echo -e "

_ __ ___ ____

| |(_)_ __\ \ / (_)_ __ | _ \__ ___ __

| || | '_ \ \ /\ / /| | '_ \| |_) \ \ /\ / | '_ \

| || | | | |\ V V / | | | | | __/ \ V V /| | | |

|_||_|_| |_| \_/\_/ |_|_| |_|_| \_/\_/ |_| |_|

${BLUE}linWinPwn: ${CYAN}version 1.0.12 ${NC}

https://github.com/lefayjey/linWinPwn

${BLUE}Author: ${CYAN}lefayjey${NC}

${BLUE}Inspired by: ${CYAN}S3cur3Th1sSh1t's WinPwn${NC}

"

print_banner

echo -e "${YELLOW}Parameters${NC}"

echo -e "-h/--help Show the help message"

echo -e "-t/--target IP Address of Target Domain Controller ${RED}[MANDATORY]${NC}"

echo -e "-d/--domain Domain of user (default: empty)"

echo -e "-u/--username Username (default: empty)"

echo -e "-p Password (NTLM authentication only) (default: empty)"

echo -e "-H LM:NT (NTLM authentication only) (default: empty)"

echo -e "-K Location to Kerberos ticket './krb5cc_ticket' (Kerberos authentication only) (default: empty)"

echo -e "-A AES Key (Kerberos authentication only) (default: empty)"

echo -e "-C Location to PFX Certificate './cert.pfx' (default: empty)"

echo -e "--cert-pass Password of provided PFX Certificate (optional)"

echo -e "--auto Run automatic enumeration"

echo -e "-o/--output Output directory (default: current dir)"

echo -e "--auto-config Run NTP sync with target DC and adds entry to /etc/hosts"

echo -e "--ldaps Use LDAPS instead of LDAP (port 636)"

echo -e "--force-kerb Use Kerberos authentication instead of NTLM when possible (requires password or NTLM hash)"

echo -e "--verbose Enable all verbose and debug outputs"

echo -e "-I/--interface Attacker's network interface (default: eth0)"

echo -e "-T/--targets Target systems for Vuln Scan, SMB Scan and Pwd Dump (default: Domain Controllers)"

echo -e " ${CYAN}Choose between:${NC} DC (Domain Controllers), All (All domain servers), File='path_to_file' (File containing list of servers), IP='IP_or_hostname' (IP or hostname)"

echo -e ""

echo -e "${YELLOW}Example usages${NC}"

echo -e "$(pwd)/$(basename "$0") -t dc_ip ${CYAN}(No password for anonymous login)${NC}" >&2;

echo -e "$(pwd)/$(basename "$0") -t dc_ip -d domain -u user [-p password or -H hash or -K kerbticket]" >&2;

echo -e ""

if [ -z "$dc_ip" ] ; then

echo -e "${RED}[-] Missing target... ${NC}"

if [ ! -z "$domain" ] ; then

dig_ip=$(dig +short ${domain})

if [ ! -z "$dig_ip" ]; then echo -e "${YELLOW}[i]${NC} Provided domain resolves to ${dig_ip}! Try again with ${YELLOW}-t $dig_ip${NC}"; fi

fi

echo -e "${YELLOW}[i]${NC} Use -h for more help"

exit 1

elif [[ ! $dc_ip =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then

echo -e "${RED}[-] Target is not an IP address... ${NC}"

dig_ip=$(dig +short ${dc_ip})

if [ ! -z "$dig_ip" ]; then echo -e "${YELLOW}[i]${NC} Provided target resolves to ${dig_ip}! Try again with ${YELLOW}-t $dig_ip${NC}"; fi

if [ ! -z "$domain" ] ; then

dig_ip=$(dig +short ${domain})

if [ ! -z "$dig_ip" ]; then echo -e "${YELLOW}[i]${NC} Provided domain resolves to ${dig_ip}! Try again with ${YELLOW}-t $dig_ip${NC}"; fi

fi

echo -e "${YELLOW}[i]${NC} Use -h for more help"

exit 1

fi

echo -e "${GREEN}[+] $(date)${NC}"

if [ ! -f "${netexec}" ] ; then

echo -e "${RED}[-] Please ensure netexec is installed and try again... ${NC}"

exit 1

else

dc_info=$(${netexec} smb ${dc_ip})

fi

dc_NETBIOS=$(echo $dc_info| cut -d ":" -f 2 | sed "s/) (domain//g" | head -n 1)

dc_domain=$(echo $dc_info | cut -d ":" -f 3 | sed "s/) (signing//g"| head -n 1)

dc_FQDN=${dc_NETBIOS}"."${dc_domain}

if [ -z "$dc_info" ] ; then

echo -e "${RED}[-] Error connecting to target! Please ensure the target is a Domain Controller and try again... ${NC}"

exit 1

elif [ -z "$dc_domain" ]; then

echo -e "${RED}[-] Error finding DC's domain, please specify domain... ${NC}"

exit 1

else

if [ -z "$domain" ]; then domain=$dc_domain; fi

fi

dc_open_ports=$(${nmap} -n -Pn -p 135,445,389,636 ${dc_ip} -sT -T5 --open)

if [[ $dc_open_ports == *"135/tcp"* ]]; then dc_port_135="${GREEN}open${NC}"; else dc_port_135="${RED}filtered|closed${NC}"; fi

if [[ $dc_open_ports == *"445/tcp"* ]]; then dc_port_445="${GREEN}open${NC}"; else dc_port_445="${RED}filtered|closed${NC}"; fi

if [[ $dc_open_ports == *"389/tcp"* ]]; then dc_port_389="${GREEN}open${NC}"; else dc_port_389="${RED}filtered|closed${NC}"; fi

if [[ $dc_open_ports == *"636/tcp"* ]]; then dc_port_636="${GREEN}open${NC}"; else dc_port_636="${RED}filtered|closed${NC}"; fi

if [ "${autoconfig_bool}" == true ]; then

echo -e "${BLUE}[*] NTP and /etc/hosts auto-config... ${NC}"

sudo timedatectl set-ntp 0

sudo ntpdate ${dc_ip}

if [[ ! $(grep ${dc_ip} "/etc/hosts" 2>/dev/null) ]]; then

echo -e "# /etc/hosts entry added by linWinPwn" | sudo tee -a /etc/hosts

echo -e "${dc_ip}\t${dc_domain} ${dc_FQDN} ${dc_NETBIOS}" | sudo tee -a /etc/hosts

else

echo -e "${PURPLE}[-] Target IP already present in /etc/hosts... ${NC}"

fi

fi

if [ "${user}" == "" ]; then user_out="null"; else user_out=${user}; fi

output_dir="${output_dir}/linWinPwn_${dc_domain}_${user_out}"

command_log="$output_dir/$(date +%Y-%m-%d)_command.log"

servers_ip_list="${output_dir}/DomainRecon/Servers/ip_list_${dc_domain}.txt"

dc_ip_list="${output_dir}/DomainRecon/Servers/dc_ip_list_${dc_domain}.txt"

