From 0a5c1fd698d2851f57ba2e84bd48c9455a8ede01 Mon Sep 17 00:00:00 2001 From: Alexander Neff Date: Mon, 3 Mar 2025 19:58:57 -0500 Subject: [PATCH] Add --computers from smb to ldap --- nxc/protocols/ldap.py | 10 ++++++++++ nxc/protocols/ldap/proto_args.py | 1 + 2 files changed, 11 insertions(+) diff --git a/nxc/protocols/ldap.py b/nxc/protocols/ldap.py index 4209a44d7..4a015aa48 100644 --- a/nxc/protocols/ldap.py +++ b/nxc/protocols/ldap.py @@ -20,6 +20,7 @@ UF_TRUSTED_FOR_DELEGATION, UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION, UF_SERVER_TRUST_ACCOUNT, + SAM_MACHINE_ACCOUNT, ) from impacket.krb5 import constants from impacket.krb5.kerberosv5 import getKerberosTGS, SessionKeyDecryptionError @@ -698,6 +699,15 @@ def groups(self): self.logger.debug("Exception:", exc_info=True) self.logger.debug(f"Skipping item, cannot process due to error {e}") + def computers(self): + resp = self.search(f"(sAMAccountType={SAM_MACHINE_ACCOUNT})", ["name"], 0) + resp_parse = parse_result_attributes(resp) + + if resp: + self.logger.display(f"Total records returned: {len(resp_parse)}") + for item in resp_parse: + self.logger.highlight(item["name"] + "$") + def dc_list(self): # Building the search filter resolv = resolver.Resolver() diff --git a/nxc/protocols/ldap/proto_args.py b/nxc/protocols/ldap/proto_args.py index 8cb3ebe83..0dc21126f 100644 --- a/nxc/protocols/ldap/proto_args.py +++ b/nxc/protocols/ldap/proto_args.py @@ -23,6 +23,7 @@ def proto_args(parser, parents): vgroup.add_argument("--admin-count", action="store_true", help="Get objets that had the value adminCount=1") vgroup.add_argument("--users", nargs="*", help="Enumerate enabled domain users") vgroup.add_argument("--groups", nargs="?", const="", help="Enumerate domain groups, if a group is specified than its members are enumerated") + vgroup.add_argument("--computers", action="store_true", help="Enumerate domain computers") vgroup.add_argument("--dc-list", action="store_true", help="Enumerate Domain Controllers") vgroup.add_argument("--get-sid", action="store_true", help="Get domain sid") vgroup.add_argument("--active-users", nargs="*", help="Get Active Domain Users Accounts")