5i<ddlZddlZddlZddlZddlmZmZmZddlm Z ddl m Z m Z ddl mZddlmZddl m Z ddlmZdd lmZdd lmZdd lmZdd lmZdd lmZddlmZddlTddl m!Z!m"Z"m#Z#ddl$m%Z%ddl&m'Z'ddl(m)Z)m*Z*ddl+m,Z,m-Z-GddZ.dS)N)DictListTuple) UniCredential)ACCESS_ALLOWED_OBJECT_ACEADS_ACCESS_MASK)GUID)SECURITY_DESCRIPTOR)r)SID)logger)MSLDAPClientStatus)LDAPSearchException) MSLDAPTarget) KNOWN_SIDS)MSLDAPClientConnection)*)ALL_ATTRIBUTESBASELEVEL)Control)escape_filter_chars)SDFlagsRequestSDFlagsRequestValue) DNS_RECORDDnsPropertyFactoryc eZdZdZddedefdZdZdZd Z d Z d Z d Z d Z ddedeedeeeeefdedef dZddedefdZefdeefdZefdeefdZefdeefdZefdeefdZdeefdZdZdZd efd!Ze fdeefd"Z!d#efd$Z"d#efd%Z#d#efd&Z$d'Z%d(Z&dd)e'fd*Z(dd)e'fd+Z)e*j+e*j,ze*j-zfd ed,e*fd-Z.e*j+e*j,ze*j-zfd ed,e*fd.Z/e*j+e*j,ze*j-zfd/ed0e0d,e*fd1Z1e2fdeefd2Z3e4fdeefd3Z5d4efd5Z6d6efd7Z7d8efd9Z8dd ed:e'fd;Z9dZ;d?efd@ZdCZ?e@fdeefdDZAd6edEefdFZBd6edGefdHZCd6efdIZDd6efdJZEd6efdKZFd6edLefdMZGd6edLefdNZHd6edOefdPZId6efdQZJdd6edRedSefdTZKd6ed4efdUZLd6ed4efdVZMdd efdWZNdd edXeOeePfdeOeePffdYZQd edeOeePffdZZRd efd[ZSd6ed4efd\ZTdd6ed]efd^ZUdd_ed`efdaZVdbZWdcZXddZYdeZZddfefdgZ[dhZ\e]fde^fdiZ_ddjedEefdkZ`d ed?efdlZadmebpe0fdnZcdd8edpedpe'fdqZedrZfdsZgdtZhduZidvZjdwZkdxZldyZmdzZnd{Zodeefd|Zpd}Zqd~ZrddZsdZtdZud edefdZvdS) MSLDAPClienta High level API for LDAP operations. target, creds, ldap_query_page_size :param target: The target object describing the connection info :type target: :class:`MSLDAPTarget` :param creds: The credential object describing the authentication to be used :type creds: :class:`MSLDAPCredential` :param ldap_query_page_size: :type ldap_query_page_size: int :return: A dictionary representing the LDAP tree :rtype: dict NFtargetcredscb||_||_||_d|_d|_d|_d|_|j|jj|_d|_|j|jj|_d|_d|_ ||_ d|_ d|_ d|_ i|_i|_d|_d|_dS)NiFr )rr keepaliveldap_query_page_size_disable_channel_binding_disable_signing_null_channel_bindingldap_query_ratelimit_tree _ldapinfo_con_MSLDAPClient__keepalive_taskkeepalive_perioddisconnected_evt _sid_cache_domainsid_cache domainname domainsid)selfrr connectionr"s C/home/kali/Ninja/venv/lib/python3.11/site-packages/msldap/client.py__init__zMSLDAPClient.__init__3s$*$+$."$"'$$$$ [#{?4$ [#{?4$*$.$)$$$$/$$/$...c K|SNr2s r4 __aenter__zMSLDAPClient.__aenter__Ns +r6cfKtj|dd{VdS)N)timeout)asynciowait_for disconnect)r2exc_typeexc tracebacks r4 __aexit__zMSLDAPClient.__aexit__Qs>**a888888888888r6cK |jsu|j4d|z}||t23d{V\}}|d|fcS6t j|jd{V|jsdSdS#t j$rYdSt$r7}td|z| d{VYd}~dSd}~wwxYw)N(distinguishedName=%s)zKeepalive exception: %s) r-is_setr* pagedsearchMSADInfo_ATTRSr?sleepr,CancelledError ExceptionprintrA)r2temptree ldap_filterentryerres r4 __keepalivezMSLDAPClient.__keepaliveTsi  " ) ) + +/ y,x7[!--k>JJzuc Ci K -- . ........  " ) ) + +/////      66  "Q &'''   s0ABA B:BC&& C&/,C!!C&cK |j|j|j|jd{V|jdS#t $r}d|fcYd}~Sd}~wwxYwNF)r+cancelr*rAr-setrM)r2rSs r4rAzMSLDAPClient.disconnectfs  '  """ i )            (??????sAA%% A=/A82A=8A=cK tj|_|jt |j|j|_|j|j_|j|j_|j |j_ |j d{V\}}|||jj dur)|j d{V\}}|d|fSntjd|jd{V\}}|||t!dn||_|d|_|d{V\|_}|jj durD|||jj|j|jj<|jj|_|jj|_|jdur2tj||d|_dS#t<$r}d|fcYd}~Sd}~wwxYw)NFzSkipping bind for no auth!z:RootDSE is empty! You will need to find the tree manually!defaultNamingContextTTN)r?Eventr-r*rrrr$r%r&connectis_anonbindr debugget_serverinforN _serverinfor( get_ad_infor)namer/ objectSidr0r1r" create_task_MSLDAPClient__keepaliver+rM)r2_rRresrSs r4r]zMSLDAPClient.connectrs+#"=??4 i&t{DJ??DI)-)FDI&!%!6DI&*&@DI#9$$&& & & & & & &FAs  Y yE!!inn&&&&&&&&XS#  CZ  \.///I,,........83 o I k FGGGGD+,DJ $ 0 0 2 2222222DNC yE!!  i7;~7JT4>34~*T_n.T^ ~$01A1A#F\B]1^1^__T *  (??????s%C G#DG## G;-G60G;6G;c|jSr8)rbr:s r4get_server_infozMSLDAPClient.get_server_infos r6cK|j |jdfS|d{V\|_}|d|fS|jj|_|j|fSr8)r0rcr)rd)r2rRs r4get_domain_namezMSLDAPClient.get_domain_namesm _ /4 "..00000000$.