sql_ip_list="${output_dir}/DomainRecon/Servers/sql_ip_list_${dc_domain}.txt"

servers_hostname_list="${output_dir}/DomainRecon/Servers/servers_list_${dc_domain}.txt"

dc_hostname_list="${output_dir}/DomainRecon/Servers/dc_list_${dc_domain}.txt"

sql_hostname_list="${output_dir}/DomainRecon/Servers/sql_list_${dc_domain}.txt"

custom_servers_list="${output_dir}/DomainRecon/Servers/custom_servers_list_${dc_domain}.txt"

target=${dc_ip}

target_servers=${servers_ip_list}

target_dc=${dc_ip_list}

target_sql=${sql_ip_list}

mkdir -p ${output_dir}/ADCS

mkdir -p ${output_dir}/BruteForce

mkdir -p ${output_dir}/Credentials

mkdir -p ${output_dir}/CommandExec

mkdir -p ${output_dir}/DomainRecon/Servers

mkdir -p ${output_dir}/DomainRecon/Users

mkdir -p ${output_dir}/Kerberos

mkdir -p ${output_dir}/Modification

mkdir -p ${output_dir}/Scans

mkdir -p ${output_dir}/Shares

mkdir -p ${output_dir}/Vulnerabilities

if [ ! -f ${servers_ip_list} ]; then /bin/touch ${servers_ip_list}; fi

if [ ! -f ${servers_hostname_list} ]; then /bin/touch ${servers_hostname_list}; fi

if [ ! -f ${dc_ip_list} ]; then /bin/touch ${dc_ip_list}; fi

if [ ! -f ${dc_hostname_list} ]; then /bin/touch ${dc_hostname_list}; fi

if [ ! -f "${user_wordlist}" ] ; then

echo -e "${RED}[-] Users list file not found${NC}"

fi

if [ ! -f "${pass_wordlist}" ] ; then

echo -e "${RED}[-] Passwords list file not found${NC}"

fi

echo -e ""

if [[ $targets == "DC" ]]; then

curr_targets="Domain Controllers"

elif [[ $targets == "All" ]]; then

curr_targets="All domain servers"

elif [[ $targets == "File="* ]]; then

curr_targets="File containing list of servers"

/bin/rm ${custom_servers_list} 2>/dev/null

custom_servers=$(echo $targets | cut -d "=" -f 2)

/bin/cp $custom_servers ${custom_servers_list} 2>/dev/null

if [ ! -s "${custom_servers_list}" ] ; then

echo -e "${RED}Invalid servers list.${NC} Choosing Domain Controllers as targets instead."

curr_targets="Domain Controllers"

custom_servers=""

fi

elif [[ $targets == "IP="* ]]; then

curr_targets="IP or hostname"

custom_ip=$(echo $targets | cut -d "=" -f 2)

/bin/rm ${custom_servers_list} 2>/dev/null

echo -n $custom_ip > ${custom_servers_list} 2>/dev/null

if [ ! -s "${custom_servers_list}" ] ; then

echo -e "${RED}Invalid servers list.${NC} Choosing Domain Controllers as targets instead."

curr_targets="Domain Controllers"

custom_ip=""

fi

else

echo -e "${RED}[-] Error invalid targets parameter. Choose between DC, All, File='./custom_list' or IP=IP_or_hostname... ${NC}"

exit 1

fi

#Check if null session or empty password is used

if [ "${pass_bool}" == false ] && [ "${hash_bool}" == false ] && [ "${kerb_bool}" == false ] && [ "${aeskey_bool}" == false ] && [ "${cert_bool}" == false ]; then

if [ ! "${user}" == "" ]; then

echo -e "${RED}[i]${NC} Please specify password, NTLM hash, Kerberos ticket, AES key or certificate and try again..."

exit 1

else

nullsess_bool=true

rand_user=$(tr -dc A-Za-z0-9 </dev/urandom | head -c 10; echo)

argument_ne="-d ${domain} -u '' -p ''"

argument_smbmap="-d ${domain} -u '' -p ''"

argument_manspider="-d ${domain} -u '' -p ''"

argument_coercer="-d ${domain} -u '' -p ''"

argument_bloodyad="-d ${domain} -u '' -p ''"

argument_privexchange="-d ${domain} -u '' -p ''"

argument_windap="-d ${domain}"

argument_adidns=""

argument_ldd=""

argument_silenthd=""

argument_enum4linux=""

argument_imp="${domain}/"

argument_imp_gp="${domain}/"

argument_ldeep="-d ${dc_domain} -a"

argument_pre2k="-d ${domain}"

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}null session ${NC}"

fi

#Check if username is not provided

elif [ "${user}" == "" ]; then

echo -e "${RED}[i]${NC} Please specify username and try again..."

exit 1

fi

#Check if password is used

if [ "${pass_bool}" == true ] ; then

argument_ne="-d ${domain} -u ${user} -p ${password}"

argument_imp="${domain}/${user}:${password}"

argument_imp_gp="${domain}/${user}:${password}"

argument_imp_ti="-user ${user} -password ${password} -domain ${domain}"

argument_bhd="-u ${user}\\@${domain} -p ${password} --auth-method ntlm"

argument_enum4linux="-w ${domain} -u ${user} -p ${password}"

argument_adidns="-u ${domain}\\\\${user} -p ${password}"

argument_ldd="-u ${domain}\\\\${user} -p ${password}"

argument_smbmap="-d ${domain} -u ${user} -p ${password}"

argument_certi_py="${domain}/${user}:${password}"

argument_certipy="-u ${user}\\@${domain} -p ${password}"

argument_ldeep="-d ${domain} -u ${user} -p ${password}"

argument_pre2k="-d ${domain} -u ${user} -p ${password}"

argument_certsync="-d ${domain} -u ${user} -p ${password}"

argument_donpapi="${domain}/${user}:${password}"

argument_hekatomb="${domain}/${user}:${password}"

argument_silenthd="-u ${domain}\\\\${user} -p ${password}"

argument_windap="-d ${domain} -u ${user} -p ${password}"

argument_targkerb="-d ${domain} -u ${user} -p ${password}"

argument_p0dalirius="-d ${domain} -u ${user} -p ${password}"

argument_manspider="-d ${domain} -u ${user} -p ${password}"

argument_coercer="-d ${domain} -u ${user} -p ${password}"

argument_bloodyad="-d ${domain} -u ${user} -p ${password}"

argument_aced="${domain}/${user}:${password}"

argument_sccm="-d ${domain} -u ${user} -p ${password}"

argument_ldapper="-D ${domain} -U ${user} -P ${password}"

argument_adalanche="--authmode ntlm --username ${user}\\@${domain} --password ${password}"

argument_mssqlrelay="-u ${user}\\@${domain} -p ${password}"

argument_pygpoabuse="${domain}/${user}:${password}'"

argument_GPOwned="-d ${domain} -u ${user} -p ${password}"

argument_privexchange="-d ${domain} -u ${user} -p ${password}"

