Skip to content

Commit 0691f5a

Browse files
p0daliriusp0dalirius
committed
Release
0 parents  commit 0691f5a

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

46 files changed

+26068
-0
lines changed

‎.github/FUNDING.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
# These are supported funding model platforms
2+
3+
github: p0dalirius
4+
patreon: Podalirius

‎.github/lockout.png‎

68.2 KB
Loading

‎.github/user_login.png‎

21.8 KB
Loading

‎.gitignore‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
# Byte-compiled / optimized / DLL files
2+
__pycache__/
3+
*.py[cod]
4+
*$py.class
5+
6+
# C extensions
7+
*.so
8+
9+
# Distribution / packaging
10+
.Python
11+
build/
12+
develop-eggs/
13+
dist/
14+
downloads/
15+
eggs/
16+
.eggs/
17+
.idea/
18+
lib64/
19+
parts/
20+
sdist/
21+
var/
22+
wheels/
23+
pip-wheel-metadata/
24+
share/python-wheels/
25+
*.egg-info/
26+
.installed.cfg
27+
*.egg
28+
MANIFEST
29+
30+
# PyInstaller
31+
# Usually these files are written by a python script from a template
32+
# before PyInstaller builds the exe, so as to inject date/other infos into it.
33+
*.manifest
34+
*.spec
35+
36+
# Installer logs
37+
pip-log.txt
38+
pip-delete-this-directory.txt
39+
40+
# Unit test / coverage reports
41+
htmlcov/
42+
.tox/
43+
.nox/
44+
.coverage
45+
.coverage.*
46+
.cache
47+
nosetests.xml
48+
coverage.xml
49+
*.cover
50+
*.py,cover
51+
.hypothesis/
52+
.pytest_cache/
53+
54+
# Translations
55+
*.mo
56+
*.pot
57+
58+
# Django stuff:
59+
*.log
60+
local_settings.py
61+
db.sqlite3
62+
db.sqlite3-journal
63+
64+
# Flask stuff:
65+
instance/
66+
.webassets-cache
67+
68+
# Scrapy stuff:
69+
.scrapy
70+
71+
# Sphinx documentation
72+
docs/_build/
73+
74+
# PyBuilder
75+
target/
76+
77+
# Jupyter Notebook
78+
.ipynb_checkpoints
79+
80+
# IPython
81+
profile_default/
82+
ipython_config.py
83+
84+
# pyenv
85+
.python-version
86+
87+
# pipenv
88+
# According to pypa/pipenv#598, it is recommended to include Pipfile.lock in version control.
89+
# However, in case of collaboration, if having platform-specific dependencies or dependencies
90+
# having no cross-platform support, pipenv may install dependencies that don't work, or not
91+
# install all needed dependencies.
92+
#Pipfile.lock
93+
94+
# PEP 582; used by e.g. github.com/David-OConnor/pyflow
95+
__pypackages__/
96+
97+
# Celery stuff
98+
celerybeat-schedule
99+
celerybeat.pid
100+
101+
# SageMath parsed files
102+
*.sage.py
103+
104+
# Environments
105+
.env
106+
.venv
107+
env/
108+
venv/
109+
ENV/
110+
env.bak/
111+
venv.bak/
112+
113+
# Spyder project settings
114+
.spyderproject
115+
.spyproject
116+
117+
# Rope project settings
118+
.ropeproject
119+
120+
# mkdocs documentation
121+
/site
122+
123+
# mypy
124+
.mypy_cache/
125+
.dmypy.json
126+
dmypy.json
127+
128+
# Pyre type checker
129+
.pyre/