#_ )N'$/ # r6query attributescontrolstree search_scopec Ktjd|dd||jjt jkr+|jjt jkrtddS||j }|tdg}|D])}| | *|}g}|O|D]L}| t|d |d|d d M|}|j||||j||j| 23d{V\} } | d| fWVdS| d d kr | dd kr/| dfWV76dS)a Performs a paged search on the AD, using the filter and attributes as a normal query does. !The LDAP connection MUST be active before invoking this function! :param query: LDAP query filter :type query: str :param attributes: List of requested attributes :type attributes: List[str] :param controls: additional controls to be passed in the query :type controls: dict :param tree: Base tree to perform the search on :type tree: str :param search_scope: LDAP search scope :type search_scope: int :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] zPaged search, filter: z attributes: ,z%There was an error in the connection!Nz BIND first!rr=rn) controlType criticality controlValue)rp size_limitrq rate_limitrs objectNamerp)r r`joinr*statusr RUNNINGERRORrNr(rMappendencoderrIr#r') r2rorprqrrrstxcontrolrQrRs r4rIzMSLDAPClient.pagedsearchs( ,,EEE388JCWCWCWXYYY Y+333 i,222 1222 F \ *4 \ = ! !!! a88AHHJJ*! wHHWAJ%%''AJQZ ()//)'0JE3  9____ VV \b  U<%8B%>%> +#s?E6root_dnlevelc Ktjd|d|i}|j|ddg|jt d|j23d{V\}}|||dkricSd|d vs |d d|d dgkrC||d d|d z d{V}|||d d<6||iS) a Returns a dictionary representing a tree starting from 'dn' containing all subtrees. :param root_dn: The start DN of the tree :type root_dn: str :param level: Recursion level :type level: int :return: A dictionary representing the LDAP tree :rtype: dict z Tree, dn: z level: z(distinguishedName=*)sdistinguishedNameNrpryrsrqrzrdistinguishedNamerpr=r)r r`r*rIr#rr' get_tree_plot)r2rrrrrQrRsubtrees r4rzMSLDAPClient.get_tree_plotsd ,,777EE:;;; $)// %&)'0=======JE3  Y zz YYY% "555|9LM`9a9imrsnABUnVZ\n\n\ &&u\':;N'OY^`aYa&bbbbbbbbG5>9999999JE3 o )OOOO FF   E4> 2 2D 888888 ?  ,./////A+cKtjdd}|||23d{V\}}| d|fWVdSt||jdfWV<6tjddS)a Fetches all machine objects available in the LDAP tree and yields them as MSADMachine object. :param attrs: Lists of attributes to request (eg. `['sAMAccountName', 'dNSHostName']`) Default: all attrs. :type attrs: list :return: Async generator which yields (`MSADMachine`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADMachine`, :class:`Exception`)] r(sAMAccountType=805306369)Nr)r r`rI MSADMachinerr)rs r4get_all_machineszMSLDAPClient.get_all_machiness ,0111-+**;>><<<<<<>(((((((JE3 o )OOOO FF   5 ! !4 '''''' ?>>AcKtjdd}|||23d{V\}}| d|fWVdSt|dfWV66tjddS)a Fetches all container objects available in the LDAP tree and yields them as MSADContainer object. :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] z$Polling AD for all container objectsz4(&(objectCategory=container)(objectClass=container))Nr)r r`rI MSADContainerrrs r4get_all_containerszMSLDAPClient.get_all_containers@s ,5666G+**;>>.......JE3 o )OOOO FF   ' ' ------ ?  ,./////sA%cxKd}|||23d{V\}}| d|fWVdS|dfWV6dS)NzR(&(objectClass=foreignSecurityPrincipal)(objectCategory=foreignSecurityPrincipal))rIrs r4!get_all_foreignsecurityprincipalsz.MSLDAPClient.get_all_foreignsecurityprincipalsQse+**;>>JE3 o )OOOO FF  ?>>s9chKd}ddg}|||23d{V\}}||fWV6dS) Fetches all LAPS passwords for all machines. This functionality is only available to specific high-privileged users. :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] rcn ms-mcs-AdmPwdNrr2rPrprQrRs r4 get_all_lapszMSLDAPClient.get_all_lapsYsu.+_%***; CCJE3 DCCs1cKd}ddg}|||23d{V\}}||fWV6ddg}|||23d{V\}}||fWV6ddg}|||23d{V\}}||fWV6ddg}|||23d{V\}}||fWV6ddg}|||23d{V\}}||fWV6dS) rrrzmsLAPS-PasswordNzmsLAPS-EncryptedPasswordzmsLAPS-EncryptedPasswordHistoryzmsLAPS-EncryptedDSRMPasswordz#msLAPS-EncryptedDSRMPasswordHistoryrrs r4get_all_laps_windowsz!MSLDAPClient.get_all_laps_windowsfs .