argument_adpeas="-d ${domain} -u ${user} -p ${password}"

argument_adcheck="-d ${domain} -u ${user} -p ${password}"

hash_bool=false

kerb_bool=false

unset KRB5CCNAME

aeskey_bool=false

cert_bool=false

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}password of ${user}${NC}"

fi

#Check if NTLM hash is used, and complete with empty LM hash / Check if Certificate is provided for PKINIT

if [ "${hash_bool}" == true ] || [ "${cert_bool}" == true ]; then

if [ "${cert_bool}" == true ]; then

echo -e "${YELLOW}[!]${NC} WARNING only ldeep and bloodyAD currently support certificate authentication.${NC}"

echo -e "${YELLOW}[!]${NC} Extracting the NTLM hash of the user using PKINIT and using PtH for all other tools${NC}"

pkinit_auth

$(which openssl) pkcs12 -in "${pfxcert}" -out "${output_dir}/Credentials/${user}.pem" -nodes -passin pass:""

if [ -f "${output_dir}/Credentials/${user}.pem" ]; then

pem_cert="${output_dir}/Credentials/${user}.pem"

echo -e "${GREEN}[+] PFX Certificate converted to PEM successfully:${NC} ${output_dir}/Credentials/${user}.pem"

fi

argument_bloodyad="-d ${domain} -u ${user} -c :${pem_cert}"

argument_ldeep="-d ${domain} -u ${user} --pfx-file ${pfxcert}"

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}Certificate of $user located at $(realpath $pfxcert)${NC}"

hash_bool=true

else

if ([ "${#hash}" -eq 65 ] && [ "$(expr substr $hash 33 1)" == ":" ]) || ([ "${#hash}" -eq 33 ] && [ "$(expr substr $hash 1 1)" == ":" ]) || ([ "${#hash}" -eq 32 ] ); then

if [ "$(echo $hash | grep ':' )" == "" ] ; then

hash=":"$hash

fi

if [ "$(echo $hash | cut -d ":" -f 1)" == "" ] ; then

hash="aad3b435b51404eeaad3b435b51404ee"$hash

fi

argument_ne="-d ${domain} -u ${user} -H ${hash}"

argument_imp=" -hashes ${hash} ${domain}/${user}"

argument_imp_gp=" -hashes ${hash} ${domain}/${user}"

argument_imp_ti="-user ${user} -hashes ${hash} -domain ${domain}"

argument_bhd="-u ${user}\\@${domain} --hashes ${hash} --auth-method ntlm"

argument_enum4linux="-w ${domain} -u ${user} -H $(expr substr $hash 34 65)"

argument_adidns="-u ${domain}\\\\${user} -p ${hash}"

argument_ldd="-u ${domain}\\\\${user} -p ${hash}"

argument_smbmap="-d ${domain} -u ${user} -p ${hash}"

argument_certi_py="${domain}/${user} --hashes ${hash}"

argument_certipy="-u ${user}\\@${domain} -hashes ${hash}"

argument_pre2k="-d ${domain} -u ${user} -hashes ${hash}"

argument_certsync="-d ${domain} -u ${user} -hashes ${hash}"

argument_donpapi=" -H ${hash} ${domain}/${user}"

argument_hekatomb="-hashes ${hash} ${domain}/${user}"

argument_silenthd="-u ${domain}\\\\${user} --hashes ${hash}"

argument_windap="-d ${domain} -u ${user} --hash ${hash}"

argument_targkerb="-d ${domain} -u ${user} -H ${hash}"

argument_p0dalirius="-d ${domain} -u ${user} -H $(expr substr $hash 34 65)"

argument_manspider="-d ${domain} -u ${user} -H $(expr substr $hash 34 65)"

argument_coercer="-d ${domain} -u ${user} --hashes ${hash}"

argument_aced=" -hashes ${hash} ${domain}/${user}"

argument_sccm="-d ${domain} -u ${user} -hashes ${hash}"

argument_ldapper="-D ${domain} -U ${user} -P ${hash}"

argument_ldeep="-d ${domain} -u ${user} -H ${hash}"

argument_bloodyad="-d ${domain} -u ${user} -p ${hash}"

argument_adalanche="--authmode ntlmpth --username ${user}\\@${domain} --password ${hash}"

argument_mssqlrelay="-u ${user}\\@${domain} -hashes ${hash}"

argument_pygpoabuse=" -hashes ${hash} ${domain}/${user}"

argument_GPOwned="-d ${domain} -u ${user} -hashes ${hash}"

argument_privexchange="-d ${domain} -u ${user} --hashes ${hash}"

argument_adcheck="-d ${domain} -u ${user} -H ${hash}"

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}NTLM hash of ${user}${NC}"

else

echo -e "${RED}[i]${NC} Incorrect format of NTLM hash..."

exit 1

fi

fi

pass_bool=false

kerb_bool=false

unset KRB5CCNAME

aeskey_bool=false

fi

#Check if kerberos ticket is used

if [ "${kerb_bool}" == true ] ; then

argument_ne="-d ${domain} -u ${user} --use-kcache"

pass_bool=false

hash_bool=false

aeskey_bool=false

cert_bool=false

forcekerb_bool=false

if [ -f "${krb5cc}" ] ; then

target=${dc_FQDN}

target_dc=${dc_hostname_list}

target_sql=${sql_hostname_list}

target_servers=${servers_hostname_list}

export KRB5CCNAME=$(realpath $krb5cc)

argument_imp="-k -no-pass ${domain}/${user}"

argument_enum4linux="-w ${domain} -u ${user} -K ${krb5cc}"

argument_bhd="-u ${user}\\@${domain} -k -no-pass -p '' --auth-method kerberos"

argument_certi_py="${domain}/${user} -k --no-pass"

argument_certipy="-u ${user}\\@${domain} -k -no-pass -target ${dc_FQDN}"

argument_ldeep="-d ${domain} -u ${user} -k"

argument_pre2k="-d ${domain} -u ${user} -k -no-pass"

argument_certsync="-d ${domain} -u ${user} -use-kcache -no-pass -k"

argument_donpapi="-k -no-pass ${domain}/${user}"

argument_targkerb="-d ${domain} -u ${user} -k --no-pass"

argument_p0dalirius="-d ${domain} -u ${user} -k --no-pass"

argument_bloodyad="-d ${domain} -u ${user} -k"

argument_aced="-k -no-pass ${domain}/${user}"

argument_sccm="-d ${domain} -u ${user} -k --no-pass"

argument_mssqlrelay="-u ${user}\\@${domain} -k -no-pass"

argument_pygpoabuse="${domain}/${user} -k -ccache $(realpath $krb5cc)"

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}Kerberos Ticket of $user located at $(realpath $krb5cc)${NC}"

else

echo -e "${RED}[i]${NC} Error accessing provided Kerberos ticket $(realpath $krb5cc)..."