‎README.md‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
# LDAP Monitor
2+
3+
Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
4+
5+
With this tool you can quickly see if your attack worked and if it changed LDAP attributes of the target object.
6+
7+
![](./python/imgs/example.png)
8+
9+
## Features
10+
11+
| Feature | [Python (.py)](./python/) | [CSharp (.exe)](./csharp/) | [Powershell (.ps1)](./powershell/) |
12+
|---------|--------|--------|------------|
13+
| LDAPS support | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
14+
| Random delay in seconds between queries | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
15+
| Custom delay in seconds between queries | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
16+
| Save output to logfile | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
17+
| Colored or not colored output with `--no-colors` | :heavy_check_mark: | :x: | :x: |
18+
| Custom page size for paged queries | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
19+
| Authenticate with user and password | :heavy_check_mark: | :heavy_check_mark: | :heavy_check_mark: |
20+
| Authenticate as current shell user | :x: | :heavy_check_mark: | :heavy_check_mark: |
21+
| Authenticate with LM:NT hashes | :heavy_check_mark: | :x: | :x: |
22+
| Authenticate with kerberos tickets | :heavy_check_mark: | :x: | :x: |
23+
24+
## Typical usecases
25+
26+
Here is a few usecases where this tool can be useful:
27+
28+
- Detect account lockout in real time
29+
![](./.github/lockout.png)
30+
31+
- Check if your privilege escalation worked (with ntlmrelay's `--escalate-user` option)
32+
![](./.github/)
33+
34+
- Detect when users are logging in to know when to start a network poisoning.
35+
![](./.github/user_login.png)
36+
37+
## Cross platform !
38+
39+
### [In Python (.py)](./python/)
40+
41+
![](./python/imgs/example.png)
42+
43+
### [In CSharp (.exe)](./csharp/)
44+
45+
![](./csharp/imgs/example.png)
46+
47+
### [In Powershell (.ps1)](./powershell/)
48+
49+
![](./powershell/imgs/example.png)
50+
51+
## Demonstration
52+
53+
https://user-images.githubusercontent.com/79218792/136900209-d2156d4c-d83d-4227-b51e-999ec99b2314.mp4
54+
55+
## Limitations
56+
57+
LDAP paged queries returns **pageSize** results per page, and it takes approximately 1 second to query a page. Therefore your monitoring refresh rate is **(number of LDAP objects // pageSize)** seconds. On most domain controllers **pageSize = 5000**.
58+
59+
60+
## Contributing
61+
62+
Pull requests are welcome. Feel free to open an issue if you want to add other features.

‎csharp/README.md‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
# Sharp LDAP Monitor
2+
3+
Monitor creation, deletion and changes to LDAP objects live during your pentest or system administration!
4+
5+
With this script you can quickly see if your attack worked and if it changed LDAP attributes of the target object. You can also directly see if you're locking accounts!
6+
7+
![](./imgs/example.png)
8+
9+
## Features
10+
11+
- [x] LDAPS support.
12+
- [x] Random delay in seconds between queries.
13+
- [x] Custom delay in seconds between queries.
14+
- [x] Save output to logfile.
15+
- [x] Custom page size for paged queries.
16+
- [x] Multiple authentication methods:
17+
- with user and password.
18+
- as current shell user
19+
20+
## Limitations
21+
22+
LDAP paged queries returns **pageSize** results per page, and it takes approximately 1 second to query a page. Therefore your monitoring refresh rate is **(number of LDAP objects // pageSize)** seconds. On most domain controllers **pageSize = 5000**.
23+
24+
## Usage
25+
26+
```
27+
$ ./ldapmonitor.py -h
28+
usage: ldapmonitor.py [-h] [--use-ldaps] [--debug] [--no-colors] [-l LOGFILE] [-r] [-t TIME_DELAY] [--dc-ip ip address] [-d DOMAIN] [-u USER]
29+
[--no-pass | -p PASSWORD | -H [LMHASH:]NTHASH | --aes-key hex key] [-k]
30+
31+
Monitor LDAP changes live!
32+
33+
optional arguments:
34+
-h, --help show this help message and exit
35+
--use-ldaps Use LDAPS instead of LDAP
36+
--debug Debug mode.
37+
--no-colors No colors mode.
38+
-l LOGFILE, --logfile LOGFILE
39+
Log file to save output to.
40+
-r, --randomize-delay
41+
Randomize delay between two queries, between 1 and 5 seconds.
42+
-t TIME_DELAY, --time-delay TIME_DELAY
43+
Delay between two queries in seconds (default: 1).
44+
45+
authentication & connection:
46+
--dc-ip ip address IP Address of the domain controller or KDC (Key Distribution Center) for Kerberos. If omitted it will use the domain part (FQDN)
47+
specified in the identity parameter
48+
-d DOMAIN, --domain DOMAIN
49+
(FQDN) domain to authenticate to
50+
-u USER, --user USER user to authenticate with
51+
52+
--no-pass don't ask for password (useful for -k)
53+
-p PASSWORD, --password PASSWORD
54+
password to authenticate with
55+
-H [LMHASH:]NTHASH, --hashes [LMHASH:]NTHASH
56+
NT/LM hashes, format is LMhash:NThash
57+
--aes-key hex key AES key to use for Kerberos Authentication (128 or 256 bits)
58+
-k, --kerberos Use Kerberos authentication. Grabs credentials from .ccache file (KRB5CCNAME) based on target parameters. If valid credentials
59+
cannot be found, it will use the ones specified in the command line
60+
```
61+
62+
## Quick start
63+
64+
- Authenticate with a password:
65+
66+
```
67+
./ldapmonitor.py -u 'Administrator' -d 'LAB.local' -p 'Admin123!' --dc-ip 192.168.2.1
68+
```
69+
70+
- Authenticate with LM:NT hashes:
71+
72+
```
73+
./ldapmonitor.py -u 'Administrator' -d 'LAB.local' --dc-ip 192.168.2.1 -H aad3b435b51404eeaad3b435b51404ee:520126a03f5d5a8d836f1c4f34ede7ce
74+
```
75+
76+
## Demonstration
77+
78+
https://user-images.githubusercontent.com/79218792/136900209-d2156d4c-d83d-4227-b51e-999ec99b2314.mp4
79+
80+
## Contributing
81+
82+
Pull requests are welcome. Feel free to open an issue if you want to add other features.