+&'***; CCJE3 D/0***; CCJE3 D67***; CCJE3 D34***; CCJE3 D:;***; CCJE3 DCCs1 A9B &B8C%dnc$Ktjd|z|j|dt |zdt D|jtd23d{V\}}||t |dfcS6dS)z Fetches one Schema entriy identified by dn :return: (`MSADSchemaEntry`, None) tuple on success or (None, `Exception`) on error :rtype: (:class:`MSADSchemaEntry`, :class:`Exception`) zPolling Schema entry for %srGc6g|]}|Sr9r.0rs r4 z0MSLDAPClient.get_schemaentry..s ;;;;;;r6N)rpryrsrqNN) r r`r*rIrMSADSCHEMAENTRY_ATTRSr#rMSADSchemaEntryr)r2rrQrRs r4get_schemaentryzMSLDAPClient.get_schemaentrys ,,b0111)//22666;;%:;;;) 0       JE3  Y  $ $U + +T 1111 *s#Bc K||jddd{V}|D]}||D]}|j|dt |zd|D|jt d|j23d{V\}}| d|fWVdSt |dfWVn6dWVtj d dS) z Fetches all Schema entries under CN=Schema,CN=Configuration,... :return: Async generator which yields (`MSADSchemaEntry`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADSchemaEntry`, :class:`Exception`)] schemaNamingContextr=rNrGc6g|]}|Sr9rrs r4rz4MSLDAPClient.get_all_schemaentry..s ---!188::---r6rrr) rrbr*rIrr#rr'rrr r`)r2rrirrrQrRs r4get_all_schemaentryz MSLDAPClient.get_all_schemaentrysU  !12G!HRS TTTTTTTT# a Vr I11!4R!8!88--u---+)2jeS  3Y vvvv  % %e , ,d 22222 e #& ,./////sB<sAMAccountNamecjKd|z}ddg}|||23d{V\}}||fcS6dS)a1 Fetches the LAPS password for a machine. This functionality is only available to specific high-privileged users. :param sAMAccountName: The username of the machine (eg. `COMP123$`). :type sAMAccountName: str :return: Laps attributes as a `dict` :rtype: (:class:`dict`, :class:`Exception`) 0(&(sAMAccountType=805306369)(sAMAccountName=%s))rrNr)r2rrPrprQrRs r4get_lapszMSLDAPClient.get_lapssuDnT+_%***; CCJE3 *DCCs2cKtjd|zd|z}||t23d{V\}}|d|fcSt||jdfcS6dS)a9 Fetches one user object from the AD, based on the sAMAccountName attribute (read: username) :param sAMAccountName: The username of the user. :type sAMAccountName: str :return: A tuple with the user as `MSADUser` and an `Exception` is there was any :rtype: (:class:`MSADUser`, :class:`Exception`) Polling AD for user %sz((&(objectClass=user)(sAMAccountName=%s))Nrr r`rIMSADUser_ATTRSrrr)r2rrPrQrRs r4get_userzMSLDAPClient.get_users ,'7888;nL+**;GGJE3 o 9   UDN 3 3T 9999H *A0cKtjd|zd|z}||t23d{V\}}|d|fcSt||jdfcS6dS)aE Fetches one machine object from the AD, based on the sAMAccountName attribute (read: username) :param sAMAccountName: The username of the machine. :type sAMAccountName: str :return: A tuple with the user as `MSADMachine` and an `Exception` is there was any :rtype: (:class:`MSADMachine`, :class:`Exception`) rrNr)r r`rIMSADMachine_ATTRSrrr)rs r4 get_machinezMSLDAPClient.get_machines ,'7888CnT+**;8IJJJE3 o 9   t~ 6 6 <<<<K *rcKtjdd|jz}||t23d{V\}}|d|fcSt ||_|jdfcS6tjddS)z Polls for basic AD information (needed for determine password usage characteristics!) :return: A tuple with the domain information as `MSADInfo` and an `Exception` is there was any :rtype: (:class:`MSADInfo`, :class:`Exception`) zPolling AD for basic inforGNzPoll finished!)r r`r(rIrJMSADInforr)r2rPrQrRs r4rczMSLDAPClient.get_ad_infos ,*+++)DJ6+**;GGJE3 o 9&&u--4> .$  H  ,     sA8cKtjdd}gd}|||23d{V\}}||fWV6dS)a Fetches all service user objects from the AD, and returns MSADUser object. Service user refers to an user with SPN (servicePrincipalName) attribute set :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields tuples with a string in SPN format and an Exception if there was any :rtype: Iterator[(:class:`str`, :class:`Exception`)] zPolling AD for all SPN entriesz(&(sAMAccountType=805306369)))rerservicePrincipalNameN)r r`rIrs r4get_all_spn_entriesz MSLDAPClient.get_all_spn_entriess ,/0000+EEE***; CCJE3 DCCsAinclude_machinec&Ktjd|z|dkrd}nd}||t23d{V\}}| d|fWVdSt||jdfWV<6tjddS)a Fetches all service user objects from the AD, and returns MSADUser object. Service user refers to an user with SPN (servicePrincipalName) attribute set :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] >Polling AD for all user objects, machine accounts included: %sTz(servicePrincipalName=*)z1(&(servicePrincipalName=*)(!