMBNTLMDialect_Data, SMBExtended_Security_Parameters, SMBExtended_Security_Data, UnsupportedFeature,\ SMBSessionSetupAndX_Extended_Data, SMBSessionSetupAndX_Extended_Parameters, SMBSessionSetupAndX_Extended_Response_Parameters,\ SMBSessionSetupAndX_Extended_Response_Data, SMB_DIALECT from impacket.smb3structs import * from impacket.spnego import SPNEGO_NegTokenInit, SPNEGO_NegTokenResp, TypesMech from impacket.nt_errors import STATUS_SUCCESS from impacket.uuid import uuidtup_to_bin from impacket.dcerpc.v5 import transport, epm from impacket.dcerpc.v5.rpcrt import * class RPC: def __init__(self, target) -> None: self.MaxTrasmitionSize = 0 self._initializeTransport(target) def GetChallange(self): ntlmChallenge = None packet = self._create_bind_request() self._rpctransport.send(packet.get_packet()) buffer = self._rpctransport.recv() if buffer != 0: response = MSRPCHeader(buffer) bindResp = MSRPCBindAck(response.getData()) self.MaxTrasmitionSize = bindResp['max_rfrag'] ntlmChallenge = ntlm.NTLMAuthChallenge(bindResp['auth_data']) return ntlmChallenge def _initializeTransport(self, target): self._rpctransport = transport.DCERPCTransportFactory(r'ncacn_ip_tcp:%s[135]' % target) self._rpctransport.set_credentials('', '', '', '', '') self._rpctransport.set_dport(135) self._rpctransport.connect() def _create_bind_request(self): bind = MSRPCBind() item = CtxItem() item['AbstractSyntax'] = epm.MSRPC_UUID_PORTMAP item['TransferSyntax'] = uuidtup_to_bin(('8a885d04-1ceb-11c9-9fe8-08002b104860', '2.0')) item['ContextID'] = 0 item['TransItems'] = 1 bind.addCtxItem(item) packet = MSRPCHeader() packet['type'] = MSRPC_BIND packet['pduData'] = bind.getData() packet['call_id'] = 1 auth = ntlm.getNTLMSSPType1('', '', signingRequired=True, use_ntlmv2=True) sec_trailer = SEC_TRAILER() sec_trailer['auth_type'] = RPC_C_AUTHN_WINNT sec_trailer['auth_level'] = RPC_C_AUTHN_LEVEL_PKT_INTEGRITY sec_trailer['auth_ctx_id'] = 0 + 79231 pad = (4 - (len(packet.get_packet()) % 4)) % 4 if pad != 0: packet['pduData'] += b'\xFF'*pad sec_trailer['auth_pad_len']=pad packet['sec_trailer'] = sec_trailer packet['auth_data'] = auth return packet class SMB1: def __init__(self, remote_name, remote_host, my_name=None, sess_port=445, timeout=60, session=None, negSessionResponse=None): self._uid = 0 self._dialects_data = None self._SignatureRequired = False self._dialects_parameters = None self.__flags1 = SMB.FLAGS1_PATHCASELESS | SMB.FLAGS1_CANONICALIZED_PATHS self.__flags2 = SMB.FLAGS2_EXTENDED_SECURITY | SMB.FLAGS2_NT_STATUS | SMB.FLAGS2_LONG_NAMES self.__timeout = timeout self._session = session self._my_name = my_name self._auth = None if session is None: self._session = nmb.NetBIOSTCPSession(my_name, remote_name, remote_host, nmb.TYPE_SERVER, sess_port, self.__timeout) self._negotiateResponse = self._negotiateSession(negSessionResponse) def GetNegotiateResponse(self): return self._negotiateResponse def GetChallange(self): packet = NewSMBPacket() if self._SignatureRequired: packet['Flags2'] |= SMB.FLAGS2_SMB_SECURITY_SIGNATURE sessionSetup = self._createSessionSetupRequest() packet.addCommand(sessionSetup) self.send(packet) packet = self.receive() if packet.isValidAnswer(SMB.SMB_COM_SESSION_SETUP_ANDX): self._uid = packet['Uid'] sessionResponse = SMBCommand(packet['Data'][0]) sessionParameters = SMBSessionSetupAndX_Extended_Response_Parameters(sessionResponse['Parameters']) sessionData = SMBSessionSetupAndX_Extended_Response_Data(flags = packet['Flags2']) sessionData['SecurityBlobLength'] = sessionParameters['SecurityBlobLength'] sessionData.fromString(sessionResponse['Data']) self._respToken = SPNEGO_NegTokenResp(sessionData['SecurityBlob']) ntlmChallenge = ntlm.NTLMAuthChallenge(self._respToken['ResponseToken']) self._session.close() return ntlmChallenge def send(self, negoPacket): negoPacket['Uid'] = self._uid negoPacket['Pid'] = (os.getpid() & 0xFFFF) negoPacket['Flags1'] |= self.__flags1 negoPacket['Flags2'] |= self.__flags2 self._session.send_packet(negoPacket.getData()) def receive(self): r = self._session.recv_packet(self.__timeout) return NewSMBPacket(data = r.get_trailer()) def _negotiateSession(self, negPacket = None): def parsePacket(negoPacket): if negoPacket['Flags2'] & SMB.FLAGS2_UNICODE: self.__flags2 |= SMB.FLAGS2_UNICODE if negoPacket.isValidAnswer(SMB.SMB_COM_NEGOTIATE): sessionResponse = SMBCommand(negoPacket['Data'][0]) self._dialects_parameters = SMBNTLMDialect_Parameters(sessionResponse['Parameters']) self._dialects_data = SMBNTLMDialect_Data() self._dialects_data['ChallengeLength'] = self._dialects_parameters['ChallengeLength'] self._dialects_data.fromString(sessionResponse['Data']) if self._dialects_parameters['Capabilities'] & SMB.CAP_EXTENDED_SECURITY: self._dialects_parameters = SMBExtended_Security_Parameters(sessionResponse['Parameters']) self._dialects_data = SMBExtended_Security_Data(sessionResponse['Data']) if self._dialects_parameters['SecurityMode'] & SMB.SECURITY_SIGNATURES_REQUIRED: self._SignatureRequired = True else: if self._dialects_parameters['DialectIndex'] == 0xffff: raise UnsupportedFeature("Remote server does not know NT LM 0.12") return self._wrapper(sessionResponse) if negPacket is None: negoPacket = NewSMBPacket() negSession = SMBCommand(SMB.SMB_COM_NEGOTIATE) self.__flags2 = self.__flags2 | SMB.FLAGS2_EXTENDED_SECURITY negSession['Data'] = b'\x02NT LM 0.12\x00' negoPacket.addCommand(negSession) self.send(negoPacket) negoPacket = self.receive() return parsePacket(negoPacket) return parsePacket(NewSMBPacket(data = negPacket)) def _createSessionSetupRequest(self): sessionSetup = SMBCommand(SMB.SMB_COM_SESSION_SETUP_ANDX) sessionSetup['Data'] = SMBSessionSetupAndX_Extended_Data() sessionSetup['Parameters'] = SMBSessionSetupAndX_Extended_Parameters() sessionSetup['Parameters']['MaxBufferSize'] = 61440 sessionSetup['Parameters']['MaxMpxCount'] = 2 sessionSetup['Parameters']['VcNumber'] = 1 sessionSetup['Parameters']['SessionKey'] = 0 sessionSetup['Parameters']['Capabilities'] = SMB.CAP_EXTENDED_SECURITY | SMB.CAP_USE_NT_ERRORS | SMB.CAP_UNICODE | SMB.CAP_LARGE_READX | SMB.CAP_LARGE_WRITEX blob = SPNEGO_NegTokenInit() blob['MechTypes'] = [TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']] self._auth = ntlm.getNTLMSSPType1(self._my_name, '', self._SignatureRequired, use_ntlmv2=True) blob['MechToken'] = self._auth.getData() sessionSetup['Parameters']['SecurityBlobLength'] = len(blob) sessionSetup['Parameters'].getData() sessionSetup['Data']['SecurityBlob'] = blob.getData() sessionSetup['Data']['NativeOS'] = 'U\x00n\x00i\x00x\x00\x00\x00' sessionSetup['Data']['NativeLanMan'] = 'S\x00a\x00m\x00b\x00a\x00\x00' return sessionSetup def _wrapper(self, sessionResponse): sessionResponse['DialectRevision'] = SMB_DIALECT if self._dialects_parameters['SecurityMode'] & SMB.SECURITY_SIGNATURES_ENABLED: sessionResponse['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED if self._SignatureRequired: sessionResponse['SecurityMode'] |= SMB2_NEGOTIATE_SIGNING_REQUIRED sessionResponse['MaxReadSize'] = self._dialects_parameters['MaxBufferSize'] sessionResponse['MaxWriteSize'] = self._dialects_parameters['MaxBufferSize'] sessionResponse['SystemTime'] = self._to_long_filetime(self._dialects_parameters['LowDateTime'], self._dialects_parameters['HighDateTime']) sessionResponse['ServerStartTime'] = 0 # SMB1 has not boot time totally return sessionResponse def _to_long_filetime(self, dwLowDateTime, dwHighDateTime): temp_time = dwHighDateTime temp_time <<= 32 temp_time |= dwLowDateTime return temp_time class SMB3: def __init__(self, remote_name, remote_host, my_name=None, sess_port=445, timeout=60, session=None, negSessionResponse=None): self._NetBIOSSession = session self._sequenceWindow = 0 self._sessionId = 0 self._timeout = timeout self._auth = None if session is None: self._NetBIOSSession = nmb.NetBIOSTCPSession(my_name, remote_name, remote_host, nmb.TYPE_SERVER, sess_port, timeout) else: self._sequenceWindow += 1 self._negotiateResponse = self._negotiateSession(negSessionResponse) def GetNegotiateResponse(self): return self._negotiateResponse def GetChallange(self): packet = self._createSessionSetupRequest(self._negotiateResponse['DialectRevision']) self.send(packet) self._answer = self.receive() sessionSetupResponse = SMB2SessionSetup_Response(self._answer['Data']) self._respToken = SPNEGO_NegTokenResp(sessionSetupResponse['Buffer']) ntlmChallenge = ntlm.NTLMAuthChallenge(self._respToken['ResponseToken']) self._NetBIOSSession.close() return ntlmChallenge def send(self, packet): packet['MessageID'] = self._sequenceWindow self._sequenceWindow += 1 packet['SessionID'] = self._sessionId packet['CreditCharge'] = 1 messageId = packet['MessageID'] data = packet.getData() self._NetBIOSSession.send_packet(data) return messageId def receive(self): data = self._NetBIOSSession.recv_packet(self._timeout) packet = SMB2Packet(data.get_trailer()) return packet def _negotiateSession(self, negSessionResponse = None): currentDialect = SMB2_DIALECT_WILDCARD if negSessionResponse is not None: negotiateResponse = SMB2Negotiate_Response(negSessionResponse['Data']) currentDialect = negotiateResponse['DialectRevision'] if currentDialect == SMB2_DIALECT_WILDCARD: packet = SMB2Packet() packet['Command'] = SMB2_NEGOTIATE negSession = SMB2Negotiate() negSession['SecurityMode'] = SMB2_NEGOTIATE_SIGNING_ENABLED negSession['Capabilities'] = SMB2_GLOBAL_CAP_ENCRYPTION negSession['ClientGuid'] = ''.join([random.choice(string.ascii_letters) for _ in range(16)]) negSession['Dialects'] = [SMB2_DIALECT_002, SMB2_DIALECT_21, SMB2_DIALECT_30] negSession['DialectCount'] = len(negSession['Dialects']) packet['Data'] = negSession self.send(packet) answer = self.receive() if answer.isValidAnswer(STATUS_SUCCESS): negotiateResponse = SMB2Negotiate_Response(answer['Data']) return negotiateResponse def _createSessionSetupRequest(self, dialect): sessionSetup = SMB2SessionSetup() sessionSetup['Flags'] = 0 blob = SPNEGO_NegTokenInit() blob['MechTypes'] = [TypesMech['NTLMSSP - Microsoft NTLM Security Support Provider']] self._auth = ntlm.getNTLMSSPType1('', '', False) blob['MechToken'] = self._auth.getData() sessionSetup['SecurityBufferLength'] = len(blob) sessionSetup['Buffer'] = blob.getData() packet = SMB2Packet() if dialect >= SMB2_DIALECT_30: packet = SMB3Packet() packet['Command'] = SMB2_SESSION_SETUP packet['Data'] = sessionSetup return packet class SmbConnection: def __init__(self, ip, hostname, port) -> None: self.target = ip self.hostname = hostname self._sess_port = int(port) self._timeout = 60 self._myName = self._get_my_name() self._nmbSession = None self._SMBConnection = None def NegotiateSession(self): flags1 = SMB.FLAGS1_PATHCASELESS | SMB.FLAGS1_CANONICALIZED_PATHS flags2 = SMB.FLAGS2_EXTENDED_SECURITY | SMB.FLAGS2_NT_STATUS | SMB.FLAGS2_LONG_NAMES negoData = '\x02NT LM 0.12\x00\x02SMB 2.002\x00\x02SMB 2.???\x00' if self._sess_port == nmb.NETBIOS_SESSION_PORT: negoData = '\x02NT LM 0.12\x00\x02SMB 2.002\x00' packet = self._negotiateSessionWildcard(True, flags1=flags1, flags2=flags2, data=negoData) if packet[0:1] == b'\xfe': self._SMBConnection = SMB3(self.hostname, self.target, self._myName, self._sess_port, self._timeout, session=self._nmbSession, negSessionResponse=SMB2Packet(packet)) else: self._SMBConnection = SMB1(self.hostname, self.target, self._myName, self._sess_port, self._timeout, session=self._nmbSession, negSessionResponse=packet) return self._SMBConnection.GetNegotiateResponse() def GetChallange(self): return self._SMBConnection.GetChallange() def _negotiateSessionWildcard(self, extended_security=True, flags1=0, flags2=0, data=None): tries = 0 smbp = NewSMBPacket() smbp['Flags1'] = flags1 smbp['Flags2'] = flags2 | SMB.FLAGS2_UNICODE response = None while tries < 2: self._nmbSession = nmb.NetBIOSTCPSession(self._myName, self.hostname, self.target, nmb.TYPE_SERVER, self._sess_port, self._timeout) negSession = SMBCommand(SMB.SMB_COM_NEGOTIATE) if extended_security is True: smbp['Flags2'] |= SMB.FLAGS2_EXTENDED_SECURITY negSession['Data'] = data smbp.addCommand(negSession) self._nmbSession.send_packet(smbp.getData()) try: response = self._nmbSession.recv_packet(self._timeout) break except nmb.NetBIOSError: smbp['Flags2'] |= SMB.FLAGS2_NT_STATUS | SMB.FLAGS2_LONG_NAMES | SMB.FLAGS2_UNICODE smbp['Data'] = [] tries += 1 if response is None: raise Exception('No answer!') return response.get_trailer() def _get_my_name(self): myName = socket.gethostname() i = myName.find('.') if i > -1: myName = myName[:i] return myName class DumpNtlm: def __init__(self, ip, hostname, port) -> None: self.target = ip self.hostname = hostname self._sess_port = int(port) self._timeout = 60 def GetInfo(self) -> dict: if self._sess_port in [139, 445]: return self.GetSmbInfo() elif self._sess_port in [135]: return self.GetRpcInfo() def GetRpcInfo(self) -> dict: rpc = RPC(self.target) ntlmChallenge = rpc.GetChallange() return self.GetChallangeInfo(ntlmChallenge) def GetSmbInfo(self) -> dict: connection = SmbConnection(self.target, self.hostname, self._sess_port) negotiation = connection.NegotiateSession() ntlmChallenge = connection.GetChallange() return self.GetChallangeInfo(ntlmChallenge) def GetChallangeInfo(self, challange) -> dict: info = {} if challange['TargetInfoFields_len'] > 0: av_pairs = ntlm.AV_PAIRS(challange['TargetInfoFields'][:challange['TargetInfoFields_len']]) if av_pairs[ntlm.NTLMSSP_AV_HOSTNAME] is not None: try: info['name'] = av_pairs[ntlm.NTLMSSP_AV_HOSTNAME][1].decode('utf-16le') except: pass if av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME] is not None: try: info['domain'] = av_pairs[ntlm.NTLMSSP_AV_DOMAINNAME][1].decode('utf-16le') except: pass if av_pairs[ntlm.NTLMSSP_AV_DNS_TREENAME] is not None: try: info['dns_tree'] = av_pairs[ntlm.NTLMSSP_AV_DNS_TREENAME][1].decode('utf-16le') except: pass if av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME] is not None: try: info['dns_domain'] = av_pairs[ntlm.NTLMSSP_AV_DNS_DOMAINNAME][1].decode('utf-16le') except: pass if av_pairs[ntlm.NTLMSSP_AV_DNS_HOSTNAME] is not None: try: info['dns_host'] = av_pairs[ntlm.NTLMSSP_AV_DNS_HOSTNAME][1].decode('utf-16le') except: pass return info ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/bloodhound/ad/structures.py0000644000175000017500000000363213646103213017754 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### from impacket.structure import Structure from struct import unpack # LDAP SID structure - from impackets SAMR_RPC_SID, except the SubAuthority is LE here class LDAP_SID_IDENTIFIER_AUTHORITY(Structure): structure = ( ('Value', '6s'), ) class LDAP_SID(Structure): structure = ( ('Revision', '(S-[0-9\\-]+)') xml_logontype_rex = re.compile('([A-Za-z0-9]+)') @staticmethod def domain2ldap(domain): return 'DC=' + ',DC='.join(str(domain).rstrip('.').split('.')) @staticmethod def ldap2domain(ldap): return re.sub(',DC=', '.', ldap[ldap.find('DC='):], flags=re.I)[3:] @staticmethod def tcp_ping(host, port, timeout=1.0): try: s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.settimeout(timeout) s.connect((host, port)) s.close() return True except KeyboardInterrupt: raise except: return False @staticmethod def ip2host(ip, resolver=resolver, use_tcp=False): result = ip try: addr = reversename.from_address(ip) except dns.exception.SyntaxError: logging.warning('DNS: invalid address: %s' % ip) return result try: answer = str(resolver.query(addr, 'PTR', tcp=use_tcp)[0]) result = answer.rstrip('.') except (dns.resolver.NXDOMAIN, dns.resolver.Timeout) as e: pass except: logging.warning('DNS lookup failed: %s' % addr) pass return result @staticmethod def rpc_get_hostname(ip, adauth): ''' Authenticated hostname resolution. Requires admin rights. Currently not in use - does not respect authentication stack ''' result = ip binding = r'ncacn_np:%s[\PIPE\wkssvc]' % ip rpctransportWkst = transport.DCERPCTransportFactory(binding) if hasattr(rpctransportWkst, 'set_credentials'): rpctransportWkst.set_credentials(adauth.username, adauth.password, adauth.domain, adauth.lm_hash, adauth.nt_hash, adauth.aes_key) rpctransportWkst.set_kerberos(False, adauth.kdc) # not supported yet dce = rpctransportWkst.get_dce_rpc() try: dce.connect() dce.bind(wkst.MSRPC_UUID_WKST) resp = wkst.hNetrWkstaGetInfo(dce, 100) result = resp['WkstaInfo']['WkstaInfo100']['wki100_computername'][:-1] domain_name = resp['WkstaInfo']['WkstaInfo100']['wki100_langroup'][:-1] if '.' in domain_name: # not workgroup result = '.'.join([result, domain_name]) dce.disconnect() except: logging.warning('WkstaGetInfo failed: %s' % ip) pass return result @staticmethod def get_ntlm_hostname(ip): ''' Unauthenticated hostname resolution with NTLM challenge/response ''' def parse_info(info): if not info: return info if 'dns_host' in info: return info['dns_host'].lower() elif 'name' in info: result = info['name'] if 'dns_domain' in info and '.' in info['dns_domain']: result = '.'