‎csharp/SharpLDAPmonitor.sln‎

Lines changed: 25 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,25 @@
1+
2+
Microsoft Visual Studio Solution File, Format Version 12.00
3+
# Visual Studio Version 16
4+
VisualStudioVersion = 16.0.31729.503
5+
MinimumVisualStudioVersion = 10.0.40219.1
6+
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SharpLDAPmonitor", "SharpLDAPmonitor\SharpLDAPmonitor.csproj", "{D7F5CCAB-BAC1-4EC1-9F29-0A821FC8CD01}"
7+
EndProject
8+
Global
9+
GlobalSection(SolutionConfigurationPlatforms) = preSolution
10+
Debug|Any CPU = Debug|Any CPU
11+
Release|Any CPU = Release|Any CPU
12+
EndGlobalSection
13+
GlobalSection(ProjectConfigurationPlatforms) = postSolution
14+
{D7F5CCAB-BAC1-4EC1-9F29-0A821FC8CD01}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
15+
{D7F5CCAB-BAC1-4EC1-9F29-0A821FC8CD01}.Debug|Any CPU.Build.0 = Debug|Any CPU
16+
{D7F5CCAB-BAC1-4EC1-9F29-0A821FC8CD01}.Release|Any CPU.ActiveCfg = Release|Any CPU
17+
{D7F5CCAB-BAC1-4EC1-9F29-0A821FC8CD01}.Release|Any CPU.Build.0 = Release|Any CPU
18+
EndGlobalSection
19+
GlobalSection(SolutionProperties) = preSolution
20+
HideSolutionNode = FALSE
21+
EndGlobalSection
22+
GlobalSection(ExtensibilityGlobals) = postSolution
23+
SolutionGuid = {AE84ADC5-94E0-41BC-8E6B-49882F4234B4}
24+
EndGlobalSection
25+
EndGlobal

‎csharp/SharpLDAPmonitor/App.config‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?xml version="1.0" encoding="utf-8" ?>
2+
<configuration>
3+
<startup>
4+
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5" />
5+
</startup>
6+
</configuration>

‎csharp/SharpLDAPmonitor/ArgumentParser.cs‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
using System.Diagnostics;
7+
8+
namespace SharpLDAPMonitor
9+
{
10+
public static class ArgumentParser
11+
{
12+
public static ArgumentParserResult Parse(IEnumerable<string> args)
13+
{
14+
var arguments = new Dictionary<string, string>();
15+
try
16+
{
17+
foreach (var argument in args)
18+
{
19+
var idx = argument.IndexOf(':');
20+
if (idx > 0)
21+
arguments[argument.Substring(0, idx)] = argument.Substring(idx + 1);
22+
else
23+
arguments[argument] = string.Empty;
24+
}
25+
26+
return ArgumentParserResult.Success(arguments);
27+
}
28+
catch (System.Exception ex)
29+
{
30+
Debug.WriteLine(ex.Message);
31+
return ArgumentParserResult.Failure();
32+
}
33+
}
34+
}
35+
}

‎csharp/SharpLDAPmonitor/ArgumentParserResult.cs‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Text;
5+
using System.Threading.Tasks;
6+
7+
namespace SharpLDAPMonitor
8+
{
9+
public class ArgumentParserResult
10+
{
11+
public bool ParsedOk { get; }
12+
public Dictionary<string, string> Arguments { get; }
13+
14+
private ArgumentParserResult(bool parsedOk, Dictionary<string, string> arguments)
15+
{
16+
ParsedOk = parsedOk;
17+
Arguments = arguments;
18+
}
19+
20+
public static ArgumentParserResult Success(Dictionary<string, string> arguments)
21+
=> new ArgumentParserResult(true, arguments);
22+
23+
public static ArgumentParserResult Failure()
24+
=> new ArgumentParserResult(false, null);
25+
26+
}
27+
}

0 commit comments

Comments
 (0)