(sAMAccountName=*$)))Nrrr2rrPrQrRs r4get_all_service_usersz"MSLDAPClient.get_all_service_userss ,OQ``aaa,;;E;**;GG9999999JE3 o )OOOO FF   E4> 2 2D 888888 H  ,./////A<c&Ktjd|z|dkrd}nd}||t23d{V\}}| d|fWVdSt||jdfWV<6tjddS)a Fetches all user objects with useraccountcontrol DONT_REQ_PREAUTH flag set from the AD, and returns MSADUser object. :param include_machine: Specifies wether machine accounts should be included in the query :type include_machine: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] rTz4(userAccountControl:1.2.840.113556.1.4.803:=4194304)zM(&(userAccountControl:1.2.840.113556.1.4.803:=4194304)(!(sAMAccountName=*$)))Nrrrs r4get_all_knoreq_usersz!MSLDAPClient.get_all_knoreq_users1s ,OQ``aaaH;;a;**;GG9999999JE3 o )OOOO FF   E4> 2 2D 888888 H  ,./////rflagsc6Ktd|i}dt|z}tj}dd|fg}||||23d{V\}}| d|fWVdSt|dfWV66dS)a Returns the full or partial Security Descriptor of the object specified by it's DN. The flags indicate which part of the security Descriptor to be returned. By default the full SD info is returned. :param object_dn: The object's DN :type object_dn: str :param flags: Flags indicate the data type to be returned. :type flags: :class:`SDFlagsRequest` :return: :rtype: :class:`MSADSecurityInfo` FlagsrG1.2.840.113556.1.4.801TrqN)rrMSADSecurityInfoATTRSdumprIr r2rr req_flagsrPrprqrQrRs r4get_objectacl_by_dn_pz"MSLDAPClient.get_objectacl_by_dn_pHs"7U"344)),?,C,CC+%*'y~~/?/?@ A(**; x*XX1111111JE3 o )OOOO FF  # #E * *D 000000 YXXs"BcKtd|i}dt|z}dg}dd|fg}||||23d{V\}}|d|fcS|dddfcS6d S) a Returns the full or partial Security Descriptor of the object specified by it's DN. The flags indicate which part of the security Descriptor to be returned. By default the full SD info is returned. :param object_dn: The object's DN :type object_dn: str :param flags: Flags indicate the data type to be returned. :type flags: :class:`SDFlagsRequest` :return: nTSecurityDescriptor attribute of the object as `bytes` and an `Exception` is there was any :rtype: (:class:`bytes`, :class:`Exception`) rrGnTSecurityDescriptorrTrNrpr)rrrrIgetrs r4get_objectacl_by_dnz MSLDAPClient.get_objectacl_by_dncs"7U"344)),?,C,CC+&'*'y~~/?/?@ A(**; x*XX@@@@@@@JE3 o 9   ! !"8 9 94 ????Y sB  object_dndatacKtd|i}td|ddg}dd|fgi}|j|||d{VS) a Updates the security descriptor of the LDAP object :param object_dn: The object's DN :type object_dn: str :param data: The actual data as bytearray to be updated in the Security Descriptor of the specified object :type data: bytes :param flags: Flags indicate the data type to be updated. :type flags: :class:`SDFlagsRequest` :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: tuple r1.2.840.113556.1.4.801TrvrxrwrreplacerN)rrrr*modify)r2rrrrrqchangess r4set_objectacl_by_dnz MSLDAPClient.set_objectacl_by_dn~s"7U"344) /nn&&(Y-. 'y 7xHH H H H H H HHr6cKd}|||23d{V\}}| d|fWVdSt|dfWV66dS)z Yields all Groups present in the LDAP tree. :return: Async generator which yields (`MSADGroup`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADGroup`, :class:`Exception`)] z(objectClass=group)N)rI MSADGrouprrs r4get_all_groupszMSLDAPClient.get_all_groupss'+**;>>*******JE3 o )OOOO FF   U # #T )))))) ?