.join((result, info['dns_domain'])) return result.lower() return None try: ntlm_dumper = DumpNtlm(ip, ip, 445) hostname = parse_info(ntlm_dumper.GetInfo()) if hostname: return hostname except: pass try: ntlm_dumper = DumpNtlm(ip, ip, 139) hostname = parse_info(ntlm_dumper.GetInfo()) if hostname: return hostname except: pass try: ntlm_dumper = DumpNtlm(ip, ip, 135) hostname = parse_info(ntlm_dumper.GetInfo()) if hostname: return hostname except: pass return ip # Translate the binary SID from LDAP into human-readable form @staticmethod def formatSid(siddata): return LDAP_SID(siddata).formatCanonical() # Translate SidType to strings accepted by BloodHound @staticmethod def translateSidType(sidType): if sidType == 1: return 'User' if sidType == 2: return 'Group' # sidType 4 means "alias", this is actually a Domain Local Group if sidType == 4: return 'Group' if sidType == 9: return 'Computer' if sidType == 5: return 'Wellknown' # Can be a (by BloudHound) unsupported type # must not be an empty string since this breaks our CSV files return 'Unknown' @staticmethod def is_dc(entry): """ Check whether the computer object is a Domain Controller """ uac = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) return uac & 0x00002000 == 0x00002000 @staticmethod def resolve_ad_entry(entry): """ Translate an LDAP entry into a dictionary containing the information used by BloodHound """ resolved = {} dn = '' domain = '' account = ADUtils.get_entry_property(entry, 'sAMAccountName', '') dn = ADUtils.get_entry_property(entry, 'distinguishedName', '') if dn != '': domain = ADUtils.ldap2domain(dn) resolved['objectid'] = ADUtils.get_entry_property(entry, 'objectSid', '') resolved['principal'] = ('%s@%s' % (account, domain)).upper() if not ADUtils.get_entry_property(entry, 'sAMAccountName'): if 'ForeignSecurityPrincipals' in dn and not 'container' in ADUtils.get_entry_property(entry, 'objectClass', []): resolved['principal'] = domain.upper() resolved['type'] = 'foreignsecurityprincipal' ename = ADUtils.get_entry_property(entry, 'name') if ename: # Fix wellknown entries if ename in ADUtils.WELLKNOWN_SIDS: name, sidtype = ADUtils.WELLKNOWN_SIDS[ename] resolved['type'] = sidtype.capitalize() resolved['principal'] = ('%s@%s' % (name, domain)).upper() # Well-known have the domain prefix since 3.0 resolved['objectid'] = '%s-%s' % (domain.upper(), resolved['objectid']) else: # Foreign security principal resolved['objectid'] = ename elif ADUtils.get_entry_property(entry, 'objectGUID'): resolved['objectid'] = ADUtils.get_entry_property(entry, 'objectGUID', '').upper()[1:-1] resolved['principal'] = ('%s@%s' % (ADUtils.get_entry_property(entry, 'name', ''), domain)).upper() object_class = ADUtils.get_entry_property(entry, 'objectClass', []) if 'organizationalUnit' in object_class: resolved['type'] = 'OU' elif 'container' in object_class: resolved['type'] = 'Container' else: resolved['type'] = 'Base' else: resolved['type'] = 'Base' else: accountType = ADUtils.get_entry_property(entry, 'sAMAccountType') object_class = ADUtils.get_entry_property(entry, 'objectClass', []) if accountType in [268435456, 268435457, 536870912, 536870913]: resolved['type'] = 'Group' elif accountType in [805306368] or \ 'msDS-GroupManagedServiceAccount' in object_class or \ 'msDS-ManagedServiceAccount' in object_class: resolved['type'] = 'User' elif accountType in [805306369]: resolved['type'] = 'Computer' short_name = account.rstrip('$') resolved['principal'] = ('%s.%s' % (short_name, domain)).upper() elif accountType in [805306370]: resolved['type'] = 'trustaccount' else: resolved['type'] = 'Domain' return resolved @staticmethod def resolve_sid_entry(entry, domain): """ Convert LsarLookupSids entries to entries for the SID cache, which should match the format from the resolve_ad_entry function. """ resolved = {} account = entry['Name'] resolved['principal'] = ('%s@%s' % (account, domain)).upper() resolved['type'] = ADUtils.translateSidType(entry['Use']).lower() # Computer accounts have a different type if resolved['type'] == 'computer': short_name = account.rstrip('$') resolved['principal'] = ('%s.%s' % (short_name, domain)).upper() return resolved @staticmethod def get_entry_property(entry, prop, default=None, raw=False): """ Simple wrapper that gets an attribute from ldap3 dictionary, converting empty values to the default specified. This is primarily for output to JSON """ if entry is None: return default try: if raw: value = entry['raw_attributes'][prop] else: value = entry['attributes'][prop] # Doesn't exist except KeyError: return default # Empty -> return default if value == []: return default try: # One value and we don't expect a list -> return the first value if len(value) == 1 and default != []: return value[0] except TypeError: # Value doesn't have a len() attribute, so we skip this pass return value @staticmethod def win_timestamp_to_unix(seconds): """ Convert Windows timestamp (100 ns since 1 Jan 1601) to unix timestamp. """ seconds = int(seconds) if seconds == 0: return 0 return int((seconds - 116444736000000000) / 10000000) @staticmethod def parse_task_xml(xml): """ Parse scheduled task XML and extract the user and logon type with regex. Is not a good way to parse XMLs but saves us the whole parsing overhead. """ res = ADUtils.xml_sid_rex.search(xml) if not res: return None sid = res.group(1) res = ADUtils.xml_logontype_rex.search(xml) if not res: return None logon_type = res.group(1) return (sid, logon_type) @staticmethod def ensure_string(data): """ Sometimes properties can contain binary data. Since we can't assume encoding, make sure it can be outputted as json """ if isinstance(data, bytes): data = repr(data) elif isinstance(data, list): data = list(map(lambda x: repr(x) if isinstance(x, bytes) else x)) return data @staticmethod def is_filtered_container(containerdn): if not containerdn: return False if "CN=DOMAINUPDATES,CN=SYSTEM,DC=" in containerdn.upper(): return True if "CN=POLICIES,CN=SYSTEM,DC=" in containerdn.upper() and (containerdn.upper().startswith('CN=USER') or containerdn.upper().startswith('CN=MACHINE')): return True return False @staticmethod def is_filtered_container_child(containerdn): if not containerdn: return False if "CN=PROGRAM DATA,DC=" in containerdn.upper(): return True if "CN=SYSTEM,DC=" in containerdn.upper(): return True return False @staticmethod def parse_gplink_string(linkstr): ''' Parse GP Link string according to MS-GPOL https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpol/08090b22-bc16-49f4-8e10-f27a8fb16d18 ''' if not linkstr: return for links in linkstr.split('LDAP://')[1:]: dn, options = links.rstrip('][ ').split(';') yield dn, int(options) class AceResolver(object): """ This class resolves ACEs containing rights, acetype and a SID to Aces containing BloodHound principals, which can be outputted to json. This is mostly a wrapper around the sid resolver calls """ def __init__(self, addomain, resolver): self.addomain = addomain self.resolver = resolver def resolve_aces(self, aces): aces_out = [] for ace in aces: out = { 'RightName': ace['rightname'], 'IsInherited': ace['inherited'] } # Is it a well-known sid? if ace['sid'] in ADUtils.WELLKNOWN_SIDS: out['PrincipalSID'] = u'%s-%s' % (self.addomain.domain.upper(), ace['sid']) out['PrincipalType'] = ADUtils.WELLKNOWN_SIDS[ace['sid']][1].capitalize() else: try: linkitem = self.addomain.newsidcache.get(ace['sid']) except KeyError: # Look it up instead # Is this SID part of the current domain? If not, use GC use_gc = not ace['sid'].startswith(self.addomain.domain_object.sid) ldapentry = self.resolver.resolve_sid(ace['sid'], use_gc) # Couldn't resolve... if not ldapentry: logging.debug('Could not resolve SID: %s', ace['sid']) # Fake it entry = { 'type': 'Base', 'objectid': ace['sid'] } else: entry = ADUtils.resolve_ad_entry(ldapentry) linkitem = { "ObjectIdentifier": entry['objectid'], "ObjectType": entry['type'].capitalize() } # Entries are cached regardless of validity - unresolvable sids # are not likely to be resolved the second time and this saves traffic self.addomain.newsidcache.put(ace['sid'], linkitem) out['PrincipalSID'] = ace['sid'] out['PrincipalType'] = linkitem['ObjectType'] aces_out.append(out) return aces_out def resolve_sid(self, sid): # Resolve SIDs for SID history purposes out = {} # Is it a well-known sid? if sid in ADUtils.WELLKNOWN_SIDS: out['ObjectIdentifier'] = u'%s-%s' % (self.addomain.domain.upper(), sid) out['ObjectType'] = ADUtils.WELLKNOWN_SIDS[sid][1].capitalize() else: try: linkitem = self.addomain.newsidcache.get(sid) except KeyError: # Look it up instead # Is this SID part of the current domain? If not, use GC use_gc = not sid.startswith(self.addomain.domain_object.sid) ldapentry = self.resolver.resolve_sid(sid, use_gc) # Couldn't resolve... if not ldapentry: logging.debug('Could not resolve SID: %s', sid) # Fake it entry = { 'type': 'Base', 'objectid':sid } else: entry = ADUtils.resolve_ad_entry(ldapentry) linkitem = { "ObjectIdentifier": entry['objectid'], "ObjectType": entry['type'].capitalize() } # Entries are cached regardless of validity - unresolvable sids # are not likely to be resolved the second time and this saves traffic self.addomain.newsidcache.put(sid, linkitem) out['ObjectIdentifier'] = sid out['ObjectType'] = linkitem['ObjectType'] return out class DNSCache(object): """ A cache used for caching forward and backward DNS at the same time. This cache is used to avoid PTR queries when forward lookups are already done """ def __init__(self): self.lock = threading.Lock() self._cache = {} # Get an entry from the cache def get(self, entry): with self.lock: return self._cache[entry] # Put a forward lookup in the cache, this also # puts the reverse lookup in the cache def put(self, entry, value): with self.lock: self._cache[entry] = value self._cache[value] = entry # Put a reverse lookup in the cache. Forward lookup # is not added since reverse is considered less reliable def put_single(self, entry, value): with self.lock: self._cache[entry] = value class SidCache(object): """ Generic cache for caching SID lookups """ def __init__(self): self.lock = threading.Lock() self._cache = {} # Get an entry from the cache def get(self, entry): with self.lock: return self._cache[entry] # Put a forward lookup in the cache, this also # puts the reverse lookup in the cache def put(self, entry, value): with self.lock: self._cache[entry] = value # Overwrite cache from disk def load(self, cache): self._cache = cache class SamCache(SidCache): """ Cache for mapping SAM names to principals. Identical to the SidCache in behaviour """ pass class CollectionException(Exception): pass ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.095881 bloodhound-1.8.0/bloodhound/enumeration/0000775000175000017500000000000014735533117017131 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/bloodhound/enumeration/__init__.py0000644000175000017500000000000013646103213021214 0ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832038.0 bloodhound-1.8.0/bloodhound/enumeration/acls.py0000664000175000017500000006270014735530746020437 0ustar00useruser#################### # # Copyright (c) 2022 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging from multiprocessing import Pool from impacket.uuid import string_to_bin, bin_to_string from bloodhound.lib import cstruct from io import BytesIO # Extended rights and property GUID mapping, converted to binary so we don't have to do this # for every comparison. # Source: https://msdn.microsoft.com/en-us/library/cc223512.aspx EXTRIGHTS_GUID_MAPPING = { "GetChanges": string_to_bin("1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"), "GetChangesAll": string_to_bin("1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"), "GetChangesInFilteredSet": string_to_bin("89e95b76-444d-4c62-991a-0facbeda640c"), "WriteMember": string_to_bin("bf9679c0-0de6-11d0-a285-00aa003049e2"), "UserForceChangePassword": string_to_bin("00299570-246d-11d0-a768-00aa006e0529"), "AllowedToAct": string_to_bin("3f78c3e5-f79a-46bd-a0b8-9d18116ddc79"), "UserAccountRestrictionsSet": string_to_bin("4c164200-20c0-11d0-a768-00aa006e0529"), "WriteGPLink": string_to_bin("f30e3bbf-9ff0-11d1-b603-0000f80367c1") } def parse_binary_acl(entry, entrytype, acl, objecttype_guid_map): """ Main ACL structure parse function. This is offloaded to subprocesses and takes the current entry and the acl data as argument. This is then returned and processed back in the main process """ if not acl: return entry, [] sd = SecurityDescriptor(BytesIO(acl)) # Check for protected DACL flag entry['IsACLProtected'] = sd.has_control(sd.PD) relations = [] # Parse owner osid = str(sd.owner_sid) ignoresids = ["S-1-3-0", "S-1-5-18", "S-1-5-10"] # Ignore Creator Owner or Local System if osid not in ignoresids: relations.append(build_relation(osid, 'Owns', inherited=False)) for ace_object in sd.dacl.aces: if ace_object.ace.AceType != 0x05 and ace_object.ace.AceType != 0x00: # These are the only two aces we care about currently logging.debug('Don\'t care about acetype %d', ace_object.ace.AceType) continue # Check if sid is ignored sid = str(ace_object.acedata.sid) # Ignore Creator Owner or Local System if sid in ignoresids: continue # For debugging, print specific aces # if sid == "S-1-5-21-2895268558-4179327395-2773671012-513": # print(ace_object) if ace_object.ace.AceType == 0x05: is_inherited = ace_object.has_flag(ACE.INHERITED_ACE) # ACCESS_ALLOWED_OBJECT_ACE if not ace_object.has_flag(ACE.INHERITED_ACE) and ace_object.has_flag(ACE.INHERIT_ONLY_ACE): # ACE is set on this object, but only inherited, so not applicable to us continue # Check if the ACE has restrictions on object type (inherited case) if ace_object.has_flag(ACE.INHERITED_ACE) \ and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_INHERITED_OBJECT_TYPE_PRESENT): # Verify if the ACE applies to this object type if not ace_applies(ace_object.acedata.get_inherited_object_type().lower(), entrytype, objecttype_guid_map): continue mask = ace_object.acedata.mask # Now the magic, we have to check all the rights BloodHound cares about # Check generic access masks first if mask.has_priv(ACCESS_MASK.GENERIC_ALL) or mask.has_priv(ACCESS_MASK.WRITE_DACL) \ or mask.has_priv(ACCESS_MASK.WRITE_OWNER) or mask.has_priv(ACCESS_MASK.GENERIC_WRITE): # For all generic rights we should check if it applies to our object type if ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and not ace_applies(ace_object.acedata.get_object_type().lower(), entrytype, objecttype_guid_map): # If it does not apply, break out of the loop here in order to # avoid individual rights firing later on continue # Check from high to low, ignore lower privs which may also match the bitmask, # even though this shouldn't happen since we check for exact matches currently if mask.has_priv(ACCESS_MASK.GENERIC_ALL): # Report this as LAPS rights if it's a computer object AND laps is enabled if entrytype == 'computer' and \ ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) and \ entry['Properties']['haslaps']: if ace_object.acedata.get_object_type().lower() == objecttype_guid_map['ms-mcs-admpwd']: relations.append(build_relation(sid, 'ReadLAPSPassword', inherited=is_inherited)) else: relations.append(build_relation(sid, 'GenericAll', inherited=is_inherited)) continue if mask.has_priv(ACCESS_MASK.GENERIC_WRITE): relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) # Don't skip this if it's the domain object, since BloodHound reports duplicate # rights as well, and this might influence some queries if entrytype != 'domain' and entrytype != 'computer': continue # These are specific bitmasks so don't break the loop from here if mask.has_priv(ACCESS_MASK.WRITE_DACL): relations.append(build_relation(sid, 'WriteDacl', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_OWNER): relations.append(build_relation(sid, 'WriteOwner', inherited=is_inherited)) # Property write privileges writeprivs = ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP) if writeprivs: # GenericWrite if entrytype in ['user', 'group', 'computer', 'gpo', 'organizational-unit'] and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) if entrytype == 'group' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['WriteMember']): relations.append(build_relation(sid, 'AddMember', '', inherited=is_inherited)) if entrytype == 'computer' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['AllowedToAct']): relations.append(build_relation(sid, 'AddAllowedToAct', '', inherited=is_inherited)) # Property set, but ignore Domain Admins since they already have enough privileges anyway if entrytype == 'computer' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['UserAccountRestrictionsSet']) and not sid.endswith('-512'): relations.append(build_relation(sid, 'WriteAccountRestrictions', '', inherited=is_inherited)) if entrytype == 'organizational-unit' and can_write_property(ace_object, EXTRIGHTS_GUID_MAPPING['WriteGPLink']): relations.append(build_relation(sid, 'WriteGPLink', '', inherited=is_inherited)) # Since 4.0 # Key credential link property write rights if entrytype in ['user', 'computer'] and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and 'ms-ds-key-credential-link' in objecttype_guid_map and ace_object.acedata.get_object_type().lower() == objecttype_guid_map['ms-ds-key-credential-link']: relations.append(build_relation(sid, 'AddKeyCredentialLink', inherited=is_inherited)) # ServicePrincipalName property write rights (exclude generic rights) if entrytype in ['user', 'computer'] and ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) \ and ace_object.acedata.get_object_type().lower() == objecttype_guid_map['service-principal-name']: relations.append(build_relation(sid, 'WriteSPN', inherited=is_inherited)) elif ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_SELF): # Self add - since 4.0 if entrytype == 'group' and ace_object.acedata.data.ObjectType == EXTRIGHTS_GUID_MAPPING['WriteMember']: relations.append(build_relation(sid, 'AddSelf', '', inherited=is_inherited)) # Property read privileges if ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_READ_PROP): if