exit 1

fi

fi

#Check if kerberos AES key is used

if [ "${aeskey_bool}" == true ] ; then

target=${dc_FQDN}

target_dc=${dc_hostname_list}

target_sql=${sql_hostname_list}

target_servers=${servers_hostname_list}

argument_ne="-d ${domain} -u ${user} --aesKey ${aeskey}"

argument_imp="-aesKey ${aeskey} ${domain}/${user}"

argument_bhd="-u ${user}\\@${domain} -aesKey ${aeskey} --auth-method kerberos"

argument_certi_py="${domain}/${user} --aes ${aeskey} -k"

argument_certipy="-u ${user}\\@${domain} -aes ${aeskey} -target ${dc_FQDN}"

argument_pre2k="-d ${domain} -u ${user} -aes ${aeskey} -k"

argument_certsync="-d ${domain} -u ${user} -aesKey ${aeskey} -k"

argument_donpapi="-k -aesKey ${aeskey} ${domain}/${user}"

argument_targkerb="-d ${domain} -u ${user} --aes-key ${aeskey} -k"

argument_p0dalirius="-d ${domain} -u ${user} --aes-key ${aeskey} -k"

argument_aced="-aes ${aeskey} ${domain}/${user}"

argument_sccm="-d ${domain} -u ${user} -aes ${aeskey}"

argument_mssqlrelay="-u ${user}\\@${domain} -aes ${aeskey} -k"

pass_bool=false

hash_bool=false

kerb_bool=false

unset KRB5CCNAME

cert_bool=false

forcekerb_bool=false

auth_string="${YELLOW}[i]${NC} Authentication method: ${YELLOW}AES Kerberos key of ${user}${NC}"

fi

#Perform authentication using provided credentials

if [ "${nullsess_bool}" == false ] ; then

auth_check=$(run_command "${netexec} smb ${target} ${argument_ne}" 2>&1| grep "\[-\]\|Traceback" -A 10 2>&1)

if [ ! -z "$auth_check" ] ; then

echo $auth_check

if [[ $auth_check == *"STATUS_PASSWORD_MUST_CHANGE"* ]] || [[ $auth_check == *"STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"* ]]; then

if [ ! -f "${impacket_smbpasswd}" ] ; then

echo -e "${RED}[-] smbpasswd.py not found! Please verify the installation of impacket${NC}"

elif [ "${kerb_bool}" == true ] || [ "${aeskey_bool}" == true ]; then

echo -e "${PURPLE}[-] smbpasswd does not support Kerberos authentication${NC}"

else

pass_passchange=""

if [ $auth_check == *"STATUS_PASSWORD_MUST_CHANGE"* ]; then

echo -e "${BLUE}[*] Changing expired password of own user. Please specify new password:${NC}"

read -p ">> " pass_passchange </dev/tty

while [ "${pass_passchange}" == "" ] ; do

echo -e "${RED}Invalid password.${NC} Please specify password:"

read -p ">> " pass_passchange </dev/tty

done

echo -e "${CYAN}[*] Changing password of ${user} to ${pass_passchange}${NC}"

run_command "${impacket_smbpasswd} ${argument_imp}\\@${dc_ip} -newpass ${pass_passchange}" | tee -a ${output_dir}/Modification/impacket_smbpasswd_${dc_domain}.txt

elif [ $auth_check == *"STATUS_NOLOGON_WORKSTATION_TRUST_ACCOUNT"* ]; then

echo -e "${BLUE}[*] Changing password of pre created computer account. Please specify new password:${NC}"

read -p ">> " pass_passchange </dev/tty

while [ "${pass_passchange}" == "" ] ; do

echo -e "${RED}Invalid password.${NC} Please specify password:"

read -p ">> " pass_passchange </dev/tty

done

authuser_passchange=""

echo -e "${BLUE}[*] Please specify username for RPC authentication:${NC}"

read -p ">> " authuser_passchange </dev/tty

while [ "${pass_passchange}" == "" ] ; do

echo -e "${RED}Invalid username.${NC} Please specify username:"

read -p ">> " authuser_passchange </dev/tty

done

authpass_passchange=""

echo -e "${BLUE}[*] Please specify password for RPC authentication:${NC}"

read -p ">> " authpass_passchange </dev/tty

while [ "${pass_passchange}" == "" ] ; do

echo -e "${RED}Invalid password.${NC} Please specify password:"

read -p ">> " authpass_passchange </dev/tty

done

echo -e "${CYAN}[*] Changing password of ${user} to ${pass_passchange}${NC}"

run_command "${impacket_smbpasswd} ${argument_imp}\\@${dc_ip} -newpass ${pass_passchange} -altuser ${authuser_passchange} -altpass ${authpass_passchange}" | tee -a ${output_dir}/Modification/impacket_smbpasswd_${dc_domain}.txt

fi

password="${pass_passchange}"

auth_check=""

authenticate

fi

echo -e ""

fi

echo -e "${RED}[-] Error authenticating to domain! Please check your credentials and try again... ${NC}"

exit 1

fi

fi

if [ "${forcekerb_bool}" == true ] ; then

argument_ne="${argument_ne} -k"

fi

if [ "${verbose_bool}" == true ] ; then

ne_verbose="--verbose"

argument_imp="-debug ${argument_imp}"

argument_imp_gp="-debug ${argument_imp_gp}"

argument_imp_ti="-debug ${argument_imp_ti}"

argument_enum4linux="${argument_enum4linux} -v"

argument_bhd="${argument_bhd} -v"

argument_adidns="${argument_adidns} -v -d"

argument_pre2k="${argument_pre2k} -verbose"

argument_certsync="${argument_certsync} -debug"

argument_donpapi="-d ${argument_donpapi}"

argument_hekatomb="-debug ${argument_hekatomb}"

argument_windap="${argument_windap} -v --debug"

argument_targkerb="${argument_targkerb} -v"

argument_kerbrute="-v"

argument_manspider="${argument_manspider} -v"

argument_coercer="${argument_coercer} -v"

argument_CVE202233679="-debug"

argument_bloodyad="-v DEBUG ${argument_bloodyad}"

argument_aced="-debug ${argument_aced}"

argument_sccm="-debug ${argument_sccm}"

mssqlrelay_verbose="-debug"

adalanche_verbose="--loglevel Debug"

argument_pygpoabuse="${argument_pygpoabuse} -vv"

argument_privexchange="${argument_privexchange} --debug"

fi

echo -e ${auth_string}

/bin/cat ${output_dir}/DomainRecon/Servers/servers_list_*_${dc_domain}.txt 2>/dev/null | sed -e 's/ //' -e 's/\$//' -e 's/.*/\U&/' | sort -uf > ${servers_hostname_list} 2>&1

/bin/cat ${output_dir}/DomainRecon/Servers/dc_list_*_${dc_domain}.txt 2>/dev/null | sed -e 's/ //' -e 's/\$//' -e "s/$/.${dc_domain}/" -e 's/.*/\U&/' | sort -uf > ${dc_hostname_list} 2>&1