>>rcKd}|||23d{V\}}| d|fWVdSt|dfWV66dS)z Yields all OUs present in the LDAP tree. :return: Async generator which yields (`MSADOU`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADOU`, :class:`Exception`)] z (objectClass=organizationalUnit)N)rIMSADOUrrs r4 get_all_ouszMSLDAPClient.get_all_ouss4+**;>>'''''''JE3 o )OOOO FF   % $ &&&&&& ?>>rgroup_dncKdt|z}||t23d{V\}}|d|fcSt|dfcS6dt dfS)z Returns an `MSADGroup` object for the group specified by group_dn :param group_dn: The user's DN :type group_dn: str :return: tuple of `MSADGroup` and an `Exception` is there was any :rtype: (:class:`MSADGroup`, :class:`Exception`) z,(&(objectClass=group)(distinguishedName=%s))NSearch returned no results!)rrIMSADGroup_ATTRSrrrM)r2rrPrQrRs r4get_group_by_dnzMSLDAPClient.get_group_by_dns@BUV^B_B__+**;HH+++++++JE3 o 9   e $ $d ****I y677 77A user_dncKd|z}||t23d{V\}}|d|fcSt|dfcS6dt dfS)z Fetches the DN for an object specified by `user_dn` :param user_dn: The user's DN :type user_dn: str :return: The user object :rtype: (:class:`MSADUser`, :class:`Exception`) z+(&(objectClass=user)(distinguishedName=%s))Nr)rIrrrrM)r2rrPrQrRs r4get_user_by_dnzMSLDAPClient.get_user_by_dns?H+**;GG*******JE3 o 9   U # #T ))))H y677 77sAsidcKdt|z}||t23d{V\}}|d|fcSt|dfcS6dt dfS)zd Fetches the DN for an object specified by `sid` :param sid: The user's SID :type sid: str (objectSid=%s)Nr)strrIrrrrM)r2rrPrQrRs r4get_user_by_sidzMSLDAPClient.get_user_by_sids"CHH,+**;GG*******JE3 o 9   U # #T ))))H y677 77r recursivec`K||d{V\}}| d|fWVdS|jry|jD]s}||23d{V\}}t|tr2|r0||jd23d{V\}}||fWV6Q||fWVY6rdSdS)a~ Fetches the DN for an object specified by `objectsid` :param dn: The object's DN :type dn: str :param recursive: Indicates wether the lookup should recursively affect all groups :type recursive: bool :return: Async generator which yields (`MSADUser`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADUser`, :class:`Exception`)] NT)r)rmemberget_object_by_dn isinstancerget_group_membersr)r2rrgrouprRrresultusers r4r zMSLDAPClient.get_group_memberssI))"--------*%_ s???? 6 \v!226::kfc69%%)!33F4LZ^3__ c 3Y`_ CK ;:s B*B  objectsidcKdt|z}||dg23d{V\}}|d|fcS|dddfcS6dtdfS)z Fetches the DN for an object specified by `objectsid` :param objectsid: The object's SID :type objectsid: str :return: The distinguishedName :rtype: (:class:`str`, :class:`Exception`) rrNrpr)rrIrM)r2r rPrQrRs r4get_dn_for_objectsidz!MSLDAPClient.get_dn_for_objectsids"C NN2+**;9L8MNN9999999JE3 o 9  1 2D 8888 O y677 77AcKdt|z}||dg23d{V\}}|d|fcS|dddfcS6dtdfS)z Fetches the objectsid for an object specified by `dn` :param dn: The object's distinguishedName :type dn: str :return: The SID of the pobject :rtype: (:class:`str`, :class:`Exception`) rGreNrprrrIrM)r2rrPrQrRs r4get_objectsid_for_dnz!MSLDAPClient.get_objectsid_for_dns*,?,C,CC+**; FF1111111JE3 o 9  k *D 0000 G y677 77rsamaccountnamecTKdt|z}d}||dg23d{V\}}|d|fcS|dd}!6|dtd|zfSg}||23d{V\}}|d|fcS||(6|dfS)N(sAMAccountName=%s)rrpzUser not found! %s)rrIrMget_tokengroupsr)r2rrPrrQrR tokengroupsidss r4get_tokengroups_userz!MSLDAPClient.get_tokengroups_user-s(&)<^)L)LL+ '**;9L8MNN6666666JE3 o 9 < !4 577 O  _  .?@@ @@*--g66ID# o 9 T7 T s A=B%cKdt|z}dg}|j||||jt|j23d{V\}}| d|fWVdSd|dvr|ddD] }|dfWV 96dS)z Yields SIDs of groups that the given DN is a member of. :return: Async generator which yields (`str`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`str`, :class:`Exception`)] rG tokenGroupsrpryrsrzN tokenGroupsrp)rr*rIr#rr')r2rrPrprQrRsid_datas r4rzMSLDAPClient.get_tokengroupsAs*,?,C,CC+ *)//)' 0JE3  9____ VVl+++<(7 dNsBc Kd}||gd23d{V\}}| d|fWVdSd|vr|j|ddt|dzdg|jt|j23d{V\}}| d|fWVngd |d vr[|d d D]L}|d d |d|d d |d d |d dd|ddfWVM{66dS)a Yields all effective group membership information for all objects of the following type: Users, Groups, Computers :return: Async generator which yields (`dict`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`dict`, :class:`Exception`)] zJ(|(sAMAccountType=805306369)(objectClass=group)(sAMAccountType=805306368)))rrre objectClass objectGUIDrpNr{rGrrrrprr"rer!)rrguidrtypetoken)rIr*rr#rr')r2rPrQrRentry2r's r4get_all_tokengroupsz MSLDAPClient.get_all_tokengroups]s^+**EEE+       JE3  9____ VVu"i33 L"5eL6I"J"JJ"#,* 4{vs /Ci  6,/ / /L)-8  E|$T*|$&|4 %k2&}5b9         s DC?cKtjtjztjz}t d|i}d}||dg23d{V\}}| d|fWVdSdt |dz}tj}dd | fg}|||| 23d{V\}}| d|fWVdSt |dfWV766dS) a> Yields the security descriptor of all objects in the LDAP tree of the following types: Users, Computers, GPOs, OUs, Groups :return: Async generator which yields (`MSADSecurityInfo`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADSecurityInfo`, :class:`Exception`)] rz(|(objectClass=organizationalUnit)(objectCategory=groupPolicyContainer)(sAMAccountType=805306369)(objectClass=group)(sAMAccountType=805306368))rr#NrGr{rTr) rDACL_SECURITY_INFORMATIONGROUP_SECURITY_INFORMATIONOWNER_SECURITY_INFORMATIONrrIrrrrr) r2 flags_valuerrPrQrRrprqr(s r4get_all_objectaclzMSLDAPClient.get_all_objectaclsp89bbcqdMM+!7["9::)c+**;dV*LL 3 3 3 3 3 3 3JE3 o )OOOO FF*-@|AT-U-UU; &:($ 0@0@AB8 ,,[*QY,ZZ3333333[VS  9____ VVV  $ $V , ,d 222222 [ZMLLs C7>C5cKd}|||23d{V\}}| d|fWVdSt|dfWV66dS)z Yields all trusted domains. :return: Async generator which yields (`MSADDomainTrust`, None) tuple on success or (None, `Exception`) on error :rtype: Iterator[(:class:`MSADDomainTrust`, :class:`Exception`)] z(objectClass=trustedDomain)r#N)rIMSADDomainTrustrrs r4get_all_trustszMSLDAPClient.get_all_trustss/+**;U*KK0000000JE3 o )OOOO FF  " "5 ) )4 ////// LKKsApasswordcK |dddd}|jdddd}gd|||d||d }|j||d{V\}}|d |fS|||d{V\}}|d |fS||d{V\}}|d |fSd S#t$r}d |fcYd}~Sd}~wwxYw) a[ Creates a new user object with a password and enables the user so it can be used immediately. :param user_dn: The user's DN :type user_dn: str :param password: The password of the user :type password: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rurNz,DC=.)organizationalPersonpersontopr z{}@{})r!snr displayNameuserPrincipalNameFr[) splitr(rformatr*addchange_password enable_userrM) r2rr3r:domainrprhrRrSs r4create_user_dnzMSLDAPClient.create_user_dns] c1abb!2 JqrrN " "6# . .6EEE !..V44 :)--44 4 4 4 4 4 461c o #:&&w99 9 9 9 9 9 961c o #:""7++ + + + + + +61c o #: *  (??????s*B C$C7#C C5'C0*C50C5 computer_sidc FK |dddd}gd|||ddddtjd |zd }|j||d{V\}}|d |fSd S#t $r}d |fcYd}~Sd}~wwxYw) zz This will create a dmsa service user that can be used for neferious reasons, but DO NOT USE THIS FOR ANYTHING ELSE! rurr5N)z#msDS-DelegatedManagedServiceAccountr7r8r9r computerz!O:S-1-5-32-544D:(A;;0xf01ff;;;%s)) r!r:rr;zmsDS-DelegatedMSAStatezmsDS-ManagedPasswordIntervalzmsDS-SupportedEncryptionTypesuserAccountControlmsDS-GroupMSAMembershipFr[)r=r from_sddlupperr*r?rM)r2rrDr:rprhrRrSs r4create_broken_dmsa_userz$MSLDAPClient.create_broken_dmsa_users  c1abb!2www  $&%'2<=`cocucucwcw=wxx  :)--44 4 4 4 4 4 461c o #: *  (??????sBB B BB B cRKddgi}|j||d{VS)z Unlocks the user by clearing the lockoutTime attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) lockoutTime)rrNr*rr2rrs r4 unlock_userzMSLDAPClient.unlock_usersC>" 'y11 1 1 1 1 1 11r6cRKddgi}|j||d{VS)a  Sets the user object to enabled by modifying the UserAccountControl attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rJ)riNrQrRs r4rAzMSLDAPClient.enable_usersD*+ 'y11 1 1 1 1 1 11r6cRKddgi}|j||d{VS)a  Sets the user object to disabled by modifying the UserAccountControl attribute. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rJ)rrnNrQrRs r4 disable_userzMSLDAPClient.disable_usersC.) 