entrytype == 'computer' and \ ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT) and \ entry['Properties']['haslaps']: if ace_object.acedata.get_object_type().lower() in (objecttype_guid_map.get('ms-mcs-admpwd'), objecttype_guid_map.get('mslaps-password')): relations.append(build_relation(sid, 'ReadLAPSPassword', inherited=is_inherited)) # Extended rights control_access = ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS) if control_access: # All Extended if entrytype in ['user', 'domain'] and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) # Also report all extended if no laps if entrytype == 'computer' and not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChanges']): relations.append(build_relation(sid, 'GetChanges', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChangesAll']): relations.append(build_relation(sid, 'GetChangesAll', '', inherited=is_inherited)) if entrytype == 'domain' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['GetChangesInFilteredSet']): relations.append(build_relation(sid, 'GetChangesInFilteredSet', '', inherited=is_inherited)) if entrytype == 'user' and has_extended_right(ace_object, EXTRIGHTS_GUID_MAPPING['UserForceChangePassword']): relations.append(build_relation(sid, 'ForceChangePassword', '', inherited=is_inherited)) if ace_object.ace.AceType == 0x00: is_inherited = ace_object.has_flag(ACE.INHERITED_ACE) mask = ace_object.acedata.mask # ACCESS_ALLOWED_ACE if not ace_object.has_flag(ACE.INHERITED_ACE) and ace_object.has_flag(ACE.INHERIT_ONLY_ACE): # ACE is set on this object, but only inherited, so not applicable to us continue if mask.has_priv(ACCESS_MASK.GENERIC_ALL): # Generic all includes all other rights, so skip from here relations.append(build_relation(sid, 'GenericAll', inherited=is_inherited)) continue if mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP): # Genericwrite is only for properties, don't skip after if entrytype in ['user', 'group', 'computer', 'gpo', 'organizational-unit']: relations.append(build_relation(sid, 'GenericWrite', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_OWNER): relations.append(build_relation(sid, 'WriteOwner', inherited=is_inherited)) # For users and domain, check extended rights if entrytype in ['user', 'domain'] and mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) # Also report all extended if no laps if entrytype == 'computer' and mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS) and \ sid != "S-1-5-32-544" and not sid.endswith('-512'): relations.append(build_relation(sid, 'AllExtendedRights', '', inherited=is_inherited)) if mask.has_priv(ACCESS_MASK.WRITE_DACL): relations.append(build_relation(sid, 'WriteDacl', inherited=is_inherited)) # Self add, also possible ad ACCESS_ALLOWED_ACE if mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_SELF) and \ sid != "S-1-5-32-544" and not sid.endswith('-512') and not sid.endswith('-519'): if entrytype == 'group': relations.append(build_relation(sid, 'AddSelf', '', inherited=is_inherited)) # pprint.pprint(entry) # pprint.pprint(relations) return entry, relations def can_write_property(ace_object, binproperty): ''' Checks if the access is sufficient to write to a specific property. This can either be because we have the right ADS_RIGHT_DS_WRITE_PROP and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_WRITE_PROP right and the ObjectType is empty, in which case we can write to any property. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx ''' if not ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_WRITE_PROP): return False if not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): # No ObjectType present - we have generic access on all properties return True # Both are binary here if ace_object.acedata.data.ObjectType == binproperty: return True return False def has_extended_right(ace_object, binrightguid): ''' Checks if the access is sufficient to control the right with the given GUID. This can either be because we have the right ADS_RIGHT_DS_CONTROL_ACCESS and the correct GUID is set in ObjectType, or if we have the ADS_RIGHT_DS_CONTROL_ACCESS right and the ObjectType is empty, in which case we have all extended rights. This is documented in [MS-ADTS] section 5.1.3.2: https://msdn.microsoft.com/en-us/library/cc223511.aspx ''' if not ace_object.acedata.mask.has_priv(ACCESS_MASK.ADS_RIGHT_DS_CONTROL_ACCESS): return False if not ace_object.acedata.has_flag(ACCESS_ALLOWED_OBJECT_ACE.ACE_OBJECT_TYPE_PRESENT): # No ObjectType present - we have all extended rights return True # Both are binary here if ace_object.acedata.data.ObjectType == binrightguid: return True return False def ace_applies(ace_guid, object_class, objecttype_guid_map): ''' Checks if an ACE applies to this object (based on object classes). Note that this function assumes you already verified that InheritedObjectType is set (via the flag). If this is not set, the ACE applies to all object types. ''' if ace_guid == objecttype_guid_map[object_class]: return True # If none of these match, the ACE does not apply to this object return False def build_relation(sid, relation, acetype='', inherited=False): if acetype != '': raise ValueError("BH 4.0 incompatible output called") return {'rightname': relation, 'sid': sid, 'inherited': inherited} class AclEnumerator(object): """ Helper class for ACL parsing. """ def __init__(self, addomain, addc, collect): self.addomain = addomain self.addc = addc # Store collection methods specified self.collect = collect self.pool = None def init_pool(self): self.pool = Pool() """ The following is Security Descriptor parsing using cstruct Thanks to Erik Schamper for helping me implement this! """ cdef = """ struct SECURITY_DESCRIPTOR { uint8 Revision; uint8 Sbz1; uint16 Control; uint32 OffsetOwner; uint32 OffsetGroup; uint32 OffsetSacl; uint32 OffsetDacl; }; struct LDAP_SID_IDENTIFIER_AUTHORITY { char Value[6]; }; struct LDAP_SID { uint8 Revision; uint8 SubAuthorityCount; LDAP_SID_IDENTIFIER_AUTHORITY IdentifierAuthority; uint32 SubAuthority[SubAuthorityCount]; }; struct ACL { uint8 AclRevision; uint8 Sbz1; uint16 AclSize; uint16 AceCount; uint16 Sbz2; char Data[AclSize - 8]; }; struct ACE { uint8 AceType; uint8 AceFlags; uint16 AceSize; char Data[AceSize - 4]; }; struct ACCESS_ALLOWED_ACE { uint32 Mask; LDAP_SID Sid; }; struct ACCESS_ALLOWED_OBJECT_ACE { uint32 Mask; uint32 Flags; char ObjectType[Flags & 1 * 16]; char InheritedObjectType[Flags & 2 * 8]; LDAP_SID Sid; }; """ c_secd = cstruct() c_secd.load(cdef, compiled=True) class SecurityDescriptor(object): # Control indexes in bit field SR = 0 # Self-Relative RM = 1 # RM Control Valid PS = 2 # SACL Protected PD = 3 # DACL Protected SI = 4 # SACL Auto-Inherited DI = 5 # DACL Auto-Inherited SC = 6 # SACL Computed Inheritance Required DC = 7 # DACL Computed Inheritance Required SS = 8 # Server Security DT = 9 # DACL Trusted SD = 10 # SACL Defaulted SP = 11 # SACL Present DD = 12 # DACL Defaulted DP = 13 # DACL Present GD = 14 # Group Defaulted OD = 15 # Owner Defaulted def has_control(self, control): # Convert to bin representation and # look up index. Slice off 0b return bin(self.control)[2:][control] == '1' def __init__(self, fh): self.fh = fh self.descriptor = c_secd.SECURITY_DESCRIPTOR(fh) self.control = self.descriptor.Control self.owner_sid = b'' self.group_sid = b'' self.sacl = b'' self.dacl = b'' if self.descriptor.OffsetOwner != 0: fh.seek(self.descriptor.OffsetOwner) self.owner_sid = LdapSid(fh=fh) if self.descriptor.OffsetGroup != 0: fh.seek(self.descriptor.OffsetGroup) self.group_sid = LdapSid(fh=fh) if self.descriptor.OffsetSacl != 0: fh.seek(self.descriptor.OffsetSacl) self.sacl = ACL(fh) if self.descriptor.OffsetDacl != 0: fh.seek(self.descriptor.OffsetDacl) self.dacl = ACL(fh) class LdapSid(object): def __init__(self, fh=None, in_obj=None): if fh: self.fh = fh self.ldap_sid = c_secd.LDAP_SID(fh) else: self.ldap_sid = in_obj def __repr__(self): return "S-{}-{}-{}".format(self.ldap_sid.Revision, bytearray(self.ldap_sid.IdentifierAuthority.Value)[5], "-".join(['{:d}'.format(v) for v in self.ldap_sid.SubAuthority])) class ACL(object): def __init__(self, fh): self.fh = fh self.acl = c_secd.ACL(fh) self.aces = [] buf = BytesIO(self.acl.Data) for i in range(self.acl.AceCount): self.aces.append(ACE(buf)) class ACCESS_ALLOWED_ACE(object): def __init__(self, fh): self.fh = fh self.data = c_secd.ACCESS_ALLOWED_ACE(fh) self.sid = LdapSid(in_obj=self.data.Sid) self.mask = ACCESS_MASK(self.data.Mask) def __repr__(self): return "" % (str(self.sid), str(self.mask)) class ACCESS_DENIED_ACE(ACCESS_ALLOWED_ACE): pass class ACCESS_ALLOWED_OBJECT_ACE(object): # Flag constants ACE_OBJECT_TYPE_PRESENT = 0x01 ACE_INHERITED_OBJECT_TYPE_PRESENT = 0x02 def __init__(self, fh): self.fh = fh self.data = c_secd.ACCESS_ALLOWED_OBJECT_ACE(fh) self.sid = LdapSid(in_obj=self.data.Sid) self.mask = ACCESS_MASK(self.data.Mask) def has_flag(self, flag): return self.data.Flags & flag == flag def get_object_type(self): if self.has_flag(self.ACE_OBJECT_TYPE_PRESENT): return bin_to_string(self.data.ObjectType) return None def get_inherited_object_type(self): if self.has_flag(self.ACE_INHERITED_OBJECT_TYPE_PRESENT): return bin_to_string(self.data.InheritedObjectType) return None def __repr__(self): out = [] for name, value in vars(ACCESS_ALLOWED_OBJECT_ACE).items(): if not name.startswith('_') and type(value) is int and self.has_flag(value): out.append(name) data = (' | '.join(out), str(self.sid), str(self.mask), self.get_object_type(), self.get_inherited_object_type()) return "" % data class ACCESS_DENIED_OBJECT_ACE(ACCESS_ALLOWED_OBJECT_ACE): pass """ ACCESS_MASK as described in 2.4.3 https://msdn.microsoft.com/en-us/library/cc230294.aspx """ class ACCESS_MASK(object): # Flag constants # These constants are only used when WRITING # and are then translated into their actual rights SET_GENERIC_READ = 0x80000000 SET_GENERIC_WRITE = 0x04000000 SET_GENERIC_EXECUTE = 0x20000000 SET_GENERIC_ALL = 0x10000000 # When reading, these constants are actually represented by # the following for Active Directory specific Access Masks # Reference: https://docs.microsoft.com/en-us/dotnet/api/system.directoryservices.activedirectoryrights?view=netframework-4.7.2 GENERIC_READ = 0x00020094 GENERIC_WRITE = 0x00020028 GENERIC_EXECUTE = 0x00020004 GENERIC_ALL = 0x000F01FF # These are actual rights (for all ACE types) MAXIMUM_ALLOWED = 0x02000000 ACCESS_SYSTEM_SECURITY = 0x01000000 SYNCHRONIZE = 0x00100000 WRITE_OWNER = 0x00080000 WRITE_DACL = 0x00040000 READ_CONTROL = 0x00020000 DELETE = 0x00010000 # ACE type specific mask constants (for ACCESS_ALLOWED_OBJECT_ACE) # Note that while not documented, these also seem valid # for ACCESS_ALLOWED_ACE types ADS_RIGHT_DS_CONTROL_ACCESS = 0x00000100 ADS_RIGHT_DS_CREATE_CHILD = 0x00000001 ADS_RIGHT_DS_DELETE_CHILD = 0x00000002 ADS_RIGHT_DS_READ_PROP = 0x00000010 ADS_RIGHT_DS_WRITE_PROP = 0x00000020 ADS_RIGHT_DS_SELF = 0x00000008 def __init__(self, mask): self.mask = mask def has_priv(self, priv): return self.mask & priv == priv def set_priv(self, priv): self.mask |= priv def remove_priv(self, priv): self.mask ^= priv def __repr__(self): out = [] for name, value in vars(ACCESS_MASK).items(): if not name.startswith('_') and type(value) is int and self.has_priv(value): out.append(name) return "" % (self.mask, ' | '.join(out)) class ACE(object): CONTAINER_INHERIT_ACE = 0x02 FAILED_ACCESS_ACE_FLAG = 0x80 INHERIT_ONLY_ACE = 0x08 INHERITED_ACE = 0x10 NO_PROPAGATE_INHERIT_ACE = 0x04 OBJECT_INHERIT_ACE = 0x01 SUCCESSFUL_ACCESS_ACE_FLAG = 0x04 def __init__(self, fh): self.fh = fh self.ace = c_secd.ACE(fh) self.acedata = None buf = BytesIO(self.ace.Data) if self.ace.AceType == 0x00: # ACCESS_ALLOWED_ACE self.acedata = ACCESS_ALLOWED_ACE(buf) elif self.ace.AceType == 0x05: # ACCESS_ALLOWED_OBJECT_ACE self.acedata = ACCESS_ALLOWED_OBJECT_ACE(buf) elif self.ace.AceType == 0x01: # ACCESS_DENIED_ACE self.acedata = ACCESS_DENIED_ACE(buf) elif self.ace.AceType == 0x06: # ACCESS_DENIED_OBJECT_ACE self.acedata = ACCESS_DENIED_OBJECT_ACE(buf) # else: # print 'Unsupported type %d' % self.ace.AceType if self.acedata: self.mask = ACCESS_MASK(self.acedata.data.Mask) def __repr__(self): out = [] for name, value in vars(ACE).items(): if not name.startswith('_') and type(value) is int and self.has_flag(value): out.append(name) return "" % (self.ace.AceType, ' | '.join(out), self.ace.AceFlags, str(self.acedata)) def has_flag(self, flag): return self.ace.AceFlags & flag == flag ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832010.0 bloodhound-1.8.0/bloodhound/enumeration/computers.py0000664000175000017500000003362014735530712021526 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import queue import threading import logging import traceback import codecs from impacket.dcerpc.v5.rpcrt import DCERPCException from bloodhound.enumeration.outputworker import OutputWorker from bloodhound.enumeration.memberships import MembershipEnumerator from bloodhound.ad.computer import ADComputer from bloodhound.ad.utils import ADUtils class ComputerEnumerator(MembershipEnumerator): """ Class to enumerate computers in the domain. Contains the threading logic and workers which will call the collection methods from the bloodhound.ad module. This class extends the MembershipEnumerator class just to inherit the membership lookup functions which are also needed for computers. """ def __init__(self, addomain, addc, collect, do_gc_lookup=True, computerfile="", exclude_dcs=False): """ Computer enumeration. Enumerates all computers in the given domain. Every domain enumerated will get its own instance of this class. """ self.addomain = addomain self.addc = addc # blocklist and allowlist are only used for debugging purposes self.blocklist = [] self.allowlist = [] self.do_gc_lookup = do_gc_lookup # Store collection methods specified self.collect = collect self.exclude_dcs = exclude_dcs if computerfile: logging.info('Limiting enumeration to FQDNs in %s', computerfile) with codecs.open(computerfile, 'r', 'utf-8') as cfile: for line in cfile: self.allowlist.append(line.strip().lower()) def enumerate_computers(self, computers, num_workers=10, timestamp="", fileNamePrefix=""): """ Enumerates the computers in the domain. Is threaded, you can specify the number of workers. Will spawn threads to resolve computers and enumerate the information. """ process_queue = queue.Queue() result_q = queue.Queue() if (fileNamePrefix != None): results_worker = threading.Thread(target=OutputWorker.write_worker, args=(result_q, fileNamePrefix + '_' + timestamp + 'computers.json')) else: results_worker = threading.Thread(target=OutputWorker.write_worker, args=(result_q, timestamp + 'computers.json')) results_worker.daemon = True results_worker.start() logging.info('Starting computer enumeration with %d workers', num_workers) if len(computers) / num_workers > 500: logging.info('The workload seems to be rather large. Consider increasing the number of workers.') for _ in range(0, num_workers): thread = threading.Thread(target=self.work, args=(process_queue, result_q)) thread.daemon = True thread.start() for _, computer in computers.items(): if not 'attributes' in computer: continue # if 'dNSHostName' not in computer['attributes']: # continue hostname = ADUtils.get_entry_property(computer, 'dNSHostName') samname = computer['attributes']['sAMAccountName'] if not hostname: logging.debug('Invalid computer object without hostname: %s', samname) hostname = '' # Check if filtering if hostname in self.blocklist: logging.info('Skipping computer: %s (blocklisted)', hostname) continue if len(self.allowlist) > 0 and hostname.lower() not in self.allowlist: logging.debug('Skipping computer: %s (not allowlisted)', hostname) continue process_queue.put((hostname, samname, computer)) process_queue.join() result_q.put(None) result_q.join() def process_computer(self, hostname, samname, objectsid, entry, results_q): """ Processes a single computer, pushes the results of the computer to the given queue. """ logging.debug('Querying computer: %s', hostname) c = ADComputer(hostname=hostname, samname=samname, ad=self.addomain, addc=self.addc, objectsid=objectsid) c.primarygroup = self.get_primary_membership(entry) if hostname and (not self.exclude_dcs or not ADUtils.is_dc(entry)) and c.try_connect(): try: if 'session' in self.collect: sessions = c.rpc_get_sessions() else: sessions = [] if 'localadmin' in self.collect: unresolved = c.rpc_get_group_members(544, c.admins) c.rpc_resolve_sids(unresolved, c.admins) if 'rdp' in self.collect: unresolved = c.rpc_get_group_members(555, c.rdp) c.rpc_resolve_sids(unresolved, c.rdp) if 'dcom' in self.collect: unresolved = c.rpc_get_group_members(562, c.dcom) c.rpc_resolve_sids(unresolved, c.dcom) if 'psremote' in self.collect: unresolved = c.rpc_get_group_members(580, c.psremote) c.rpc_resolve_sids(unresolved, c.psremote) if 'loggedon' in self.collect: loggedon = c.rpc_get_loggedon() registry_sessions = c.rpc_get_registry_sessions() else: loggedon = [] registry_sessions = [] if 'experimental' in self.collect: services = c.rpc_get_services() tasks = c.rpc_get_schtasks() else: services = [] tasks = [] c.rpc_close() # c.rpc_get_domain_trusts() if sessions is None: sessions = [] # Should we use the GC? use_gc = self.addomain.num_domains > 1 and self.do_gc_lookup # Process found sessions for ses in sessions: # For every session, resolve the SAM name in the GC if needed domain = self.addomain.domain try: users = self.addomain.samcache.get(ses['user']) except KeyError: # Look up the SAM name in the GC entries = self.addomain.objectresolver.resolve_samname(ses['user'], use_gc=use_gc) if entries is not None: users = [user['attributes']['objectSid'] for user in entries] if entries is None or users == []: logging.warning('Failed to resolve SAM name %s in current forest', ses['user']) continue self.addomain.samcache.put(ses['user'], users) # Resolve the IP to obtain the host the session is from try: target = self.addomain.dnscache.get(ses['source']) except KeyError: target = ADUtils.ip2host(ses['source'], self.addomain.dnsresolver, self.addomain.dns_tcp) # not resolved using dns - resolve using SMB/RPC NTLM if target == ses['source']: target = ADUtils.get_ntlm_hostname(ses['source']) # if target == ses['source']: # not resolved yet! # target = ADUtils.rpc_get_hostname(ses['source'], self.addomain.auth) # Even if the result is the IP (aka could not resolve PTR) we still cache # it since this result is unlikely to change during this run self.addomain.dnscache.put_single(ses['source'], target) if ':' in target: # IPv6 address, not very useful continue if '.' not in target: logging.debug('Resolved target does not look like an IP or domain. Assuming hostname: %s', target) target = '%s.