/bin/cat ${output_dir}/DomainRecon/Servers/ip_list_*_${dc_domain}.txt 2>/dev/null | sort -uf > ${servers_ip_list} 2>&1

/bin/cat ${output_dir}/DomainRecon/Servers/dc_ip_list_*_${dc_domain}.txt 2>/dev/null | sort -uf > ${dc_ip_list} 2>&1

if [[ ! $(grep ${dc_ip} ${servers_ip_list} 2>/dev/null) ]]; then echo ${dc_ip} >> ${servers_ip_list}; fi

if [[ ! $(grep ${dc_ip} ${dc_ip_list} 2>/dev/null) ]]; then echo ${dc_ip} >> ${dc_ip_list}; fi

if [[ ! $(grep ${dc_FQDN^^} ${dc_hostname_list} 2>/dev/null) ]]; then echo ${dc_FQDN,,} >> ${dc_hostname_list}; fi

if [[ ! $(grep ${dc_FQDN^^} ${servers_hostname_list} 2>/dev/null) ]]; then echo ${dc_FQDN,,} >> ${servers_hostname_list}; fi

users_list="${output_dir}/DomainRecon/Users/users_list_${dc_domain}.txt"

/bin/cat ${output_dir}/DomainRecon/Users/users_list_*_${dc_domain}.txt 2>/dev/null | sort -uf > ${users_list} 2>&1

if [[ ! "${user}" == "" ]] && [[ ! $(grep ${user} ${users_list} 2>/dev/null) ]]; then echo ${user} >> ${users_list}; fi

if [ ! -f "${adidnsdump}" ] ; then

echo -e "${RED}[-] Please verify the installation of adidnsdump${NC}"

echo -e ""

else

echo -e "${BLUE}[*] DNS dump using adidnsdump${NC}"

dns_records="${output_dir}/DomainRecon/dns_records_${dc_domain}.csv"

if [ ! -f "${dns_records}" ]; then

if [ "${kerb_bool}" == true ] || [ "${aeskey_bool}" == true ]; then

echo -e "${PURPLE}[-] adidnsdump does not support Kerberos authentication${NC}"

else

if [ "${ldaps_bool}" == true ]; then ldaps_param="--ssl"; else ldaps_param=""; fi

run_command "${adidnsdump} ${argument_adidns} ${ldaps_param} --dns-tcp ${dc_ip}" | tee ${output_dir}/DomainRecon/adidnsdump_output_${dc_domain}.txt

mv records.csv ${output_dir}/DomainRecon/dns_records_${dc_domain}.csv 2>/dev/null

/bin/cat ${output_dir}/DomainRecon/dns_records_${dc_domain}.csv 2>/dev/null | grep "A," | grep -v "DnsZones\|@" | cut -d "," -f 2 | sort -u | grep "\S" | sed -e "s/$/.${dc_domain}/" > ${output_dir}/DomainRecon/Servers/servers_list_dns_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/dns_records_${dc_domain}.csv 2>/dev/null | grep "A," | grep -v "DnsZones\|@" | cut -d "," -f 3 > ${output_dir}/DomainRecon/Servers/ip_list_dns_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/dns_records_${dc_domain}.csv 2>/dev/null | grep "@" | grep "NS," | cut -d "," -f 3 | sed 's/\.$//' > ${output_dir}/DomainRecon/Servers/dc_list_dns_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/dns_records_${dc_domain}.csv 2>/dev/null | grep "@" | grep "A," | cut -d "," -f 3 > ${output_dir}/DomainRecon/Servers/dc_ip_list_dns_${dc_domain}.txt

fi

parse_servers

else

parse_servers

echo -e "${YELLOW}[i] DNS dump found ${NC}"

fi

fi

echo -e ""

if [ ! -f "${nmap}" ]; then

echo -e "${RED}[-] Please verify the installation of nmap ${NC}"

else

if [ "${curr_targets}" == "Domain Controllers" ] ; then

servers_smb_list=${target_dc}

elif [ "${curr_targets}" == "All domain servers" ] ; then

servers_scan_list=${target_servers}

echo -e "${YELLOW}[i] Scanning all domain servers ${NC}"

servers_smb_list="${output_dir}/Scans/servers_all_smb_${dc_domain}.txt"

if [ ! -f "${servers_smb_list}" ]; then

run_command "${nmap} -p 445 -Pn -sT -n -iL ${servers_scan_list} -oG ${output_dir}/Scans/nmap_smb_scan_all_${dc_domain}.txt" 1>/dev/null 2>&1

grep -a "open" ${output_dir}/Scans/nmap_smb_scan_all_${dc_domain}.txt 2>/dev/null | cut -d " " -f 2 > ${servers_smb_list}

else

echo -e "${YELLOW}[i] SMB nmap scan results found ${NC}"

fi

elif [ "${curr_targets}" == "File containing list of servers" ] ; then

servers_scan_list=${custom_servers_list}

echo -e "${YELLOW}[i] Scanning servers in ${custom_servers} ${NC}"

servers_smb_list="${output_dir}/Scans/servers_custom_smb_${dc_domain}.txt"

if [ "${custom_target_scanned}" == false ]; then

run_command "${nmap} -p 445 -Pn -sT -n -iL ${servers_scan_list} -oG ${output_dir}/Scans/nmap_smb_scan_custom_${dc_domain}.txt" 1>/dev/null 2>&1

grep -a "open" ${output_dir}/Scans/nmap_smb_scan_custom_${dc_domain}.txt 2>/dev/null | cut -d " " -f 2 > ${servers_smb_list}

custom_target_scanned=true

else

echo -e "${YELLOW}[i] SMB nmap scan results found ${NC}"

fi

elif [ "${curr_targets}" == "IP or hostname" ] ; then

servers_scan_list=$(head -n1 ${custom_servers_list})

echo -e "${YELLOW}[i] Scanning server ${custom_ip}${NC}"

servers_smb_list="${output_dir}/Scans/servers_custom_smb_${dc_domain}.txt"

if [ "${custom_target_scanned}" == false ]; then

run_command "${nmap} -p 445 -Pn -sT -n ${servers_scan_list} -oG ${output_dir}/Scans/nmap_smb_scan_custom_${dc_domain}.txt" 1>/dev/null 2>&1

grep -a "open" ${output_dir}/Scans/nmap_smb_scan_custom_${dc_domain}.txt 2>/dev/null | cut -d " " -f 2 > ${servers_smb_list}

custom_target_scanned=true

else

echo -e "${YELLOW}[i] SMB nmap scan results found ${NC}"

fi

fi

fi

if [ ! -f "${bloodhound}" ] ; then

echo -e "${RED}[-] Please verify the installation of bloodhound${NC}"

else

mkdir -p ${output_dir}/DomainRecon/BloodHound

echo -e "${BLUE}[*] BloodHound Enumeration using all collection methods (Noisy!)${NC}"

if [ -n "$(ls -A ${output_dir}/DomainRecon/BloodHound/ 2>/dev/null | grep -v 'bloodhound_output')" ] ; then

echo -e "${YELLOW}[i] BloodHound results found, skipping... ${NC}"

else

if [ "${nullsess_bool}" == true ] ; then

echo -e "${PURPLE}[-] BloodHound requires credentials${NC}"

else

current_dir=$(pwd)

cd ${output_dir}/DomainRecon/BloodHound

run_command "${bloodhound} -d ${dc_domain} ${argument_bhd} -c all,LoggedOn -ns ${dc_ip} --dns-timeout 5 --dns-tcp" | tee ${output_dir}/DomainRecon/BloodHound/bloodhound_output_${dc_domain}.txt

cd ${current_dir}

#${netexec} ${ne_verbose} ldap ${ne_kerb} ${target} "${argument_ne}" --bloodhound -ns ${dc_ip} -c All --log ${output_dir}/DomainRecon/BloodHound/ne_bloodhound_output_${dc_domain}.txt 2>&1