'y11 1 1 1 1 1 11r6spncVKdd|fgi}|j||d{VS)K Adds an SPN record to the user object. :param user_dn: The user's DN :type user_dn: str :param spn: The SPN to be added. It must follow the SPN string format specifications. :type spn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rr?NrQr2rrWrs r4 add_user_spnzMSLDAPClient.add_user_spn$sFUCL> 'y11 1 1 1 1 1 11r6cVKdd|fgi}|j||d{VS)rYrdeleteNrQrZs r4 del_user_spnzMSLDAPClient.del_user_spn5sGXsO, 'y11 1 1 1 1 1 11r6hostnamecVKdd|fgi}|j||d{VS)z Adds additional hostname to the user object. :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) zmsds-additionaldnshostnamer?NrQ)r2rr_rs r4add_additional_hostnamez$MSLDAPClient.add_additional_hostnameFsH 5("3!4 'y11 1 1 1 1 1 11r6cFK|j|d{VS)z Deletes the user. This action is destructive! :param user_dn: The user's DN :type user_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) Nr*r])r2rs r4 delete_userzMSLDAPClient.delete_userVs0y(( ( ( ( ( ( ((r6newpassoldpasscKdgi}|A|ddd|zf|ddd|zfn |ddd|zf|j||d{VS)a Changes the password of a user. If used with a high-privileged account (eg. Domain admin, Account operator...), the old password can be `None` :param user_dn: The user's DN :type user_dn: str :param newpass: The new password :type newpass: str :param oldpass: The current password :type oldpass: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) unicodePwdNr]z"%s"r?r)rr*r)r2rrerfrs r4r@zMSLDAPClient.change_passwordcs  '  <6G+; <=== <(8 9:::: <FW,< =>>>y11 1 1 1 1 1 11r6cVKdd|fgi}|j||d{VS)a  Adds a user to a group :param user_dn: The user's DN :type user_dn: str :param group_dn: The groups's DN :type group_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rr?NrQr2rrrs r4add_user_to_groupzMSLDAPClient.add_user_to_groupsH ug  'y'22 2 2 2 2 2 22r6cVKdd|fgi}|j||d{VS)a  Removes user from group :param user_dn: The user's DN :type user_dn: str :param group_dn: The groups's DN :type group_dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) rr]NrQrjs r4del_user_from_groupz MSLDAPClient.del_user_from_groupsH x! " 'y'22 2 2 2 2 2 22r6cKdt|z}||t23d{V\}}| d|fWVdS|dd}|r||dfWV|s|dfWVWd|vr t |dfWV{d|vrt |dfWV6dS)NrGrpr!r r )rrIrrrrr)r2rexpected_classrPrQrRtemps r4rzMSLDAPClient.get_object_by_dns6),?,C,CC+**;GG + + + + + + +JE3 o )OOOO FF   ! !- 0 040  " "5 ) )4 ///// + +$   U # #T ))))))4   e $ $d *****HGGsCrcK|g}g}|D]$}|t|%|j|||d{VS)a Performs the modify operation. :param dn: The DN of the object whose attributes are to be modified :type dn: str :param changes: Describes the changes to be made on the object. Must be a dictionary of the following format: {'attribute': [('change_type', [value])]} :type changes: dict :param controls: additional controls to be passed in the query :type controls: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) Nr)rrr*r)r2rrrq controls_convrs r4rzMSLDAPClient.modifysu8-**g(())))yGmDD D D D D D DDr6cHK|j||d{VS)a4 Performs the add operation. :param dn: The DN of the object to be added :type dn: str :param attributes: Attributes to be used in the operation :type attributes: dict :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) N)r*r?)r2rrps r4r?zMSLDAPClient.adds0y}}R,, , , , , , ,,r6cFK|j|d{VS)z Performs the delete operation. :param dn: The DN of the object to be deleted :type dn: str :return: A tuple of (True, None) on success or (False, Exception) on error. :rtype: (:class:`bool`, :class:`Exception`) Nrc)r2rs r4r]zMSLDAPClient.deletes0y## # # # # # ##r6c K ||d{V\}}||||d{V\}}|||tdtj|}t j|}t}tj ||_ tj d|_ tj|_d|_|jj|dd|fgi} t+dt,ji} d| d d g} ||| | d{V\} }||d S#t$r} d | fcYd} ~ Sd} ~ wwxYw) zDAdds AddMember rights to the user on the group specified by group_dnNFailed to get forest's SDz$bf9679c0-0de6-11d0-a285-00aa003049e2rrrrrFrr[)rrrMr from_bytescopydeepcopyrr from_stringSidr ObjectTyper