%s' % (target, domain) # Resolve target hostname try: hostsid = self.addomain.computersidcache.get(target.lower()) except KeyError: logging.warning('Could not resolve hostname to SID: %s', target) continue # Put the result on the results queue. for user in users: c.sessions.append({'ComputerSID':hostsid, 'UserSID':user}) if loggedon is None: loggedon = [] # Put the logged on users on the queue too for user, userdomain in loggedon: # Construct fake UPN to cache this user fupn = '%s@%s' % (user.upper(), userdomain.upper()) try: users = self.addomain.samcache.get(fupn) except KeyError: entries = self.addomain.objectresolver.resolve_samname(user, use_gc=use_gc) if entries is not None: if len(entries) > 1: for resolved_user in entries: edn = ADUtils.get_entry_property(resolved_user, 'distinguishedName') edom = ADUtils.ldap2domain(edn).lower() if edom == userdomain.lower(): users = [resolved_user['attributes']['objectSid']] break logging.debug('Skipping resolved user %s since domain does not match (%s != %s)', edn, edom, userdomain.lower()) else: users = [resolved_user['attributes']['objectSid'] for resolved_user in entries] if entries is None or users == []: logging.warning('Failed to resolve SAM name %s in current forest', samname) continue self.addomain.samcache.put(fupn, users) for resultuser in users: c.loggedon.append({'ComputerSID':objectsid, 'UserSID':resultuser}) if registry_sessions is None: registry_sessions = [] # Process found registry sessions for ses in registry_sessions: c.registry_sessions.append({'ComputerSID':objectsid, 'UserSID':ses['user']}) # Process Tasks for taskuser in tasks: c.loggedon.append({'ComputerSID':objectsid, 'UserSID':taskuser}) # Process Services for serviceuser in services: try: user = self.addomain.sidcache.get(serviceuser) except KeyError: # Resolve UPN in GC userentry = self.addomain.objectresolver.resolve_upn(serviceuser) # Resolve it to an entry and store in the cache self.addomain.sidcache.put(serviceuser, userentry['attributes']['objectSid']) user = userentry['attributes']['objectSid'] logging.debug('Resolved Service UPN to SID: %s', user) c.loggedon.append({'ComputerSID':objectsid, 'UserSID':user}) results_q.put(('computer', c.get_bloodhound_data(entry, self.collect))) except DCERPCException: logging.debug(traceback.format_exc()) logging.warning('Querying computer failed: %s', hostname) except Exception as e: logging.error('Unhandled exception in computer %s processing: %s', hostname, str(e)) logging.info(traceback.format_exc()) else: c.permanentfailure = True # Write the info we have to the file regardless try: results_q.put(('computer', c.get_bloodhound_data(entry, self.collect))) except Exception as e: logging.error('Unhandled exception in computer %s processing: %s', hostname, str(e)) logging.info(traceback.format_exc()) def work(self, process_queue, results_q): """ Work function, will obtain work from the given queue and will push results on the results_q. """ logging.debug('Start working') while True: hostname, samname, entry = process_queue.get() objectsid = entry['attributes']['objectSid'] logging.info('Querying computer: %s', hostname) self.process_computer(hostname, samname, objectsid, entry, results_q) process_queue.task_done() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832038.0 bloodhound-1.8.0/bloodhound/enumeration/domains.py0000664000175000017500000001621514735530746021147 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import codecs import json import calendar from bloodhound.ad.utils import ADUtils, AceResolver from bloodhound.ad.trusts import ADDomainTrust from bloodhound.enumeration.acls import parse_binary_acl class DomainEnumerator(object): """ Class to enumerate trusts in the domain. Contains the dumping functions which methods from the bloodhound.ad module. """ def __init__(self, addomain, addc): """ Trusts enumeration. Enumerates all trusts between the source domain and other domains/forests. """ self.addomain = addomain self.addc = addc def dump_domain(self, collect, timestamp="", filename='domains.json', fileNamePrefix=""): if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + filename else: filename = timestamp + filename """ Dump trusts. This is currently the only domain info we support, so this function handles the entire domain dumping. """ if 'trusts' in collect: entries = self.addc.get_trusts() else: entries = [] try: logging.debug('Opening file for writing: %s' % filename) out = codecs.open(filename, 'w', 'utf-8') except: logging.warning('Could not write file: %s' % filename) return # If the logging level is DEBUG, we ident the objects if logging.getLogger().getEffectiveLevel() == logging.DEBUG: indent_level = 1 else: indent_level = None # Todo: fix this properly. Current code is quick fix to work with domains # that have custom casing in their DN domain_object = None for domain in self.addomain.domains.keys(): if domain.lower() == self.addomain.baseDN.lower(): domain_object = self.addomain.domains[domain] break if not domain_object: logging.error('Could not find domain object. Aborting domain enumeration') return # Initialize json structure datastruct = { "data": [], "meta": { "type": "domains", "count": 0, "version":5 } } # Get functional level level_id = ADUtils.get_entry_property(domain_object, 'msds-behavior-version') try: functional_level = ADUtils.FUNCTIONAL_LEVELS[int(level_id)] except KeyError: functional_level = 'Unknown' whencreated = ADUtils.get_entry_property(domain_object, 'whencreated', default=0) if not isinstance(whencreated, int): whencreated = calendar.timegm(whencreated.timetuple()) domain = { "ObjectIdentifier": domain_object['attributes']['objectSid'], "Properties": { "name": self.addomain.domain.upper(), "domain": self.addomain.domain.upper(), "domainsid": ADUtils.get_entry_property(domain_object, 'objectSid'), "distinguishedname": ADUtils.get_entry_property(domain_object, 'distinguishedName').upper(), "description": ADUtils.get_entry_property(domain_object, 'description', ''), "functionallevel": functional_level, "highvalue": True, 'whencreated': whencreated }, "Trusts": [], "Aces": [], # The below is all for GPO collection, unsupported as of now. "Links": [], "ChildObjects": [], "GPOChanges": { "AffectedComputers": [], "DcomUsers": [], "LocalAdmins": [], "PSRemoteUsers": [], "RemoteDesktopUsers": [] }, "IsDeleted": False, } if 'container' in collect: for childentry in self.addc.get_childobjects(ADUtils.get_entry_property(domain_object, 'distinguishedName')): if ADUtils.is_filtered_container_child(ADUtils.get_entry_property(childentry, 'distinguishedName')): continue resolved_childentry = ADUtils.resolve_ad_entry(childentry) out_object = { "ObjectIdentifier": resolved_childentry['objectid'], "ObjectType": resolved_childentry['type'], } domain["ChildObjects"].append(out_object) if 'acl' in collect: resolver = AceResolver(self.addomain, self.addomain.objectresolver) _, aces = parse_binary_acl(domain, 'domain', ADUtils.get_entry_property(domain_object, 'nTSecurityDescriptor'), self.addc.objecttype_guid_map) domain['Aces'] = resolver.resolve_aces(aces) if 'trusts' in collect: num_entries = 0 for entry in entries: num_entries += 1 trust = ADDomainTrust(ADUtils.get_entry_property(entry, 'name'), ADUtils.get_entry_property(entry, 'trustDirection'), ADUtils.get_entry_property(entry, 'trustType'), ADUtils.get_entry_property(entry, 'trustAttributes'), ADUtils.get_entry_property(entry, 'securityIdentifier')) domain['Trusts'].append(trust.to_output()) logging.info('Found %u trusts', num_entries) if 'container' in collect: for gplink_dn, options in ADUtils.parse_gplink_string(ADUtils.get_entry_property(domain_object, 'gPLink', '')): link = dict() link['IsEnforced'] = options == 2 try: link['GUID'] = self.addomain.get_dn_from_cache_or_ldap(gplink_dn.upper())['ObjectIdentifier'] domain['Links'].append(link) except TypeError: logging.warning('Could not resolve GPO link to {0}'.format(gplink_dn)) # Single domain only datastruct['meta']['count'] = 1 datastruct['data'].append(domain) json.dump(datastruct, out, indent=indent_level) logging.debug('Finished writing domain info') out.close() ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832038.0 bloodhound-1.8.0/bloodhound/enumeration/memberships.py0000664000175000017500000012072214735530746022032 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import queue import threading import calendar from bloodhound.ad.utils import ADUtils, AceResolver from bloodhound.ad.computer import ADComputer from bloodhound.ad.structures import LDAP_SID from bloodhound.enumeration.acls import AclEnumerator, parse_binary_acl from bloodhound.enumeration.outputworker import OutputWorker class MembershipEnumerator(object): """ Class to enumerate memberships in the domain. Contains the dumping functions which methods from the bloodhound.ad module. """ def __init__(self, addomain, addc, collect, disable_pooling): """ Membership enumeration. Enumerates all groups/users/other memberships. """ self.addomain = addomain self.addc = addc # Store collection methods specified self.collect = collect self.disable_pooling = disable_pooling self.aclenumerator = AclEnumerator(addomain, addc, collect) self.aceresolver = AceResolver(addomain, addomain.objectresolver) self.result_q = None def get_membership(self, member): """ Attempt to resolve the membership (DN) of a group to an object Moved to addomain logic since we need DN resolving in other files """ return self.addomain.get_dn_from_cache_or_ldap(member) @staticmethod def get_primary_membership(entry): """ Construct primary membership from RID to SID (BloodHound 3.0 only) """ try: primarygroupid = int(entry['attributes']['primaryGroupID']) except (TypeError, KeyError): # Doesn't have a primarygroupid, means it is probably a Group instead of a user return None return '%s-%d' % ('-'.join(entry['attributes']['objectSid'].split('-')[:-1]), primarygroupid) @staticmethod def add_user_properties(user, entry): """ Resolve properties for user objects """ props = user['Properties'] # print entry # Is user enabled? Checked by seeing if the UAC flag 2 (ACCOUNT_DISABLED) is not set props['enabled'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 2 == 0 props['lastlogon'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'lastLogon', default=0, raw=True) ) props['lastlogontimestamp'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'lastlogontimestamp', default=0, raw=True) ) if props['lastlogontimestamp'] == 0: props['lastlogontimestamp'] = -1 props['pwdlastset'] = ADUtils.win_timestamp_to_unix( ADUtils.get_entry_property(entry, 'pwdLastSet', default=0, raw=True) ) props['dontreqpreauth'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00400000 == 0x00400000 props['pwdneverexpires'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00010000 == 0x00010000 props['sensitive'] = ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00100000 == 0x00100000 props['serviceprincipalnames'] = ADUtils.get_entry_property(entry, 'servicePrincipalName', []) props['hasspn'] = len(props['serviceprincipalnames']) > 0 props['displayname'] = ADUtils.get_entry_property(entry, 'displayName') props['email'] = ADUtils.get_entry_property(entry, 'mail') props['title'] = ADUtils.get_entry_property(entry, 'title') props['homedirectory'] = ADUtils.get_entry_property(entry, 'homeDirectory') props['description'] = ADUtils.get_entry_property(entry, 'description') props['userpassword'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'userPassword')) props['admincount'] = ADUtils.get_entry_property(entry, 'adminCount', 0) == 1 if len(ADUtils.get_entry_property(entry, 'msDS-AllowedToDelegateTo', [])) > 0: props['allowedtodelegate'] = ADUtils.get_entry_property(entry, 'msDS-AllowedToDelegateTo', []) props['sidhistory'] = [LDAP_SID(bsid).formatCanonical() for bsid in ADUtils.get_entry_property(entry, 'sIDHistory', [])] # v4 props whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) if isinstance(whencreated, int): props['whencreated'] = whencreated else: props['whencreated'] = calendar.timegm(whencreated.timetuple()) props['unixpassword'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'unixuserpassword')) props['unicodepassword'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'unicodepwd')) props['logonscript'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'scriptpath')) props['samaccountname'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'sAMAccountName')) # Non-default schema? # props['sfupassword'] = ADUtils.ensure_string(ADUtils.get_entry_property(entry, 'msSFU30Password')) props['sfupassword'] = None def enumerate_users(self, timestamp="", fileNamePrefix=""): if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'users.json' else: filename = timestamp + 'users.json' # Should we include extra properties in the query? with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect entries = self.addc.get_users(include_properties=with_properties, acl=acl) logging.debug('Writing users to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'users', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() # This loops over a generator, results are fetched from LDAP on the go for entry in entries: resolved_entry = ADUtils.resolve_ad_entry(entry) # Skip trust objects if resolved_entry['type'] == 'trustaccount': continue user = { "AllowedToDelegate": [], "ObjectIdentifier": ADUtils.get_entry_property(entry, 'objectSid'), "PrimaryGroupSID": MembershipEnumerator.get_primary_membership(entry), "Properties": { "name": resolved_entry['principal'], "domain": self.addomain.domain.upper(), "domainsid": self.addomain.domain_object.sid, "distinguishedname":ADUtils.get_entry_property(entry, 'distinguishedName').upper(), "unconstraineddelegation": ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00080000 == 0x00080000, "trustedtoauth": ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x01000000 == 0x01000000, "passwordnotreqd": ADUtils.get_entry_property(entry, 'userAccountControl', default=0) & 0x00000020 == 0x00000020 }, "Aces": [], "SPNTargets": [], "HasSIDHistory": [], "IsDeleted": ADUtils.get_entry_property(entry, 'isDeleted', default=False) } if with_properties: MembershipEnumerator.add_user_properties(user, entry) if 'allowedtodelegate' in user['Properties']: delegatehosts_cache = [] for host in user['Properties']['allowedtodelegate']: try: target = host.split('/')[1] except IndexError: logging.warning('Invalid delegation target: %s', host) continue try: object_sid = self.addomain.computersidcache.get(target.lower()) user['AllowedToDelegate'].append({ 'ObjectIdentifier': object_sid, 'ObjectType': ADUtils.resolve_ad_entry( self.addomain.objectresolver.resolve_sid(object_sid) )['type'], }) except KeyError: object_sam = target.upper().split(".")