/usr/bin/jq -r ".data[].Properties.samaccountname| select( . != null )" ${output_dir}/DomainRecon/BloodHound/*_users.json 2>/dev/null > ${output_dir}/DomainRecon/Users/users_list_bhd_${dc_domain}.txt

/usr/bin/jq -r ".data[].Properties.name| select( . != null )" ${output_dir}/DomainRecon/BloodHound/*_computers.json 2>/dev/null > ${output_dir}/DomainRecon/Servers/servers_list_bhd_${dc_domain}.txt

/usr/bin/jq -r '.data[].Properties | select(.serviceprincipalnames | . != null) | select (.serviceprincipalnames[] | contains("MSSQL")).serviceprincipalnames[]' ${output_dir}/DomainRecon/BloodHound/*_users.json 2>/dev/null | cut -d "/" -f 2 | cut -d ":" -f 1 | sort -u > ${output_dir}/DomainRecon/Servers/sql_list_bhd_${dc_domain}.txt

parse_users

parse_servers

fi

fi

fi

echo -e ""

if [ ! -f "${bloodhound}" ] ; then

echo -e "${RED}[-] Please verify the installation of bloodhound${NC}"

else

mkdir -p ${output_dir}/DomainRecon/BloodHound

echo -e "${BLUE}[*] BloodHound Enumeration using DCOnly${NC}"

if [ -n "$(ls -A ${output_dir}/DomainRecon/BloodHound/ 2>/dev/null | grep -v 'bloodhound_output')" ] ; then

echo -e "${YELLOW}[i] BloodHound results found, skipping... ${NC}"

else

if [ "${nullsess_bool}" == true ] ; then

echo -e "${PURPLE}[-] BloodHound requires credentials${NC}"

else

current_dir=$(pwd)

cd ${output_dir}/DomainRecon/BloodHound

run_command "${bloodhound} -d ${dc_domain} ${argument_bhd} -c DCOnly -ns ${dc_ip} --dns-timeout 5 --dns-tcp" | tee ${output_dir}/DomainRecon/BloodHound/bloodhound_output_dconly_${dc_domain}.txt

cd ${current_dir}

#${netexec} ${ne_verbose} ldap ${target} "${argument_ne}" --bloodhound -ns ${dc_ip} -c DCOnly --log tee ${output_dir}/DomainRecon/BloodHound/ne_bloodhound_output_${dc_domain}.txt 2>&1

/usr/bin/jq -r ".data[].Properties.samaccountname| select( . != null )" ${output_dir}/DomainRecon/BloodHound/*_users.json 2>/dev/null > ${output_dir}/DomainRecon/Users/users_list_bhd_${dc_domain}.txt

/usr/bin/jq -r ".data[].Properties.name| select( . != null )" ${output_dir}/DomainRecon/BloodHound/*_computers.json 2>/dev/null > ${output_dir}/DomainRecon/Servers/servers_list_bhd_${dc_domain}.txt

parse_users

parse_servers

fi

fi

fi

echo -e ""

if [ ! -f "${ldapdomaindump}" ] ; then

echo -e "${RED}[-] Please verify the installation of ldapdomaindump${NC}"

else

mkdir -p ${output_dir}/DomainRecon/LDAPDomainDump

echo -e "${BLUE}[*] ldapdomaindump Enumeration${NC}"

if [ -n "$(ls -A ${output_dir}/DomainRecon/LDAPDomainDump/ 2>/dev/null | grep -v 'ldd_output')" ] ; then

echo -e "${YELLOW}[i] ldapdomaindump results found, skipping... ${NC}"

else

if [ "${kerb_bool}" == true ] || [ "${aeskey_bool}" == true ] ; then

echo -e "${PURPLE}[-] ldapdomaindump does not support Kerberos authentication ${NC}"

else

if [ "${ldaps_bool}" == true ]; then ldaps_param="ldaps"; else ldaps_param="ldap"; fi

run_command "${ldapdomaindump} ${argument_ldd} ${ldaps_param}://${dc_ip} -o ${output_dir}/DomainRecon/LDAPDomainDump" | tee "${output_dir}/DomainRecon/LDAPDomainDump/ldd_output_${dc_domain}.txt"

fi

/usr/bin/jq -r ".[].attributes.sAMAccountName[]" ${output_dir}/DomainRecon/LDAPDomainDump/domain_users.json 2>/dev/null > ${output_dir}/DomainRecon/Users/users_list_ldd_${dc_domain}.txt

/usr/bin/jq -r ".[].attributes.dNSHostName[]" ${output_dir}/DomainRecon/LDAPDomainDump/domain_computers.json 2>/dev/null > ${output_dir}/DomainRecon/Servers/servers_list_ldd_${dc_domain}.txt

parse_users

parse_servers

fi

fi

echo -e ""

if [ ! -f "${enum4linux_py}" ] ; then

echo -e "${RED}[-] Please verify the installation of enum4linux-ng${NC}"

else

echo -e "${BLUE}[*] enum4linux Enumeration${NC}"

if [ "${aeskey_bool}" == true ] ; then

echo -e "${PURPLE}[-] enum4linux does not support Kerberos authentication using AES Key${NC}"

else

run_command "${enum4linux_py} -A ${argument_enum4linux} ${target} -oJ ${output_dir}/DomainRecon/enum4linux_${dc_domain}" > ${output_dir}/DomainRecon/enum4linux_${dc_domain}.txt

head -n 20 ${output_dir}/DomainRecon/enum4linux_${dc_domain}.txt 2>&1

echo -e "............................(truncated output)"

/usr/bin/jq -r ".users[].username" ${output_dir}/DomainRecon/enum4linux_${dc_domain}.json 2>/dev/null > ${output_dir}/DomainRecon/Users/users_list_enum4linux_${dc_domain}.txt

if [ "${nullsess_bool}" == true ] ; then

echo -e "${CYAN}[*] Guest with empty password (null session)${NC}"

run_command "${enum4linux_py} -A ${target} -u 'Guest' -p '' -oJ ${output_dir}/DomainRecon/enum4linux_guest_${dc_domain}" > ${output_dir}/DomainRecon/enum4linux_guest_${dc_domain}.txt

head -n 20 ${output_dir}/DomainRecon/enum4linux_guest_${dc_domain}.txt 2>&1

echo -e "............................(truncated output)"

