New module to list active user accounts with Password Never Expires #1036
Conversation
…nabled Signed-off-by: Daahtk <61582785+DaahtKing@users.noreply.github.com>
DaahtKing
requested review from
Marshall-Hallenbeck,
NeffIsBack,
mpgn and
zblurx
as code owners
|
Thanks for the PR, but (un-)fortunately this functionality already exists. |
|
These are two differents things @NeffIsBack :
|
Thanks for pointing it out, i can't read apparently. Should have compared the bits that are queried. @DaahtKing please substitute the bits with the constants from impacket. E.g. see: Line 1001 in 69c87d2 |
NeffIsBack
left a comment
NeffIsBack
left a comment
There was a problem hiding this comment.
Quick review :)
I think a formatted output such as --users has would be nice as well, see:
Lines 781 to 788 in 69c87d2
| def ldap_time_to_datetime(self, ldap_time): | ||
| """Convert an LDAP timestamp to a datetime object.""" | ||
| if ldap_time == "0": | ||
| return "Never" | ||
| try: | ||
| epoch = datetime(1601, 1, 1) + timedelta(seconds=int(ldap_time) / 10000000) | ||
| return epoch.strftime("%Y-%m-%d %H:%M:%S") | ||
| except Exception: | ||
| return "Conversion Error" |
There was a problem hiding this comment.
Please use the connection.getUnixTime() function for conversion. E.g.:
Line 785 in 69c87d2
| context.log.debug(f"Search Filter={search_filter}") | ||
|
|
||
| # Executing the LDAP query | ||
| resp = connection.ldap_connection.search( |
There was a problem hiding this comment.
Please use the internal connection.search function. Debug logging for attributes, error handling etc is also handled in there.
|
|
||
| if not resp: | ||
| context.log.display("No accounts found with Password Never Expires") | ||
| return True |
There was a problem hiding this comment.
Just do a normal return, nothing checks if the module has executed "successfully" or not.
| for item in resp: | ||
| if "attributes" not in item: | ||
| continue | ||
|
|
||
| account_data = {} | ||
|
|
||
| for attribute in item["attributes"]: | ||
| attr_type = str(attribute["type"]) | ||
|
|
||
| if attr_type == "sAMAccountName": | ||
| account_data['username'] = str(attribute["vals"][0]) | ||
| elif attr_type == "distinguishedName": | ||
| account_data['dn'] = str(attribute["vals"][0]) | ||
| elif attr_type == "userAccountControl": | ||
| account_data['uac'] = int(attribute["vals"][0]) | ||
| elif attr_type == "whenCreated": | ||
| account_data['created'] = str(attribute["vals"][0]) | ||
| elif attr_type == "pwdLastSet" and attribute["vals"]: | ||
| pwd_last_set = str(attribute["vals"][0]) | ||
| account_data['pwdLastSet'] = self.ldap_time_to_datetime(pwd_last_set) | ||
| elif attr_type == "description" and attribute["vals"]: | ||
| account_data['description'] = str(attribute["vals"][0]) | ||
|
|
||
| if 'username' in account_data: | ||
| accounts.append(account_data) |
There was a problem hiding this comment.
Please use the parse_result_attributes function.
| # Saving and displaying results | ||
| if accounts: | ||
| account_count = len(accounts) | ||
| filename = f"{NXC_PATH}/logs/{connection.domain}.pwd_never_expires.txt" |
There was a problem hiding this comment.
Please use the "NXC_PATH/modules/<module_name>" path
| return False | ||
|
|
||
| return True |
There was a problem hiding this comment.
These returns can be removed
| "(!(userAccountControl:1.2.840.113556.1.4.803:=2))" | ||
| "(userAccountControl:1.2.840.113556.1.4.803:=65536))") |
There was a problem hiding this comment.
Please use constants form impacket, e.g. "UF_ACCOUNTDISABLE"
3 participants
New module to list active user accounts with Password Never Expires :