[0].split("\\")[0] if object_sam in delegatehosts_cache: continue delegatehosts_cache.append(object_sam) object_entry = self.addomain.objectresolver.resolve_samname(object_sam + '*', allow_filter=True) if object_entry: object_resolved = ADUtils.resolve_ad_entry(object_entry[0]) user['AllowedToDelegate'].append({ 'ObjectIdentifier': object_resolved['objectid'], 'ObjectType': object_resolved['type'], }) # Parse SID history if len(user['Properties']['sidhistory']) > 0: for historysid in user['Properties']['sidhistory']: user['HasSIDHistory'].append(self.aceresolver.resolve_sid(historysid)) # If this is a GMSA, process it's ACL. We don't bother with threads/processes here # since these accounts shouldn't be that common and neither should they have very complex # DACLs which control who can read their password if ADUtils.get_entry_property(entry, 'msDS-GroupMSAMembership', default=b'', raw=True) != b'': self.parse_gmsa(user, entry) # Cache link entry for membership resolution linkentry = { "ObjectIdentifier": resolved_entry['objectid'], "ObjectType": resolved_entry['type'].capitalize() } self.addomain.dncache[entry['dn'].upper()] = linkentry # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(user, 'user', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(user, 'user', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(user) self.write_default_users() # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing users') def enumerate_groups(self, timestamp="", fileNamePrefix=""): highvalue = ["S-1-5-32-544", "S-1-5-32-550", "S-1-5-32-549", "S-1-5-32-551", "S-1-5-32-548"] def is_highvalue(sid): if sid.endswith("-512") or sid.endswith("-516") or sid.endswith("-519"): return True if sid in highvalue: return True return False # Should we include extra properties in the query? with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'groups.json' else: filename = timestamp + 'groups.json' entries = self.addc.get_groups(include_properties=with_properties, acl=acl) logging.debug('Writing groups to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'groups', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() for entry in entries: resolved_entry = ADUtils.resolve_ad_entry(entry) try: sid = entry['attributes']['objectSid'] except KeyError: #Somehow we found a group without a sid? logging.warning('Could not determine SID for group %s', entry['attributes']['distinguishedName']) continue group = { "ObjectIdentifier": sid, "Properties": { "domain": self.addomain.domain.upper(), "domainsid": self.addomain.domain_object.sid, "highvalue": is_highvalue(sid), "name": resolved_entry['principal'], "distinguishedname": ADUtils.get_entry_property(entry, 'distinguishedName').upper() }, "Members": [], "Aces": [], "IsDeleted": ADUtils.get_entry_property(entry, 'isDeleted', default=False) } if sid in ADUtils.WELLKNOWN_SIDS: # Prefix it with the domain group['ObjectIdentifier'] = '%s-%s' % (self.addomain.domain.upper(), sid) if with_properties: group['Properties']['admincount'] = ADUtils.get_entry_property(entry, 'adminCount', default=0) == 1 group['Properties']['description'] = ADUtils.get_entry_property(entry, 'description') group['Properties']['samaccountname'] = ADUtils.get_entry_property(entry, 'sAMAccountName') whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) if isinstance(whencreated, int): group['Properties']['whencreated'] = whencreated else: group['Properties']['whencreated'] = calendar.timegm(whencreated.timetuple()) for member in entry['attributes']['member']: resolved_member = self.get_membership(member) if resolved_member: group['Members'].append(resolved_member) # Create cache entry for links link_output = { "ObjectIdentifier": group['ObjectIdentifier'], "ObjectType": 'Group' } self.addomain.dncache[ADUtils.get_entry_property(entry, 'distinguishedName').upper()] = link_output # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(group, 'group', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(group, 'group', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(group) self.write_default_groups() # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing groups') def enumerate_computers_dconly(self,timestamp ="", fileNamePrefix=""): ''' Enumerate computer objects. This function is only used if no collection was requested that required connecting to computers anyway. ''' if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'computers.json' else: filename = timestamp + 'computers.json' # Should we include extra properties in the query? with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect entries = self.addc.get_computers(include_properties=with_properties, acl=acl) logging.debug('Writing computers ACL to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'computers', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() # This loops over the cached entries for entry in entries: if not 'attributes' in entry: continue hostname = ADUtils.get_entry_property(entry, 'dNSHostName') samname = ADUtils.get_entry_property(entry, 'sAMAccountName') if not hostname: logging.debug('Invalid computer object without hostname: %s', samname) hostname = '' cobject = ADComputer(hostname=hostname, samname=samname, ad=self.addomain, addc=self.addc, objectsid=entry['attributes']['objectSid']) cobject.primarygroup = MembershipEnumerator.get_primary_membership(entry) computer = cobject.get_bloodhound_data(entry, self.collect, skip_acl=True) # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(computer, 'computer', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(computer, 'computer', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(computer) # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing computers') def enumerate_gpos(self, timestamp ="", fileNamePrefix=""): if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'gpos.json' else: filename = timestamp + 'gpos.json' with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect entries = self.addc.get_gpos(include_properties=with_properties, acl=acl) logging.debug('Writing GPOs to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'gpos', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() for entry in entries: resolved_entry = ADUtils.resolve_ad_entry(entry) try: guid = entry['attributes']['objectGUID'][1:-1].upper() except KeyError: #Somehow we found an OU without a guid? logging.warning('Could not determine GUID for GPO %s', entry['attributes']['distinguishedName']) continue gpo = { "ObjectIdentifier": guid, "Properties": { "domain": self.addomain.domain.upper(), "name": '%s@%s' % (ADUtils.get_entry_property(entry, 'displayName', '').upper(), self.addomain.domain.upper()), "distinguishedname": ADUtils.get_entry_property(entry, 'distinguishedName', '').upper(), "domainsid": self.addomain.domain_object.sid, "highvalue": False, "gpcpath": ADUtils.get_entry_property(entry, 'gPCFileSysPath', '').upper(), }, "IsDeleted": False, "IsACLProtected": False, "Aces": [], } if with_properties: gpo["Properties"]["description"] = ADUtils.get_entry_property(entry, 'description', '') whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) if isinstance(whencreated, int): gpo['Properties']['whencreated'] = whencreated else: gpo['Properties']['whencreated'] = calendar.timegm(whencreated.timetuple()) # Create cache entry for links link_output = { "ObjectIdentifier": gpo['ObjectIdentifier'], "ObjectType": "GPO", } self.addomain.dncache[ADUtils.get_entry_property(entry, 'distinguishedName').upper()] = link_output # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(gpo, 'gpo', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(gpo, 'gpo', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(gpo) # self.write_default_groups() # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing GPO') def enumerate_ous(self, timestamp ="", fileNamePrefix=""): if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'ous.json' else: filename = timestamp + 'ous.json' with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect entries = self.addc.get_ous(include_properties=with_properties, acl=acl) logging.debug('Writing OU to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'ous', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() for entry in entries: resolved_entry = ADUtils.resolve_ad_entry(entry) try: guid = entry['attributes']['objectGUID'][1:-1].upper() except KeyError: #Somehow we found an OU without a guid? logging.warning('Could not determine GUID for OU %s', entry['attributes']['distinguishedName']) continue ou = { "ObjectIdentifier": guid, "Properties": { "domain": self.addomain.domain.upper(), "name": '%s@%s' % (ADUtils.get_entry_property(entry, 'name').upper(), self.addomain.domain.upper()), "distinguishedname": ADUtils.get_entry_property(entry, 'distinguishedName').upper(), "domainsid": self.addomain.domain_object.sid, "highvalue": False, # Ref: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-gpol/08090b22-bc16-49f4-8e10-f27a8fb16d18 "blocksinheritance": ADUtils.get_entry_property(entry, 'gPOptions', 0) == 1, }, "IsDeleted": False, "IsACLProtected": False, "Aces": [], "Links": [], "ChildObjects": [], "GPOChanges": { "AffectedComputers": [], "DcomUsers": [], "LocalAdmins": [], "PSRemoteUsers": [], "RemoteDesktopUsers": [] }, } if with_properties: ou["Properties"]["description"] = ADUtils.get_entry_property(entry, 'description') whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) if isinstance(whencreated, int): ou['Properties']['whencreated'] = whencreated else: ou['Properties']['whencreated'] = calendar.timegm(whencreated.timetuple()) for childentry in self.addc.get_childobjects(ou["Properties"]["distinguishedname"]): resolved_childentry = ADUtils.resolve_ad_entry(childentry) out_object = { "ObjectIdentifier":resolved_childentry['objectid'], "ObjectType":resolved_childentry['type'] } ou["ChildObjects"].append(out_object) for gplink_dn, options in ADUtils.parse_gplink_string(ADUtils.get_entry_property(entry, 'gPLink', '')): link = dict() link['IsEnforced'] = options == 2 try: link['GUID'] = self.get_membership(gplink_dn.upper())['ObjectIdentifier'] ou['Links'].append(link) except TypeError: logging.warning('Could not resolve GPO link to {0}'.format(gplink_dn)) # Create cache entry for links link_output = { "ObjectIdentifier": ou['ObjectIdentifier'], "ObjectType": 'OU' } self.addomain.dncache[ADUtils.get_entry_property(entry, 'distinguishedName').upper()] = link_output # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(ou, 'organizational-unit', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(ou, 'organizational-unit', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(ou) # self.write_default_groups() # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing OU') def enumerate_containers(self, timestamp ="", fileNamePrefix=""): if (fileNamePrefix != None): filename = fileNamePrefix + "_" + timestamp + 'containers.json' else: filename = timestamp + 'containers.json' with_properties = 'objectprops' in self.collect acl = 'acl' in self.collect entries = self.addc.get_containers(include_properties=with_properties, acl=acl) logging.debug('Writing containers to file: %s', filename) # Use a separate queue for processing the results self.result_q = queue.Queue() results_worker = threading.Thread(target=OutputWorker.membership_write_worker, args=(self.result_q, 'containers', filename)) results_worker.daemon = True results_worker.start() if acl and not self.disable_pooling: self.aclenumerator.init_pool() for entry in entries: if ADUtils.is_filtered_container(ADUtils.get_entry_property(entry, 'distinguishedName')): continue resolved_entry = ADUtils.resolve_ad_entry(entry) try: guid = entry['attributes']['objectGUID'][1:-1].upper() except KeyError: #Somehow we found an container without a guid? logging.warning('Could not determine GUID for container %s', entry['attributes']['distinguishedName']) continue container = { "ObjectIdentifier": guid, "Properties": { "domain": self.addomain.domain.upper(), "name": '%s@%s' % (ADUtils.get_entry_property(entry, 'name').upper(), self.addomain.domain.upper()), "distinguishedname": ADUtils.get_entry_property(entry, 'distinguishedName').upper(), "domainsid": self.addomain.domain_object.sid, "highvalue": False, }, "IsDeleted": False, "IsACLProtected": False, "Aces": [], "ChildObjects": [], } if with_properties: container["Properties"]["description"] = ADUtils.get_entry_property(entry, 'description', '') whencreated = ADUtils.get_entry_property(entry, 'whencreated', default=0) container["Properties"]["whencreated"] = calendar.timegm(whencreated.timetuple()) for childentry in self.addc.get_childobjects(container["Properties"]["distinguishedname"]): if ADUtils.is_filtered_container_child(ADUtils.get_entry_property(childentry, 'distinguishedName')): continue resolved_childentry = ADUtils.resolve_ad_entry(childentry) object = { "ObjectIdentifier":resolved_childentry['objectid'], "ObjectType":resolved_childentry['type'] } container["ChildObjects"].append(object) # Create cache entry for links link_output = { "ObjectIdentifier": container['ObjectIdentifier'], "ObjectType": 'container' } self.addomain.dncache[ADUtils.get_entry_property(entry, 'distinguishedName').upper()] = link_output # If we are enumerating ACLs, we break out of the loop here # this is because parsing ACLs is computationally heavy and therefor is done in subprocesses if acl: if self.disable_pooling: # Debug mode, don't run this pooled since it hides exceptions self.process_acldata(parse_binary_acl(container, 'container', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map)) else: # Process ACLs in separate processes, then call the processing function to resolve entries and write them to file self.aclenumerator.pool.apply_async(parse_binary_acl, args=(container, 'container', ADUtils.get_entry_property(entry, 'nTSecurityDescriptor', raw=True), self.addc.objecttype_guid_map), callback=self.process_acldata) else: # Write it to the queue -> write to file in separate thread # this is solely for consistency with acl parsing, the performance improvement is probably minimal self.result_q.put(container) # If we are parsing ACLs, close the parsing pool first # then close the result queue and join it if acl and not self.disable_pooling: self.aclenumerator.pool.close() self.aclenumerator.pool.join() self.result_q.put(None) else: self.result_q.put(None) self.result_q.join() logging.debug('Finished writing containers') def parse_gmsa(self, user, entry): """ Parse GMSA DACL which states which users can read the password """ _, aces = parse_binary_acl(user, 'user', ADUtils.get_entry_property(entry, 'msDS-GroupMSAMembership', raw=True), self.addc.objecttype_guid_map) processed_aces = self.aceresolver.resolve_aces(aces) for ace in processed_aces: if ace['RightName'] == 'Owner': continue ace['RightName'] = 'ReadGMSAPassword' user['Aces'].append(ace) def process_acldata(self, result): """ Process ACLs that resulted from parsing with cstruct """ data, aces = result # Parse aces data['Aces'] += self.aceresolver.resolve_aces(aces) self.result_q.put(data) def write_default_users(self): """ Write built-in users to users.json file """ domainsid = self.addomain.domain_object.sid domainname = self.addomain.domain.upper() user = { "AllowedToDelegate": [], "ObjectIdentifier": "%s-S-1-5-20" % domainname, "PrimaryGroupSID": None, "Properties": { "domain": domainname, "domainsid": self.addomain.domain_object.sid, "name": "NT AUTHORITY@%s" % domainname, }, "Aces": [], "SPNTargets": [], "HasSIDHistory": [], "IsDeleted": False, "IsACLProtected": False, } self.result_q.put(user) def write_default_groups(self): """ Put default groups in the groups.json file """ # Domain controllers rootdomain = self.addc.get_root_domain().upper() entries = self.addc.get_domain_controllers() group = { "IsDeleted": False, "IsACLProtected": False, "ObjectIdentifier": "%s-S-1-5-9" % rootdomain, "Properties": { "domain": rootdomain.upper(), "name": "ENTERPRISE DOMAIN CONTROLLERS@%s" % rootdomain, }, "Members": [], "Aces": [] } for entry in entries: resolved_entry = ADUtils.resolve_ad_entry(entry) memberdata = { "ObjectIdentifier": resolved_entry['objectid'], "ObjectType": resolved_entry['type'].capitalize() } group["Members"].append(memberdata) self.result_q.put(group) domainsid = self.addomain.domain_object.sid domainname = self.addomain.domain.upper() # Everyone evgroup = { "IsDeleted": False, "IsACLProtected": False, "ObjectIdentifier": "%s-S-1-1-0" % domainname, "Properties": { "domain": domainname, "domainsid": self.addomain.domain_object.sid, "name": "EVERYONE@%s" % domainname, }, "Members": [], "Aces": [] } self.result_q.put(evgroup) # Authenticated users augroup = { "IsDeleted": False, "IsACLProtected": False, "ObjectIdentifier": "%s-S-1-5-11" % domainname, "Properties": { "domain": domainname, "domainsid": self.addomain.domain_object.sid, "name": "AUTHENTICATED USERS@%s" % domainname, }, "Members": [], "Aces": [] } self.result_q.put(augroup) # Interactive iugroup = { "IsDeleted": False, "IsACLProtected": False, "ObjectIdentifier": "%s-S-1-5-4" % domainname, "Properties": { "domain": domainname, "domainsid": self.addomain.domain_object.sid, "name": "INTERACTIVE@%s" % domainname, }, "Members": [], "Aces": [] } self.result_q.put(iugroup) def do_container_collection(self, timestamp="", fileNamePrefix=""): self.enumerate_gpos(timestamp, fileNamePrefix) self.enumerate_ous(timestamp, fileNamePrefix) self.enumerate_containers(timestamp, fileNamePrefix) def enumerate_memberships(self, timestamp="", fileNamePrefix=""): """ Run appropriate enumeration tasks """ self.enumerate_users(timestamp, fileNamePrefix) self.enumerate_groups(timestamp, fileNamePrefix) if 'container' in self.collect: self.do_container_collection(timestamp, fileNamePrefix) if not ('localadmin' in self.collect or 'session' in self.collect or 'loggedon' in self.collect or 'experimental' in self.collect): self.enumerate_computers_dconly(timestamp, fileNamePrefix) ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1701167431.0 bloodhound-1.8.0/bloodhound/enumeration/objectresolver.py0000664000175000017500000001531114531340507022525 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import threading from ldap3.utils.conv import escape_filter_chars class ObjectResolver(object): """ This class is responsible for resolving objects. This can be for example sAMAccountNames which should be resolved in the GC to see which domain they belong to, or SIDs which have to be resolved somewhere else. This resolver is thread-safe. """ def __init__(self, addomain, addc): self.addomain = addomain self.addc = addc self.lock = threading.Lock() def resolve_distinguishedname(self, distinguishedname, use_gc=True): """ Resolve a DistinguishedName in LDAP. This will use the GC by default Returns a single LDAP entry """ with self.lock: if use_gc and not self.addc.gcldap: if not self.addc.gc_connect(): # Error connecting, bail return None if not