/usr/bin/jq -r ".users[].username" ${output_dir}/DomainRecon/enum4linux_guest_${dc_domain}.json 2>/dev/null > ${output_dir}/DomainRecon/Users/users_list_enum4linux_guest_${dc_domain}.txt

fi

fi

parse_users

fi

echo -e ""

echo -e "${BLUE}[*] GPP Enumeration${NC}"

run_command "${netexec} ${ne_verbose} smb ${target_dc} ${argument_ne} -M gpp_autologin -M gpp_password --log ${output_dir}/DomainRecon/ne_gpp_output_${dc_domain}.txt" 2>&1

echo -e ""

if [ "${nullsess_bool}" == true ] ; then

echo -e "${BLUE}[*] Users Enumeration (RPC Null session)${NC}"

run_command "${netexec} ${ne_verbose} smb ${target} ${argument_ne} --users --log ${output_dir}/DomainRecon/ne_users_nullsess_smb_${dc_domain}.txt" 2>&1

run_command "${netexec} ${ne_verbose} smb ${target} -u Guest -p '' --users --log ${output_dir}/DomainRecon/ne_users_nullsess_smb_${dc_domain}.txt" 2>&1

run_command "${netexec} ${ne_verbose} smb ${target} -u ${rand_user} -p '' --users --log ${output_dir}/DomainRecon/ne_users_nullsess_smb_${dc_domain}.txt" 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_users_nullsess_smb_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep SMB | sed 's/[ ][ ]*/ /g' | cut -d " " -f 10 | cut -d "\\" -f 2 > ${output_dir}/DomainRecon/Users/users_list_ne_smb_nullsess_${dc_domain}.txt 2>&1

count=$(cat ${output_dir}/DomainRecon/Users/users_list_ne_smb_nullsess_${dc_domain}.txt | sort -u | wc -l | cut -d " " -f 1)

echo -e "${GREEN}[+] Found ${count} users using RPC User Enum${NC}"

else

echo -e "${BLUE}[*] Users / Computers Enumeration (RPC authenticated)${NC}"

run_command "${netexec} ${ne_verbose} smb ${target} ${argument_ne} --users --log ${output_dir}/DomainRecon/ne_users_auth_smb_${dc_domain}.txt" 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_users_auth_smb_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep SMB | sed 's/[ ][ ]*/ /g' | cut -d " " -f 10 | cut -d "\\" -f 2 > ${output_dir}/DomainRecon/Users/users_list_ne_smb_${dc_domain}.txt 2>&1

count=$(cat ${output_dir}/DomainRecon/Users/users_list_ne_smb_${dc_domain}.txt | sort -u | wc -l | cut -d " " -f 1)

echo -e "${GREEN}[+] Found ${count} users using RPC User Enum${NC}"

run_command "${netexec} ${ne_verbose} smb ${target} ${argument_ne} --computers" > ${output_dir}/DomainRecon/ne_computers_auth_smb_${dc_domain}.txt

fi

parse_users

echo -e ""

echo -e "${BLUE}[*] Password Policy Enumeration${NC}"

run_command "${netexec} ${ne_verbose} smb ${target} ${argument_ne} --pass-pol --log ${output_dir}/DomainRecon/ne_passpol_output_${dc_domain}.txt" 2>&1

echo -e ""

if [ "${ldaps_bool}" == true ]; then ldaps_param="--port 636"; else ldaps_param=""; fi

if [ "${nullsess_bool}" == true ] ; then

echo -e "${BLUE}[*] Users Enumeration (LDAP Null session)${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} --users --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_users_nullsess_ldap_${dc_domain}.txt" 2>&1

run_command "${netexec} ${ne_verbose} ldap ${target} -u Guest -p '' ${ldaps_param} --users --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_users_nullsess_ldap_${dc_domain}.txt" 2>&1

run_command "${netexec} ${ne_verbose} ldap ${target} -u ${rand_user} -p '' ${ldaps_param} --users --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_users_nullsess_ldap_${dc_domain}.txt" 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_users_nullsess_ldap_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep LDAP | sed 's/[ ][ ]*/ /g' | cut -d " " -f 10 > ${output_dir}/DomainRecon/Users/users_list_ne_ldap_nullsess_${dc_domain}.txt 2>&1

count=$(cat ${output_dir}/DomainRecon/Users/users_list_ne_ldap_nullsess_${dc_domain}.txt | sort -u | wc -l | cut -d " " -f 1)

echo -e "${GREEN}[+] Found ${count} users using LDAP User Enum${NC}"

else

echo -e "${BLUE}[*] Users Enumeration (LDAP authenticated)${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} --users --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_users_auth_ldap_${dc_domain}.txt" 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_users_auth_ldap_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep LDAP | sed 's/[ ][ ]*/ /g' | cut -d " " -f 10 > ${output_dir}/DomainRecon/Users/users_list_ne_ldap_${dc_domain}.txt 2>&1

count=$(cat ${output_dir}/DomainRecon/Users/users_list_ne_ldap_${dc_domain}.txt | sort -u | wc -l | cut -d " " -f 1)

echo -e "${GREEN}[+] Found ${count} users using LDAP User Enum${NC}"

fi

parse_users

echo -e ""

echo -e "${BLUE}[*] DC List Enumeration${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} --dc-list --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_dclist_output_${dc_domain}.txt" 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_dclist_output_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep LDAP | sed 's/[ ][ ]*/ /g' | cut -d " " -f 10 > ${output_dir}/DomainRecon/Servers/dc_list_ne_ldap_${dc_domain}.txt 2>&1

/bin/cat ${output_dir}/DomainRecon/ne_dclist_output_${dc_domain}.txt 2>/dev/null | grep -v "\[-\|\[+\|\[\*" | grep LDAP | sed 's/[ ][ ]*/ /g' | cut -d " " -f 12 > ${output_dir}/DomainRecon/Servers/dc_ip_list_ne_ldap_${dc_domain}.txt 2>&1

parse_servers

echo -e ""

echo -e ""

echo -e "${BLUE}[*] Password not required Enumeration${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} --password-not-required --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_passnotrequired_output_${dc_domain}.txt" 2>&1

echo -e ""

echo -e "${BLUE}[*] Users Description containing word: pass${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} -M get-desc-users --kdcHost ${dc_FQDN}" 2>&1 > ${output_dir}/DomainRecon/ne_get-desc-users_pass_output_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/ne_get-desc-users_pass_output_${dc_domain}.txt 2>/dev/null | grep -i "pass\|pwd" | tee ${output_dir}/DomainRecon/ne_get-desc-users_pass_results_${dc_domain}.txt 2>&1

if [ ! -s ${output_dir}/DomainRecon/ne_get-desc-users_pass_results_${dc_domain}.txt ]; then