use_gc and not self.addc.resolverldap: if not self.addc.ldap_connect(resolver=True): # Error connecting, bail return None if use_gc: logging.debug('Querying GC for DN %s', distinguishedname) else: logging.debug('Querying resolver LDAP for DN %s', distinguishedname) distinguishedname = self.addc.ldap_get_single(distinguishedname, use_gc=use_gc, use_resolver=True, attributes=['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'objectSid', 'name']) return distinguishedname def resolve_samname(self, samname, use_gc=True, allow_filter=False): """ Resolve a SAM name in the GC. This can give multiple results. Returns a list of LDAP entries """ out = [] if not allow_filter: safename = escape_filter_chars(samname) else: safename = samname with self.lock: if use_gc: if not self.addc.gcldap: if not self.addc.gc_connect(): # Error connecting, bail return None logging.debug('Querying GC for SAM Name %s', samname) else: logging.debug('Querying LDAP for SAM Name %s', samname) entries = self.addc.search(search_base="", search_filter='(sAMAccountName=%s)' % safename, use_gc=use_gc, attributes=['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'objectSid', 'name']) # This uses a generator, however we return a list for entry in entries: out.append(entry) return out def resolve_upn(self, upn): """ Resolve a UserPrincipalName in the GC. Returns a single LDAP entry """ safename = escape_filter_chars(upn) with self.lock: if not self.addc.gcldap: if not self.addc.gc_connect(): # Error connecting, bail return None logging.debug('Querying GC for UPN %s', upn) entries = self.addc.search(search_base="", search_filter='(&(objectClass=user)(userPrincipalName=%s))' % safename, use_gc=True, attributes=['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'objectSid', 'name']) for entry in entries: # By definition this can be only one entry return entry def resolve_sid(self, sid, use_gc=True): """ Resolve a SID in LDAP. This will use the GC by default Returns a single LDAP entry """ with self.lock: if use_gc and not self.addc.gcldap: if not self.addc.gc_connect(): # Error connecting, bail return None if not use_gc and not self.addc.resolverldap: if not self.addc.ldap_connect(resolver=True): # Error connecting, bail return None if use_gc: base = "" logging.debug('Querying GC for SID %s', sid) else: logging.debug('Querying resolver LDAP for SID %s', sid) base = None entries = self.addc.search(search_base=base, search_filter='(objectSid=%s)' % sid, use_gc=use_gc, use_resolver=True, attributes=['sAMAccountName', 'distinguishedName', 'sAMAccountType', 'name']) for entry in entries: return entry def gc_sam_lookup(self, samname): """ This function attempts to resolve the SAM name returned in session enumeration to a user/domain combination by querying the Global Catalog. SharpHound calls this GC Deconflictation. """ output = [] entries = self.resolve_samname(samname) # If an error occurs, return if entries is None: return if len(entries) > 0: for entry in entries: output.append(entry['attributes']['objectSid']) else: logging.warning('Failed to resolve SAM name %s in current forest', samname) return output ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832038.0 bloodhound-1.8.0/bloodhound/enumeration/outputworker.py0000664000175000017500000001354514735530746022312 0ustar00useruser#################### # # Copyright (c) 2018 Fox-IT # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # #################### import logging import codecs import json MAX_ENTRIES = 40000 class OutputWorker(object): @staticmethod def write_worker(result_q, computers_filename): """ Worker to write the results from the results_q to the given files. """ computers_out = codecs.open(computers_filename, 'w', 'utf-8') filenumber = 0 # If the logging level is DEBUG, we ident the objects if logging.getLogger().getEffectiveLevel() == logging.DEBUG: indent_level = 1 else: indent_level = None # Write start of the json file computers_out.write('{"data":[') num_computers = 0 current_num_computers = 0 while True: obj = result_q.get() if obj is None: logging.debug('Write worker obtained a None value, exiting') break objtype, data = obj if objtype == 'computer': if current_num_computers != 0: computers_out.write(',') try: encoded_computer = json.dumps(data, indent=indent_level) computers_out.write(encoded_computer) except TypeError: logging.error('Data error {0}, could not convert data to json'.format(repr(data))) computers_out.write('{}') num_computers += 1 current_num_computers += 1 else: logging.warning("Type is %s this should not happen", objtype) result_q.task_done() # Loop file if it gets too big if num_computers % MAX_ENTRIES == 0 and num_computers > 0: logging.debug('Rotating output file %s', computers_filename) computers_out.write('],"meta":{"methods":0,"type":"computers","count":%d, "version":5}}' % current_num_computers) computers_out.close() filenumber += 1 new_filename = computers_filename.replace('.json', '_%02d.json' % filenumber) computers_out = codecs.open(new_filename, 'w', 'utf-8') current_num_computers = 0 computers_out.write('{"data":[') logging.debug('Write worker is done, closing files') # Write metadata manually computers_out.write('],"meta":{"methods":0,"type":"computers","count":%d, "version":5}}' % current_num_computers) computers_out.close() result_q.task_done() @staticmethod def membership_write_worker(result_q, enumtype, filename): """ Worker to write the results from the results_q to the given file. This is for both users and groups """ try: membership_out = codecs.open(filename, 'w', 'utf-8') filenumber = 0 except: logging.warning('Could not write file: %s', filename) result_q.task_done() return # If the logging level is DEBUG, we ident the objects if logging.getLogger().getEffectiveLevel() == logging.DEBUG: indent_level = 1 else: indent_level = None # Write start of the json file membership_out.write('{"data":[') num_members = 0 current_num_members = 0 while True: data = result_q.get() if data is None: break if current_num_members != 0: membership_out.write(',') try: encoded_member = json.dumps(data, indent=indent_level) membership_out.write(encoded_member) except TypeError: logging.error('Data error {0}, could not convert data to json'.format(repr(data))) membership_out.write('{}') num_members += 1 current_num_members += 1 result_q.task_done() # Loop file if it gets too big if num_members % MAX_ENTRIES == 0 and num_members > 0: logging.debug('Rotating output file %s', filename) membership_out.write('],"meta":{"methods":0,"type":"%s","count":%d, "version":5}}' % (enumtype, current_num_members)) membership_out.close() filenumber += 1 new_filename = filename.replace('.json', '_%02d.json' % filenumber) membership_out = codecs.open(new_filename, 'w', 'utf-8') current_num_members = 0 membership_out.write('{"data":[') logging.info('Found %d %s', num_members, enumtype) # Write metadata manually membership_out.write('],"meta":{"methods":0,"type":"%s","count":%d, "version":5}}' % (enumtype, current_num_members)) membership_out.close() result_q.task_done() ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.095881 bloodhound-1.8.0/bloodhound/lib/0000775000175000017500000000000014735533117015351 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1587054219.0 bloodhound-1.8.0/bloodhound/lib/__init__.py0000644000175000017500000000101313646103213017441 0ustar00useruserfrom bloodhound.lib.cstruct import ( cstruct, ctypes, dumpstruct, hexdump, Instance, PointerInstance, Parser, RawType, BaseType, Error, ParserError, CompilerError, ResolveError, NullPointerDereference, ) __all__ = [ "cstruct", "ctypes", "dumpstruct", "hexdump", "Instance", "PointerInstance", "Parser", "RawType", "BaseType", "Error", "ParserError", "CompilerError", "ResolveError", "NullPointerDereference", ]././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832010.0 bloodhound-1.8.0/bloodhound/lib/cstruct.py0000664000175000017500000015422014735530712017414 0ustar00useruser# Copyright (c) 2018 Fox-IT Security Research Team # # Permission is hereby granted, free of charge, to any person obtaining a copy # of this software and associated documentation files (the "Software"), to deal # in the Software without restriction, including without limitation the rights # to use, copy, modify, merge, publish, distribute, sublicense, and/or sell # copies of the Software, and to permit persons to whom the Software is # furnished to do so, subject to the following conditions: # # The above copyright notice and this permission notice shall be included in all # copies or substantial portions of the Software. # # THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR # IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, # FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE # AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER # LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE # SOFTWARE. # TODO: # - Rework definition parsing, maybe pycparser? # - Change expression implementation # - Lazy reading? import re import sys import ast import pprint import string import struct import ctypes as _ctypes from io import BytesIO from collections import OrderedDict try: from builtins import bytes as newbytes except ImportError: newbytes = bytes PY3 = sys.version_info > (3,) if PY3: long = int xrange = range DEBUG = False COLOR_RED = '\033[1;31m' COLOR_GREEN = '\033[1;32m' COLOR_YELLOW = '\033[1;33m' COLOR_BLUE = '\033[1;34m' COLOR_PURPLE = '\033[1;35m' COLOR_CYAN = '\033[1;36m' COLOR_WHITE = '\033[1;37m' COLOR_NORMAL = '\033[1;0m' COLOR_BG_RED = '\033[1;41m\033[1;37m' COLOR_BG_GREEN = '\033[1;42m\033[1;37m' COLOR_BG_YELLOW = '\033[1;43m\033[1;37m' COLOR_BG_BLUE = '\033[1;44m\033[1;37m' COLOR_BG_PURPLE = '\033[1;45m\033[1;37m' COLOR_BG_CYAN = '\033[1;46m\033[1;37m' COLOR_BG_WHITE = '\033[1;47m\033[1;30m' PRINTABLE = string.digits + string.ascii_letters + string.punctuation + " " COMPILE_TEMPL = """ class {name}(Structure): def __init__(self, cstruct, structure, source=None): self.structure = structure self.source = source super({name}, self).__init__(cstruct, structure.name, structure.fields) def _read(self, stream): r = OrderedDict() sizes = {{}} bitreader = BitBuffer(stream, self.cstruct.endian) {read_code} return Instance(self, r, sizes) def add_fields(self, name, type_, offset=None): raise NotImplementedError("Can't add fields to a compiled structure") def __repr__(self): return '' """ class Error(Exception): pass class ParserError(Error): pass class CompilerError(Error): pass class ResolveError(Error): pass class NullPointerDereference(Error): pass def log(line, *args, **kwargs): if not DEBUG: return print(line.format(*args, **kwargs), file=sys.stderr) class cstruct(object): """Main class of cstruct. All types are registered in here. Args: endian: The endianness to use when parsing. pointer: The pointer type to use for Pointers. """ DEF_CSTYLE = 1 def __init__(self, endian='<', pointer='uint64'): self.endian = endian self.consts = {} self.lookups = {} self.typedefs = { 'byte': 'int8', 'ubyte': 'uint8', 'uchar': 'uint8', 'short': 'int16', 'ushort': 'uint16', 'long': 'int32', 'ulong': 'uint32', 'ulong64': 'uint64', 'u1': 'uint8', 'u2': 'uint16', 'u4': 'uint32', 'u8': 'uint64', 'word': 'uint16', 'dword': 'uint32', 'longlong': 'int64', 'ulonglong': 'uint64', 'int': 'int32', 'unsigned int': 'uint32', 'int8': PackedType(self, 'int8', 1, 'b'), 'uint8': PackedType(self, 'uint8', 1, 'B'), 'int16': PackedType(self, 'int16', 2, 'h'), 'uint16': PackedType(self, 'uint16', 2, 'H'), 'int32': PackedType(self, 'int32', 4, 'i'), 'uint32': PackedType(self, 'uint32', 4, 'I'), 'int64': PackedType(self, 'int64', 8, 'q'), 'uint64': PackedType(self, 'uint64', 8, 'Q'), 'float': PackedType(self, 'float', 4, 'f'), 'double': PackedType(self, 'double', 8, 'd'), 'char': CharType(self), 'wchar': WcharType(self), 'int24': BytesInteger(self, 'int24', 3, True), 'uint24': BytesInteger(self, 'uint24', 3, False), 'int48': BytesInteger(self, 'int48', 6, True), 'uint48': BytesInteger(self, 'uint48', 6, False), 'void': VoidType(), } self.pointer = self.resolve(pointer) def addtype(self, name, t, replace=False): """Add a type or type reference. Args: name: Name of the type to be added. t: The type to be added. Can be a str reference to another type or a compatible type class. Raises: ValueError: If the type already exists. """ name = name.lower() if not replace and name.lower() in self.typedefs: raise ValueError("Duplicate type: %s" % name) self.typedefs[name] = t def load(self, s, deftype=None, **kwargs): """Parse structures from the given definitions using the given definition type. Definitions can be parsed using different parsers. Currently, there's only one supported parser - DEF_CSTYLE. Parsers can add types and modify this cstruct instance. Arguments can be passed to parsers using kwargs. Args: s: The definition to parse. deftype: The definition type to parse the definitions with. **kwargs: Keyword arguments for parsers. """ deftype = deftype or cstruct.DEF_CSTYLE if deftype == cstruct.DEF_CSTYLE: parser = CStyleParser(self, **kwargs) parser.parse(s) def loadfile(self, s, deftype=None, **kwargs): """Load structure definitions from a file. The given path will be read and parsed using the .load() function. Args: s: The path to load definitions from. deftype: The definition type to parse the definitions with. **kwargs: Keyword arguments for parsers. """ with open(s, 'r') as fh: self.load(fh.read(), deftype, **kwargs) def read(self, name, s): """Parse data using a given type. Args: name: Type name to read. s: File-like object or byte string to parse. Returns: The parsed data. """ return self.resolve(name).read(s) def resolve(self, name): """Resolve a type name to get the actual type object. Types can be referenced using different names. When we want the actual type object, we need to resolve these references. Args: name: Type name to resolve. Returns: The resolved type object. Raises: ResolveError: If the type can't be resolved. """ t = name if not isinstance(t, str): return t for i in xrange(10): if t.lower() not in self.typedefs: raise ResolveError("Unknown type %s" % name) t = self.typedefs[t.lower()] if not isinstance(t, str): return t raise ResolveError("Recursion limit exceeded while resolving type %s" % name) def __getattr__(self, attr): if attr.lower() in self.typedefs: return self.typedefs[attr.lower()] if attr in self.consts: return self.consts[attr] raise AttributeError("Invalid Attribute: %s" % attr) class Parser(object): """Base class for definition parsers. Args: cstruct: An instance of cstruct. """ def __init__(self, cstruct): self.cstruct = cstruct def parse(self, data): """This function should parse definitions to cstruct types. Args: data: Data to parse definitions from, usually a string. """ raise NotImplementedError() class CStyleParser(Parser): """Definition parser for C-like structure syntax. Args: cstruct: An instance of cstruct compiled: Whether structs should be compiled or not. """ def __init__(self, cstruct, compiled=True): self.compiled = compiled super(CStyleParser, self).__init__(cstruct) # TODO: Implement proper parsing def parse(self, data): self._constants(data) self._enums(data) self._structs(data) self._lookups(data, self.cstruct.consts) def _constants(self, data): r = re.finditer(r'#define\s+(?P[^\s]+)\s+(?P[^\r\n]+)\s*\n', data) for t in r: d = t.groupdict() v = d['value'].rsplit('//')[0] try: v = ast.literal_eval(v) except (ValueError, SyntaxError): pass self.cstruct.consts[d['name']] = v def _enums(self, data): r = re.finditer( r'enum\s+(?P[^\s:{]+)\s*(:\s*(?P[^\s]+)\s*)?\{(?P[^}]+)\}\s*;', data, ) for t in r: d = t.groupdict() nextval = 0 values = {} for line in d['values'].split('\n'): line, sep, comment = line.partition("//") for v in line.split(","): key, sep, val = v.partition("=") key = key.strip() val = val.strip() if not key: continue if not val: val = nextval else: val = Expression(self.cstruct, val).evaluate({}) nextval = val + 1 values[key] = val if not d['type']: d['type'] = 'uint32' enum = Enum( self.cstruct, d['name'], self.cstruct.resolve(d['type']), values ) self.cstruct.addtype(enum.name, enum) def _structs(self, data): compiler = Compiler(self.cstruct) r = re.finditer( r'(#(?P(?:compile))\s+)?((?Ptypedef)\s+)?(?P[^\s]+)\s+(?P[^\s]+)?(?P\s*\{[^}]+\}(?P\s+[^;\n]+)?)?\s*;', data, ) for t in r: d = t.groupdict() if d['name']: name = d['name'] elif d['defs']: name = d['defs'].strip().split(',')[0].strip() else: raise ParserError("No name for struct") if d['type'] == 'struct': data = self._parse_fields(d['fields'][1:-1].strip()) st = Structure(self.cstruct, name, data) if d['flags'] == 'compile' or self.compiled: st = compiler.compile(st) elif d['typedef'] == 'typedef': st = d['type'] else: continue if d['name']: self.cstruct.addtype(d['name'], st) if d['defs']: for td in d['defs'].strip().split(','): td = td.strip() self.cstruct.addtype(td, st) def _parse_fields(self, s): fields = re.finditer( r'(?P[^\s]+)\s+(?P[^\s\[:]+)(\s*:\s*(?P\d+))?