echo -e "${PURPLE}[-] No users with passwords in description found${NC}"

fi

echo -e ""

echo -e "${BLUE}[*] Get MachineAccountQuota${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} -M maq --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_MachineAccountQuota_output_${dc_domain}.txt" 2>&1

echo -e ""

echo -e "${BLUE}[*] Subnets Enumeration${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target} ${argument_ne} ${ldaps_param} -M subnets --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_subnets_output_${dc_domain}.txt" 2>&1

echo -e ""

echo -e "${BLUE}[*] LDAP-signing check${NC}"

run_command "${netexec} ${ne_verbose} ldap ${target_dc} ${argument_ne} ${ldaps_param} -M ldap-checker --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_ldap-checker_output_${dc_domain}.txt" 2>&1

echo -e ""

if [ ! -f "${impacket_findDelegation}" ] ; then

echo -e "${RED}[-] findDelegation.py not found! Please verify the installation of impacket${NC}"

else

echo -e "${BLUE}[*] Impacket findDelegation Enumeration${NC}"

run_command "${impacket_findDelegation} ${argument_imp} -dc-ip ${dc_ip} -target-domain ${dc_domain} -dc-host ${dc_NETBIOS}" | tee ${output_dir}/DomainRecon/impacket_findDelegation_output_${dc_domain}.txt

if [[ $(grep 'error' ${output_dir}/DomainRecon/impacket_findDelegation_output_${dc_domain}.txt 2>/dev/null) ]]; then

echo -e "${RED}[-] Errors during Delegation enum... ${NC}"

fi

fi

echo -e "${BLUE}[*] Trusted-for-delegation check (netexec)${NC}"

if [ "${ldaps_bool}" == true ]; then ldaps_param="--port 636"; else ldaps_param=""; fi

run_command "${netexec} ${ne_verbose} ldap ${target_dc} ${argument_ne} ${ldaps_param} --trusted-for-delegation --kdcHost ${dc_FQDN} --log ${output_dir}/DomainRecon/ne_trusted-for-delegation_output_${dc_domain}.txt" 2>&1

echo -e ""

if [ ! -f "${bloodyad}" ] ; then

echo -e "${RED}[-] Please verify the installation of bloodyad{NC}"

else

mkdir -p ${output_dir}/DomainRecon/bloodyAD

echo -e "${BLUE}[*] bloodyad All Enumeration${NC}"

if [ "${aeskey_bool}" == true ] || [ "${nullsess_bool}" == true ] ; then

echo -e "${PURPLE}[-] bloodyad requires credentials and does not support Kerberos authentication using AES Key${NC}"

else

if [ "${ldaps_bool}" == true ]; then ldaps_param="-s"; else ldaps_param=""; fi

domain_DN=$(fqdn_to_ldap_dn ${dc_domain})

echo -e "${CYAN}[*] Searching for attribute msDS-Behavior-Version${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get object ${domain_DN} --attr msDS-Behavior-Version" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_forestlevel_${dc_domain}.txt

echo -e "${CYAN}[*] Searching for attribute ms-DS-MachineAccountQuota${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get object ${domain_DN} --attr ms-DS-MachineAccountQuota" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_maq_${dc_domain}.txt

echo -e "${CYAN}[*] Searching for attribute minPwdLength${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get object ${domain_DN} --attr minPwdLength" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_minpasslen_${dc_domain}.txt

echo -e "${CYAN}[*] Searching for users${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get children --otype useronly" > ${output_dir}/DomainRecon/bloodyAD/bloodyad_allusers_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/bloodyAD/bloodyad_allusers_${dc_domain}.txt 2>/dev/null | cut -d "," -f 1 | cut -d "=" -f 2 | sort -u > ${output_dir}/DomainRecon/Users/users_list_bla_${dc_domain}.txt 2>/dev/null

parse_users

echo -e "${CYAN}[*] Searching for computers${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get children --otype computer" > ${output_dir}/DomainRecon/bloodyAD/bloodyad_allcomp_${dc_domain}.txt

/bin/cat ${output_dir}/DomainRecon/bloodyAD/bloodyad_allcomp_${dc_domain}.txt 2>/dev/null | cut -d "," -f 1 | cut -d "=" -f 2 | sort -u | grep "\S" | sed -e "s/$/.${dc_domain}/" > ${output_dir}/DomainRecon/Servers/servers_list_bla_${dc_domain}.txt 2>/dev/null

parse_servers

echo -e "${CYAN}[*] Searching for containers${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get children --otype container" > ${output_dir}/DomainRecon/bloodyAD/bloodyad_allcontainers_${dc_domain}.txt

echo -e "${CYAN}[*] Searching for Kerberoastable${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get search --filter '(&(samAccountType=805306368)(servicePrincipalName=*))' --attr sAMAccountName" | grep sAMAccountName | cut -d ' ' -f 2 | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_kerberoast_${dc_domain}.txt

echo -e "${CYAN}[*] Searching for ASREPRoastable${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get search --filter '(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(UserAccountControl:1.2.840.113556.1.4.803:=2)))' --attr sAMAccountName" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_asreproast_${dc_domain}.txt

fi

fi

echo -e ""

if [ ! -f "${bloodyad}" ] ; then

echo -e "${RED}[-] Please verify the installation of bloodyad{NC}"

else

mkdir -p ${output_dir}/DomainRecon/bloodyAD

if [ "${aeskey_bool}" == true ] || [ "${nullsess_bool}" == true ] ; then

echo -e "${PURPLE}[-] bloodyad requires credentials and does not support Kerberos authentication using AES Key${NC}"

else

if [ "${ldaps_bool}" == true ]; then ldaps_param="-s"; else ldaps_param=""; fi

echo -e "${BLUE}[*] bloodyad search for writable objects${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get writable" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_writable_${dc_domain}.txt

fi

fi

echo -e ""

if [ ! -f "${bloodyad}" ] ; then

echo -e "${RED}[-] Please verify the installation of bloodyad{NC}"

else

mkdir -p ${output_dir}/DomainRecon/bloodyAD

if [ "${aeskey_bool}" == true ] || [ "${nullsess_bool}" == true ] ; then

echo -e "${PURPLE}[-] bloodyad requires credentials and does not support Kerberos authentication using AES Key${NC}"

else

if [ "${ldaps_bool}" == true ]; then ldaps_param="-s"; else ldaps_param=""; fi

echo -e "${BLUE}[*] bloodyad dump DNS entries${NC}"

run_command "${bloodyad} ${argument_bloodyad} ${ldaps_param} --host ${dc_ip} get dnsDump" | tee ${output_dir}/DomainRecon/bloodyAD/bloodyad_dns_${dc_domain}.txt

echo -e "${YELLOW}If ADIDNS does not contain a wildcard entry, check for ADIDNS spoofing${NC}"

/bin/cat ${output_dir}/DomainRecon/bloodyAD/bloodyad_dns_${dc_domain}.txt 2>/dev/null | sed -n '/[^\n]*\*/,/^$/p'

fi

fi