(\[(?P[^;\n]*)\])?;', s, ) r = [] for f in fields: d = f.groupdict() if d['type'].startswith('//'): continue type_ = self.cstruct.resolve(d['type']) d['name'] = d['name'].replace('(', '').replace(')', '') # Maybe reimplement lazy type references later # _type = TypeReference(self, d['type']) if d['count'] is not None: if d['count'] == '': count = None else: count = Expression(self.cstruct, d['count']) try: count = count.evaluate() except Exception: pass type_ = Array(self.cstruct, type_, count) if d['name'].startswith('*'): d['name'] = d['name'][1:] type_ = Pointer(self.cstruct, type_) field = Field(d['name'], type_, int(d['bits']) if d['bits'] else None) r.append(field) return r def _lookups(self, data, consts): r = re.finditer(r'\$(?P[^\s]+) = ({[^}]+})\w*\n', data) for t in r: d = ast.literal_eval(t.group(2)) self.cstruct.lookups[t.group(1)] = dict( [(self.cstruct.consts[k], v) for k, v in d.items()] ) class Instance(object): """Holds parsed structure data.""" def __init__(self, type_, values, sizes=None): object.__setattr__(self, '_type', type_) object.__setattr__(self, '_values', values) object.__setattr__(self, '_sizes', sizes) def write(self, fh): """Write this structure to a writable file-like object. Args: fh: File-like objects that supports writing. Returns: The amount of bytes written. """ return self.__dict__['_type'].write(fh, self) def dumps(self): """Dump this structure to a byte string. Returns: The raw bytes of this structure. """ s = BytesIO() self.write(s) return s.getvalue() def __getattr__(self, attr): if attr not in self.__dict__['_type'].lookup: raise AttributeError("Invalid attribute: %r" % attr) return self.__dict__['_values'][attr] def __setattr__(self, attr, value): if attr not in self.__dict__['_type'].lookup: raise AttributeError("Invalid attribute: %r" % attr) self.__dict__['_values'][attr] = value def __getitem__(self, item): return self.__dict__['_values'][item] def __contains__(self, attr): return attr in self.__dict__['_values'] def __repr__(self): return '<%s %s>' % ( self.__dict__['_type'].name, ', '.join( [ '%s=%s' % (k, hex(v) if isinstance(v, (int, long)) else repr(v)) for k, v in self.__dict__['_values'].items() ] ), ) def __len__(self): return len(self.dumps()) def _size(self, field): return self.__dict__['_sizes'][field] class PointerInstance(object): """Like the Instance class, but for structures referenced by a pointer.""" def __init__(self, t, stream, addr, ctx): self._stream = stream self._type = t self._addr = addr self._ctx = ctx self._value = None def _get(self): log("Dereferencing pointer -> 0x{:016x} [{!r}]", self._addr, self._stream) if self._addr == 0: raise NullPointerDereference() if self._value is None: pos = self._stream.tell() self._stream.seek(self._addr) if isinstance(self._type, Array): r = self._type._read(self._stream, self._ctx) else: r = self._type._read(self._stream) self._stream.seek(pos) self._value = r return self._value def __getattr__(self, attr): return getattr(self._get(), attr) def __str__(self): return str(self._get()) def __nonzero__(self): return self._addr != 0 def __repr__(self): return "".format(self._type, self._addr) class Expression(object): """Expression parser for simple calculations in definitions.""" operators = [ ('+', lambda a, b: a + b), ('-', lambda a, b: a - b), ('*', lambda a, b: a * b), ('/', lambda a, b: a / b), ('&', lambda a, b: a & b), ('|', lambda a, b: a | b), ('>>', lambda a, b: a >> b), ('<<', lambda a, b: a << b), ] def __init__(self, cstruct, expr): self.cstruct = cstruct self.expr = expr def evaluate(self, context=None): context = context if context else {} level = 0 levels = [] buf = '' for i in xrange(len(self.expr)): if self.expr[i] == '(': level += 1 levels.append(buf) buf = '' continue if self.expr[i] == ')': level -= 1 val = self.evaluate_part(buf, context) buf = levels.pop() buf += str(val) continue buf += self.expr[i] return self.evaluate_part(buf, context) def evaluate_part(self, e, v): e = e.strip() for o in self.operators: if o[0] in e: a, b = e.rsplit(o[0], 1) return o[1](self.evaluate_part(a, v), self.evaluate_part(b, v)) if e in v: return v[e] if e.startswith('0x'): return int(e, 16) if e in self.cstruct.consts: return self.cstruct.consts[e] return int(e) def __repr__(self): return self.expr class BaseType(object): """Base class for cstruct type classes.""" def __init__(self, cstruct): self.cstruct = cstruct def reads(self, data): """Parse the given data according to the type that implements this class. Args: data: Byte string to parse. Returns: The parsed value of this type. """ data = BytesIO(data) return self._read(data) def dumps(self, data): """Dump the given data according to the type that implements this class. Args: data: Data to dump. Returns: The resulting bytes. """ out = BytesIO() self._write(out, data) return out.getvalue() def read(self, obj, *args, **kwargs): """Parse the given data according to the type that implements this class. Args: obj: Data to parse. Can be a (byte) string or a file-like object. Returns: The parsed value of this type. """ if isinstance(obj, (str, bytes, newbytes)): return self.reads(obj) return self._read(obj) def write(self, stream, data): """Write the given data to a writable file-like object according to the type that implements this class. Args: stream: Writable file-like object to write to. data: Data to write. Returns: The amount of bytes written. """ return self._write(stream, data) def _read(self, stream): raise NotImplementedError() def _read_array(self, stream, count): return [self._read(stream) for i in xrange(count)] def _read_0(self, stream): raise NotImplementedError() def _write(self, stream, data): raise NotImplementedError() def _write_array(self, stream, data): num = 0 for i in data: num += self._write(stream, i) return num def _write_0(self, stream, data): raise NotImplementedError() def default(self): """Return a default value of this type.""" raise NotImplementedError() def default_array(self): """Return a default array of this type.""" raise NotImplementedError() def __getitem__(self, count): return Array(self.cstruct, self, count) def __call__(self, *args, **kwargs): if len(args) > 0: return self.read(*args, **kwargs) r = self.default() if kwargs: for k, v in kwargs.items(): setattr(r, k, v) return r class RawType(BaseType): """Base class for raw types that have a name and size.""" def __init__(self, cstruct, name=None, size=0): self.name = name self.size = size super(RawType, self).__init__(cstruct) def __len__(self): return self.size def __repr__(self): if self.name: return self.name return BaseType.__repr__(self) class Structure(BaseType): """Type class for structures.""" def __init__(self, cstruct, name, fields=None): self.name = name self.size = None self.lookup = OrderedDict() self.fields = fields if fields else [] for f in self.fields: self.lookup[f.name] = f self._calc_offsets() super(Structure, self).__init__(cstruct) def _calc_offsets(self): offset = 0 bitstype = None bitsremaining = 0 for field in self.fields: if field.bits: if bitsremaining == 0 or field.type != bitstype: bitstype = field.type bitsremaining = bitstype.size * 8 if offset is not None: field.offset = offset offset += bitstype.size else: field.offset = None bitsremaining -= field.bits continue field.offset = offset if offset is not None: try: offset += len(field.type) except TypeError: offset = None def _calc_size(self): size = 0 bitstype = None bitsremaining = 0 for field in self.fields: if field.bits: if bitsremaining == 0 or field.type != bitstype: bitstype = field.type bitsremaining = bitstype.size * 8 size += bitstype.size bitsremaining -= field.bits continue fieldlen = len(field.type) size += fieldlen if field.offset is not None: size = max(size, field.offset + fieldlen) return size def _read(self, stream, *args, **kwargs): log("[Structure::read] {} {}", self.name, self.size) bitbuffer = BitBuffer(stream, self.cstruct.endian) struct_start = stream.tell() r = OrderedDict() sizes = {} for field in self.fields: start = stream.tell() ft = self.cstruct.resolve(field.type) if field.offset: if start != struct_start + field.offset: log( "+ seeking to 0x{:x}+0x{:x} for {}".format( struct_start, field.offset, field.name ) ) stream.seek(struct_start + field.offset) start = struct_start + field.offset if field.bits: r[field.name] = bitbuffer.read(ft, field.bits) continue else: bitbuffer.reset() if isinstance(ft, (Array, Pointer)): v = ft._read(stream, r) else: v = ft._read(stream) sizes[field.name] = stream.tell() - start r[field.name] = v return Instance(self, r, sizes) def _write(self, stream, data): bitbuffer = BitBuffer(stream, self.cstruct.endian) num = 0 for field in self.fields: if field.bits: bitbuffer.write(field.type, getattr(data, field.name), field.bits) continue if bitbuffer._type: bitbuffer.flush() num += field.type._write(stream, getattr(data, field.name)) # Flush bitbuffer if bitbuffer._type: bitbuffer.flush() return num def add_field(self, name, type_, offset=None): """Add a field to this structure. Args: name: The field name. type_: The field type. offset: The field offset. """ field = Field(name, type_, offset=offset) self.fields.append(field) self.lookup[name] = field self.size = None setattr(self, name, field) def default(self): """Create and return an empty Instance from this structure. Returns: An empty Instance from this structure. """ r = OrderedDict() for field in self.fields: r[field.name] = field.type.default() return Instance(self, r) def __len__(self): if self.size is None: self.size = self._calc_size() return self.size def __repr__(self): return ''.format(self.name) def show(self, indent=0): """Pretty print this structure.""" if indent == 0: print("struct {}".format(self.name)) for field in self.fields: if field.offset is None: offset = '0x??' else: offset = '0x{:02x}'.format(field.offset) print("{}+{} {} {}".format(' ' * indent, offset, field.name, field.type)) if isinstance(field.type, Structure): field.type.show(indent + 1) class BitBuffer(object): """Implements a bit buffer that can read and write bit fields.""" def __init__(self, stream, endian): self.stream = stream self.endian = endian self._type = None self._buffer = 0 self._remaining = 0 def read(self, field_type, bits): if self._remaining < 1 or self._type != field_type: self._type = field_type self._remaining = field_type.size * 8 self._buffer = field_type._read(self.stream) if self.endian != '>': v = self._buffer & ((1 << bits) - 1) self._buffer >>= bits self._remaining -= bits else: v = self._buffer & ( ((1 << (self._remaining - bits)) - 1) ^ ((1 << self._remaining) - 1) ) v >>= self._remaining - bits self._remaining -= bits return v def write(self, field_type, data, bits): if self._remaining == 0: self._remaining = field_type.size * 8 self._type = field_type if self.endian != '>': self._buffer |= data << (self._type.size * 8 - self._remaining) else: self._buffer |= data << (self._remaining - bits) self._remaining -= bits def flush(self): self._type._write(self.stream, self._buffer) self._type = None self._remaining = 0 self._buffer = 0 def reset(self): self._type = None self._buffer = 0 self._remaining = 0 class Field(object): """Holds a structure field.""" def __init__(self, name, type_, bits=None, offset=None): self.name = name self.type = type_ self.bits = bits self.offset = offset def __repr__(self): return ''.format(self.name, self.type) class Array(BaseType): """Implements a fixed or dynamically sized array type. Example: When using the default C-style parser, the following syntax is supported: x[3] -> 3 -> static length. x[] -> None -> null-terminated. x[expr] -> expr -> dynamic length. """ def __init__(self, cstruct, type_, count): self.type = type_ self.count = count self.dynamic = isinstance(self.count, Expression) or self.count is None super(Array, self).__init__(cstruct) def _read(self, stream, context=None): if self.count is None: return self.type._read_0(stream) if self.dynamic: count = self.count.evaluate(context) else: count = self.count return self.type._read_array(stream, max(0, count)) def _write(self, f, data): if self.count is None: return self.type._write_0(f, data) return self.type._write_array(f, data) def default(self): if self.dynamic or self.count is None: return [] return [self.type.default() for i in xrange(self.count)] def __repr__(self): if self.count is None: return '{0!r}[]'.format(self.type) return '{0!r}[{1}]'.format(self.type, self.count) def __len__(self): if self.dynamic: raise TypeError("Dynamic size") return len(self.type) * self.count class PackedType(RawType): """Implements a packed type that uses Python struct packing characters.""" def __init__(self, cstruct, name, size, packchar): self.packchar = packchar super(PackedType, self).__init__(cstruct, name, size) def _read(self, stream): return self._read_array(stream, 1)[0] def _read_array(self, stream, count): length = self.size * count data = stream.read(length) fmt = self.cstruct.endian + str(count) + self.packchar if len(data) != length: raise EOFError("Read %d bytes, but expected %d" % (len(data), length)) return list(struct.unpack(fmt, data)) def _read_0(self, stream): r = [] while True: d = stream.read(self.size) v = struct.unpack(self.cstruct.endian + self.packchar, d)[0] if v == 0: break r.append(v) return r def _write(self, stream, data): return self._write_array(stream, [data]) def _write_array(self, stream, data): fmt = self.cstruct.endian + str(len(data)) + self.packchar return stream.write(struct.pack(fmt, *data)) def _write_0(self, stream, data): return self._write_array(stream, data + [0]) def default(self): return 0 def default_array(self, count): return [0] * count class CharType(RawType): """Implements a character type that can properly handle strings.""" def __init__(self, cstruct): super(CharType, self).__init__(cstruct, 'char', 1) def _read(self, stream): return stream.read(1) def _read_array(self, stream, count): if count == 0: return b'' return stream.read(count) def _read_0(self, stream): r = [] while True: c = stream.read(1) if c == b'': raise EOFError() if c == b'\x00': break r.append(c) return b''.join(r) def _write(self, stream, data): if isinstance(data, int): data = chr(data) if PY3 and isinstance(data, str): data = data.encode('latin-1') return stream.write(data) def _write_array(self, stream, data): return self._write(stream, data) def _write_0(self, stream, data): return self._write(stream, data + b'\x00') def default(self): return b'\x00' def default_array(self, count): return b'\x00' * count class WcharType(RawType): """Implements a wide-character type.""" def __init__(self, cstruct): super(WcharType, self).__init__(cstruct, 'wchar', 2) @property def encoding(self): if self.cstruct.endian == '<': return 'utf-16-le' elif self.cstruct.endian == '>': return 'utf-16-be' def _read(self, stream): return stream.read(2).decode(self.encoding) def _read_array(self, stream, count): if count == 0: return u'' data = stream.read(2 * count) return data.decode(self.encoding) def _read_0(self, stream): r = b'' while True: c = stream.read(2) if len(c) != 2: raise EOFError() if c == b'\x00\x00': break r += c return r.decode(self.encoding) def _write(self, stream, data): return stream.write(data.encode(self.encoding)) def _write_array(self, stream, data): return self._write(stream, data) def _write_0(self, stream, data): return self._write(stream, data + u'\x00') def default(self): return u'\x00' def default_array(self, count): return u'\x00' * count class BytesInteger(RawType): """Implements an integer type that can span an arbitrary amount of bytes.""" def __init__(self, cstruct, name, size, signed): self.signed = signed super(BytesInteger, self).__init__(cstruct, name, size) @staticmethod def parse(buf, size, count, signed, endian): nums = [] for c in xrange(count): num = 0 data = buf[c * size:(c + 1) * size] if endian == '<': data = b''.join(data[i:i + 1] for i in reversed(xrange(len(data)))) ints = list(data) if PY3 else map(ord, data) for i in ints: num = (num << 8) | i if signed and num & 1 << (size * 8 - 1): bias = 1 << (size * 8 - 1) num -= bias * 2 nums.append(num) return nums @staticmethod def pack(data, size, endian): buf = [] for i in data: num = int(i) if num < 0: num += 1 << (size * 8) d = [b'\x00'] * size i = size - 1 while i >= 0: b = num & 255 d[i] = bytes((b,)) if PY3 else chr(b) num >>= 8 i -= 1 if endian == '<': d = b''.join(d[i:i + 1][0] for i in reversed(xrange(len(d)))) else: d = b''.join(d) buf.append(d) return b''.join(buf) def _read(self, stream): return self.parse(stream.read(self.size * 1), self.size, 1, self.signed, self.cstruct.endian)[0] def _read_array(self, stream, count): return self.parse(stream.read(self.size * count), self.size, count, self.signed, self.cstruct.endian) def _read_0(self, stream): r = [] while True: v = self._read(stream) if v == 0: break r.append(v) return r def _write(self, stream, data): return stream.write(self.pack([data], self.size, self.cstruct.endian)) def _write_array(self, stream, data): return stream.write(self.pack(data, self.size, self.cstruct.endian)) def _write_0(self, stream, data): return self._write_array(stream, data + [0]) def default(self): return 0 def default_array(self, count): return [0] * count class Enum(RawType): """Implements an Enum type. Enums can be made using any type. The API for accessing enums and their values is very similar to Python 3 native enums. Example: When using the default C-style parser, the following syntax is supported: enum [: ] { }; For example, an enum that has A=1, B=5 and C=6 could be written like so: enum Test : uint16 { A, B=5, C }; """ def __init__(self, cstruct, name, type_, values): self.type = type_ self.values = values self.reverse = {} for k, v in values.items(): self.reverse[v] = k super(Enum, self).__init__(cstruct, name, len(self.type)) def __call__(self, value): return EnumInstance(self, value) def _read(self, stream): v = self.type._read(stream) return self(v) def _read_array(self, stream, count): return list(map(self, self.type._read_array(stream, count))) def _read_0(self, stream): return list(map(self, self.type._read_0(stream))) def _write(self, stream, data): data = data.value if isinstance(data, EnumInstance) else data return self.type._write(stream, data) def _write_array(self, stream, data): data = [d.value if isinstance(d, EnumInstance) else d for d in data] return self.type._write_array(stream, data) def _write_0(self, stream, data): data = [d.value if isinstance(d, EnumInstance) else d for d in data] return self.type._write_0(stream, data) def default(self): return self(0) def __getitem__(self, attr): if attr in self.values: return self(self.values[attr]) raise KeyError(attr) def __getattr__(self, attr): if attr in self.values: return self(self.values[attr]) raise AttributeError(attr) def __contains__(self, attr): return attr in self.values class EnumInstance(object): """Implements a value instance of an Enum""" def __init__(self, enum, value): self.enum = enum self.value = value @property def name(self): if self.value not in self.enum.reverse: return '{}_{}'.format(self.enum.name, self.value) return self.enum.reverse[self.value] def __eq__(self, value): if isinstance(value, EnumInstance) and value.enum is not self.enum: return False if hasattr(value, 'value'): value = value.value return self.value == value def __ne__(self, value): return self.__eq__(value) is False def __hash__(self): return hash((self.enum, self.value)) def __str__(self): return '{}.{}'.format(self.enum.name, self.name) def __repr__(self): return '<{}.{}: {}>'.format(self.enum.name, self.name, self.value) class Union(RawType): def __init__(self, cstruct): self.cstruct = cstruct super(Union, self).__init__(cstruct) def _read(self, stream): raise NotImplementedError() class Pointer(RawType): """Implements a pointer to some other type.""" def __init__(self, cstruct, target): self.cstruct = cstruct self.type = target super(Pointer, self).__init__(cstruct) def _read(self, stream, ctx): addr = self.cstruct.pointer(stream) return PointerInstance(self.type, stream, addr, ctx) def __len__(self): return len(self.cstruct.pointer) def __repr__(self): return ''.format(self.type) class VoidType(RawType): """Implements a void type.""" def __init__(self): super(VoidType, self).__init__(None, 'void', 0) def _read(self, stream): return None def ctypes(structure): """Create ctypes structures from cstruct structures.""" fields = [] for field in structure.fields: t = ctypes_type(field.type) fields.append((field.name, t)) tt = type(structure.name, (_ctypes.Structure, ), {"_fields_": fields}) return tt def ctypes_type(t): mapping = { "I": _ctypes.c_ulong, "i": _ctypes.c_long, "b": _ctypes.c_int8, } if isinstance(t, PackedType): return mapping[t.packchar] if isinstance(t, CharType): return _ctypes.c_char if isinstance(t, Array): subtype = ctypes_type(t._type) return subtype * t.count if isinstance(t, Pointer): subtype = ctypes_type(t._target) return ctypes.POINTER(subtype) raise NotImplementedError("Type not implemented: %s" % t.__class__.__name__) class Compiler(object): """Compiler for cstruct structures. Creates somewhat optimized parsing code.""" def __init__(self, cstruct): self.cstruct = cstruct def compile(self, structure): source = self.gen_struct_class(structure) c = compile(source, '', 'exec') env = { 'OrderedDict': OrderedDict, 'Structure': Structure, 'Instance': Instance, 'Expression': Expression, 'EnumInstance': EnumInstance, 'PointerInstance': PointerInstance, 'BytesInteger': BytesInteger, 'BitBuffer': BitBuffer, 'struct': struct, 'xrange': xrange, } exec(c, env) sc = env[structure.name](self.cstruct, structure, source) return sc def gen_struct_class(self, structure): blocks = [] classes = [] cur_block = [] read_size = 0 prev_was_bits = False for field in structure.fields: ft = self.cstruct.resolve(field.type) if not isinstance( ft, ( Structure, Pointer, Enum, Array, PackedType, CharType, WcharType, BytesInteger, ), ): raise CompilerError("Unsupported type for compiler: {}".format(ft)) if isinstance(ft, Structure) or ( isinstance(ft, Array) and isinstance(ft.type, Structure) ): if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) struct_read = 's = stream.tell()\n' if isinstance(ft, Array): num = ft.count if isinstance(num, Expression): num = 'max(0, Expression(self.cstruct, "{expr}").evaluate(r))'.format( expr=num.expr ) struct_read += ( 'r["{name}"] = []\n' 'for _ in xrange({num}):\n' ' r["{name}"].append(self.cstruct.{struct_name}._read(stream))\n'.format( name=field.name, num=num, struct_name=ft.type.name ) ) else: struct_read += 'r["{name}"] = self.cstruct.{struct_name}._read(stream)\n'.format( name=field.name, struct_name=ft.name ) struct_read += 'sizes["{name}"] = stream.tell() - s'.format( name=field.name ) blocks.append(struct_read) read_size = 0 cur_block = [] continue if field.bits: if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) blocks.append( 'r["{name}"] = bitreader.read(self.cstruct.{type_name}, {bits})'.format( name=field.name, type_name=field.type.name, bits=field.bits ) ) read_size = 0 cur_block = [] prev_was_bits = True continue elif prev_was_bits: blocks.append('bitreader.reset()') prev_was_bits = False try: count = len(ft) read_size += count cur_block.append(field) except Exception: if cur_block: blocks.append(self.gen_read_block(read_size, cur_block)) blocks.append(self.gen_dynamic_block(field)) read_size = 0 cur_block = [] if len(cur_block): blocks.append(self.gen_read_block(read_size, cur_block)) read_code = '\n\n'.join(blocks) read_code = '\n'.join([' ' * 2 + line for line in read_code.split('\n')]) classes.append(COMPILE_TEMPL.format(name=structure.name, read_code=read_code)) return '\n\n'.join(classes) def gen_read_block(self, size, block): templ = ( 'buf = stream.read({size})\n' 'if len(buf) != {size}: raise EOFError()\n' 'data = struct.unpack(self.cstruct.endian + "{{}}", buf)\n' '{{}}'.format(size=size) ) readcode = [] fmt = [] curtype = None curcount = 0 buf_offset = 0 data_offset = 0 for field in block: ft = self.cstruct.resolve(field.type) t = ft count = 1 data_count = 1 read_slice = '' if isinstance(t, Enum): t = t.type elif isinstance(t, Pointer): t = self.cstruct.pointer if isinstance(ft, Array): count = t.count data_count = count t = t.type if isinstance(t, Enum): t = t.type elif isinstance(t, Pointer): t = self.cstruct.pointer if isinstance(t, (CharType, WcharType, BytesInteger)): read_slice = '{}:{}'.format( buf_offset, buf_offset + (count * t.size) ) else: read_slice = '{}:{}'.format(data_offset, data_offset + count) elif isinstance(t, CharType): read_slice = str(buf_offset) elif isinstance(t, (WcharType, BytesInteger)): read_slice = '{}:{}'.format(buf_offset, buf_offset + t.size) else: read_slice = str(data_offset) if not curtype: if isinstance(t, PackedType): curtype = t.packchar else: curtype = 'x' if isinstance(t, (PackedType, CharType, WcharType, BytesInteger, Enum)): charcount = count if isinstance(t, (CharType, WcharType, BytesInteger)): data_count = 0 packchar = 'x' charcount *= t.size else: packchar = t.packchar if curtype != packchar: fmt.append('{}{}'.format(curcount, curtype)) curcount = 0 curcount += charcount curtype = packchar getter = '' if isinstance(t, BytesInteger): getter = 'BytesInteger.parse(buf[{slice}], {size}, {count}, {signed}, self.cstruct.endian){data_slice}'.format( slice=read_slice, size=t.size, count=count, signed=t.signed, data_slice='[0]' if count == 1 else '', ) elif isinstance(t, (CharType, WcharType)): getter = 'buf[{}]'.format(read_slice) if isinstance(t, WcharType): getter += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" else: getter = 'data[{}]'.format(read_slice) if isinstance(ft, Enum): getter = 'EnumInstance(self.cstruct.{type_name}, {getter})'.format( type_name=ft.name, getter=getter ) elif isinstance(ft, Array) and isinstance(ft.type, Enum): getter = '[EnumInstance(self.cstruct.{type_name}, d) for d in {getter}]'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Pointer): getter = 'PointerInstance(self.cstruct.{type_name}, stream, {getter}, r)'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Array) and isinstance(ft.type, Pointer): getter = '[PointerInstance(self.cstruct.{type_name}, stream, d, r) for d in {getter}]'.format( type_name=ft.type.name, getter=getter ) elif isinstance(ft, Array) and isinstance(t, PackedType): getter = 'list({})'.format(getter) readcode.append( 'r["{name}"] = {getter}'.format(name=field.name, getter=getter) ) readcode.append( 'sizes["{name}"] = {size}'.format(name=field.name, size=count * t.size) ) data_offset += data_count buf_offset += count * t.size if curcount: fmt.append('{}{}'.format(curcount, curtype)) return templ.format(''.join(fmt), '\n'.join(readcode)) def gen_dynamic_block(self, field): if not isinstance(field.type, Array): raise CompilerError( "Only Array can be dynamic, got {!r}".format(field.type) ) t = field.type.type reader = None if not field.type.count: # Null terminated if isinstance(t, PackedType): reader = ( 't = []\nwhile True:\n' ' d = stream.read({size})\n' ' if len(d) != {size}: raise EOFError()\n' ' v = struct.unpack(self.cstruct.endian + "{packchar}", d)[0]\n' ' if v == 0: break\n' ' t.append(v)'.format(size=t.size, packchar=t.packchar) ) elif isinstance(t, (CharType, WcharType)): reader = ( 't = []\n' 'while True:\n' ' c = stream.read({size})\n' ' if len(c) != {size}: raise EOFError()\n' ' if c == b"{null}": break\n' ' t.append(c)\nt = b"".join(t)'.format( size=t.size, null='\\x00' * t.size ) ) if isinstance(t, WcharType): reader += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" elif isinstance(t, BytesInteger): reader = ( 't = []\n' 'while True:\n' ' d = stream.read({size})\n' ' if len(d) != {size}: raise EOFError()\n' ' v = BytesInteger.parse(d, {size}, 1, {signed}, self.cstruct.endian)\n' ' if v == 0: break\n' ' t.append(v)'.format(size=t.size, signed=t.signed) ) return '{reader}\nr["{name}"] = t\nsizes["{name}"] = len(t)'.format( reader=reader, name=field.name ) else: expr = field.type.count.expr expr_read = ( 'dynsize = max(0, Expression(self.cstruct, "{expr}").evaluate(r))\n' 'buf = stream.read(dynsize * {type_size})\n' 'if len(buf) != dynsize * {type_size}: raise EOFError()\n' 'r["{name}"] = {{reader}}\n' 'sizes["{name}"] = dynsize * {type_size}'.format( expr=expr, name=field.name, type_size=t.size ) ) if isinstance(t, PackedType): reader = 'list(struct.unpack(self.cstruct.endian + "{{:d}}{packchar}".format(dynsize), buf))'.format( packchar=t.packchar, type_size=t.size ) elif isinstance(t, (CharType, WcharType)): reader = 'buf' if isinstance(t, WcharType): reader += ".decode('utf-16-le' if self.cstruct.endian == '<' else 'utf-16-be')" elif isinstance(t, BytesInteger): reader = 'BytesInteger.parse(buf, {size}, dynsize, {signed}, self.cstruct.endian)'.format( size=t.size, signed=t.signed ) return expr_read.format(reader=reader, size=None) def hexdump(s, palette=None, offset=0, prefix=""): """Hexdump some data. Args: s: Bytes to hexdump. palette: Colorize the hexdump using this color pattern. offset: Byte offset of the hexdump. prefix: Optional prefix. """ if palette: palette = palette[::-1] remaining = 0 active = None for i in xrange(0, len(s), 16): vals = "" chars = [] for j in xrange(16): if not active and palette: remaining, active = palette.pop() vals += active elif active and j == 0: vals += active if i + j >= len(s): vals += " " else: c = s[i + j] c = chr(c) if PY3 else c p = c if c in PRINTABLE else "." if active: vals += "{:02x}".format(ord(c)) chars.append(active + p + COLOR_NORMAL) else: vals += "{:02x}".format(ord(c)) chars.append(p) remaining -= 1 if remaining == 0: active = None if palette is not None: vals += COLOR_NORMAL if j == 15: if palette is not None: vals += COLOR_NORMAL vals += " " if j == 7: vals += " " chars = "".join(chars) print("{}{:08x} {:48s} {}".format(prefix, offset + i, vals, chars)) def dumpstruct(t, data=None, offset=0): """Dump a structure or parsed structure instance. Prints a colorized hexdump and parsed structure output. Args: t: Structure or Instance to dump. data: Bytes to parse the Structure on, if t is not a parsed Instance. offset: Byte offset of the hexdump. """ colors = [ (COLOR_RED, COLOR_BG_RED), (COLOR_GREEN, COLOR_BG_GREEN), (COLOR_YELLOW, COLOR_BG_YELLOW), (COLOR_BLUE, COLOR_BG_BLUE), (COLOR_PURPLE, COLOR_BG_PURPLE), (COLOR_CYAN, COLOR_BG_CYAN), (COLOR_WHITE, COLOR_BG_WHITE), ] if isinstance(t, Instance): g = t t = t._type data = g.dumps() elif isinstance(t, Structure) and data: g = t(data) else: raise ValueError("Invalid arguments") palette = [] ci = 0 out = "struct {}".format(t.name) + ":\n" for field in g._type.fields: fg, bg = colors[ci % len(colors)] palette.append((g._size(field.name), bg)) ci += 1 v = getattr(g, field.name) if isinstance(v, str): v = repr(v) elif isinstance(v, int): v = hex(v) elif isinstance(v, list): v = pprint.pformat(v) if '\n' in v: v = v.replace('\n', '\n{}'.format(' ' * (len(field.name) + 4))) out += "- {}{}{}: {}\n".format(fg, field.name, COLOR_NORMAL, v) print() hexdump(data, palette, offset=offset) print() print(out) ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.096881 bloodhound-1.8.0/bloodhound.egg-info/0000775000175000017500000000000014735533117016275 5ustar00useruser././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/PKG-INFO0000644000175000017500000000171514735533117017374 0ustar00useruserMetadata-Version: 2.1 Name: bloodhound Version: 1.8.0 Summary: Python based ingestor for BloodHound Home-page: https://github.com/dirkjanm/bloodhound.py Author: Dirk-jan Mollema, Edwin van Vliet, Matthijs Gielen Author-email: dirkjan@dirkjanm.io, edwin.vanvliet@fox-it.com, matthijs.gielen@fox-it.com Maintainer: Dirk-jan Mollema Maintainer-email: dirkjan@dirkjanm.io License: MIT Classifier: Intended Audience :: Information Technology Classifier: License :: OSI Approved :: MIT License Classifier: Programming Language :: Python :: 3.7 Classifier: Programming Language :: Python :: 3.8 Classifier: Programming Language :: Python :: 3.9 Classifier: Programming Language :: Python :: 3.10 Classifier: Programming Language :: Python :: 3.11 Classifier: Programming Language :: Python :: 3.12 License-File: LICENSE Requires-Dist: dnspython Requires-Dist: impacket>=0.9.17 Requires-Dist: ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5 Requires-Dist: pyasn1>=0.4 Requires-Dist: pycryptodome ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/SOURCES.txt0000664000175000017500000000143214735533117020161 0ustar00useruserLICENSE README.md setup.py bloodhound/__init__.py bloodhound/__main__.py bloodhound.egg-info/PKG-INFO bloodhound.egg-info/SOURCES.txt bloodhound.egg-info/dependency_links.txt bloodhound.egg-info/entry_points.txt bloodhound.egg-info/requires.txt bloodhound.egg-info/top_level.txt bloodhound/ad/__init__.py bloodhound/ad/authentication.py bloodhound/ad/computer.py bloodhound/ad/domain.py bloodhound/ad/dumpntlm.py bloodhound/ad/structures.py bloodhound/ad/trusts.py bloodhound/ad/utils.py bloodhound/enumeration/__init__.py bloodhound/enumeration/acls.py bloodhound/enumeration/computers.py bloodhound/enumeration/domains.py bloodhound/enumeration/memberships.py bloodhound/enumeration/objectresolver.py bloodhound/enumeration/outputworker.py bloodhound/lib/__init__.py bloodhound/lib/cstruct.py././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/dependency_links.txt0000664000175000017500000000000114735533117022343 0ustar00useruser ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/entry_points.txt0000664000175000017500000000006614735533117021575 0ustar00useruser[console_scripts] bloodhound-python = bloodhound:main ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/requires.txt0000664000175000017500000000012514735533117020673 0ustar00useruserdnspython impacket>=0.9.17 ldap3!=2.5.0,!=2.5.2,!=2.6,>=2.5 pyasn1>=0.4 pycryptodome ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735833167.0 bloodhound-1.8.0/bloodhound.egg-info/top_level.txt0000664000175000017500000000001314735533117021021 0ustar00useruserbloodhound ././@PaxHeader0000000000000000000000000000003300000000000010211 xustar0027 mtime=1735833167.096881 bloodhound-1.8.0/setup.cfg0000664000175000017500000000004614735533117014267 0ustar00useruser[egg_info] tag_build = tag_date = 0 ././@PaxHeader0000000000000000000000000000002600000000000010213 xustar0022 mtime=1735832445.0 bloodhound-1.8.0/setup.py0000664000175000017500000000235214735531575014170 0ustar00useruserfrom setuptools import setup setup(name='bloodhound', version='1.8.0', description='Python based ingestor for BloodHound', author='Dirk-jan Mollema, Edwin van Vliet, Matthijs Gielen', author_email='dirkjan@dirkjanm.io, edwin.vanvliet@fox-it.com, matthijs.gielen@fox-it.com', maintainer='Dirk-jan Mollema', maintainer_email='dirkjan@dirkjanm.io', url='https://github.com/dirkjanm/bloodhound.py', packages=['bloodhound', 'bloodhound.ad', 'bloodhound.lib', 'bloodhound.enumeration'], license='MIT', install_requires=['dnspython', 'impacket>=0.9.17', 'ldap3>=2.5,!=2.5.2,!=2.5.0,!=2.6', 'pyasn1>=0.4', 'pycryptodome'], classifiers=[ 'Intended Audience :: Information Technology', 'License :: OSI Approved :: MIT License', 'Programming Language :: Python :: 3.7', 'Programming Language :: Python :: 3.8', 'Programming Language :: Python :: 3.9', 'Programming Language :: Python :: 3.10', 'Programming Language :: Python :: 3.11', 'Programming Language :: Python :: 3.12', ], entry_points= { 'console_scripts': ['bloodhound-python=bloodhound:main'] } )