WRITE_PROPMaskAceFlagsDaclacesrto_bytesrrr+rr)r2rruser_sidrRrigroup_sdnew_sdace_1rrrqrhrSs r4add_priv_addmemberzMSLDAPClient.add_priv_addmembers(227;;;;;;;;=8S o I,,X6666666683 o I k 0 1 11!,S118 M( # #6 $ & &5x((59&'MNN5*5:5> ;5!!!y&//*;*;<=7# ^ 5$9-NN$$8 ++h:: : : : : : :61c o I *  (??????sE%E++ F5E>8F>F forest_dncK ||d{V\}}||| |jj}||d{V\}}|||t dt j|}tj|}t}tj ||_ tj d|_tj|_d|_|jj|t} tj || _ tj d| _tj| _d| _|jj| dd|fgi} t/dt0ji} d | d d g} ||| | d{V\} }||d S#t$r}d |fcYd}~Sd}~wwxYw) zzAdds DCSync rights to the given user by modifying the forest's Security Descriptor to add GetChanges and GetChangesAll ACENrvz$1131f6aa-9c07-11d1-f79f-00c04fc2dcd2rz$1131f6ad-9c07-11d1-f79f-00c04fc2dcd2rrrrFrr[)rr)rrrMr rwrxryrr rzr{r r|rCONTROL_ACCESSr~rrrrrrrr+rr)r2rrrrRri forest_sdrrace_2rrrqrhrSs r4add_priv_dcsynczMSLDAPClient.add_priv_dcsyncs>5227;;;;;;;;=8S o I0I,,Y7777777783 o I k 0 1 11"-c229 M) $ $6 $ & &5x((59&'MNN5.5:5> ;5!!! $ & &5x((59&'MNN5.5:5> ;5!!!y&//*;*;<=7# ^ 5$9-NN$$8 ++i(;; ; ; ; ; ; ;61c o I *  (??????sG*G00 H:H=HH new_owner_sid target_dncK tj|}n#dtdfcYSxYwd}||dkr9d}||d{V\}}||t j|}n\d|z}|||g23d{V\}}||t j|d|}n6tdtj|} || _ |d | fgi} | || d{V\} }||d S#t$r} d| fcYd} ~ Sd} ~ wwxYw) zChanges the owner in a Security Descriptor to the new_owner_sid on an LDAP object or on an LDAP object's attribute identified by target_dn and target_attribute. target_attribute can be omitted to change the target_dn's SD's ownerFz Incorrect SIDNr|rrGrpzTarget DN not found!rr[) r rzrMrr rwrIrxryOwnerrr) r2rrtarget_attribute target_sdrirRrorQrrrhrSs r4change_priv_ownerzMSLDAPClient.change_priv_ownerIs$-OM22MM- )O,, ,,,,9"2b"8"8---i88888888HC  Y#.s33II $y 0E ,,U5E4FGG-------jeS  i$/l0CDT0UVVY U H + , ,, M) $ $66<FOO$5$5677++i11 1 1 1 1 1 161c o I *  (??????s=D*/D*A"D*CBD** E4D=7E=EcK d}d|jjz}||t|23d{V\}}| d|fWVdSt|ddfWV76dS#t $r}d|fWVYd}~dSd}~wwxYw)N$(objectClass=certificationAuthority)zSCN=Certification Authorities,CN=Public Key Services,CN=Services,CN=Configuration,%srprrROOTCAr)rrI MSADCA_ATTRSMSADCArrMr2rPrrrQrRrSs r4 list_root_caszMSLDAPClient.list_root_casqs  7; _bfbpcC C4++Kl[_+``2222222ZUC  9____ VV   5( + +T 111111 a``    q==== 66666 '.A,A)A,"A,, B6BBcK d}d|jjz}||t|23d{V\}}| d|fWVdSt|ddfWV76dS#t $r}d|fWVYd}~dSd}~wwxYw)NrzLCN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,%srNTCArrs r4 list_ntcaszMSLDAPClient.list_ntcass  7; X[_[i[{ {4++Kl[_+``0000000ZUC  9____ VV   5& ) )4 ////// a``    q==== 66666 rcK d}d|jjz}||t|23d{V\}}| d|fWVdSt|ddfWV76dS#t $r}d|fWVYd}~dSd}~wwxYw)Nrz=CN=AIA,CN=Public Key Services,CN=Services,CN=Configuration,%srAIACArrs r4 list_aiacaszMSLDAPClient.list_aiacass  7; IDNLl l4++Kl[_+``1111111ZUC  9____ VV   5' * *D 000000 a``    q==== 66666 rcK d}d|jjz}||t|23d{V\}}| d|fWVdSt|dfWV66dS#t $r}d|fWVYd}~dSd}~wwxYw)Nz%(objectCategory=pKIEnrollmentService)CN=Configuration,%sr)r)rrIMSADEnrollmentService_ATTRSMSADEnrollmentServicerrMrs r4list_enrollment_servicesz%MSLDAPClient.list_enrollment_servicess  8; $."B B4++KFajn+oo7777777ZUC  9____ VV  ) )% 0 0$ 666666 poo    q==== 66666 s'.A+A(A+!A++ B5BBrdcK tdtjtjztjzi}dd|fg}d}|d|z}d|jjz}||t||23d{V\}}| d|fWVdSt |dfWV66dS#t$r}d|fWVYd}~dSd}~wwxYw)NrrTz'(objectCategory=pKICertificateTemplate)z3(&(objectCategory=pKICertificateTemplate)(name=%s))r)rprqrr) rrr+r,r-rr)rrIMSADCertificateTemplate_ATTRSMSADCertificateTemplaterrM) r2rdrrqrPrrrQrRrSs r4list_certificate_templatesz'MSLDAPClient.list_certificate_templatessi "Gn.VWeXA/ABPBk/k$lmm9($ 0@0@AB8:; G$NK $."B B4++KFcnv@D+EE9999999ZUC  9____ VV ! + +E 2 2D 888888 EEE    q==== 66666 s*BCB= C!C C CCc`K d}||gd23d{V\}}| ddd|fWVdS|dd|dd|dddfWVm6dS#t$r}ddd|fWVYd}~dSd}~wwxYw)N-(objectClass=msDS-GroupManagedServiceAccount))rrKmsDS-ManagedPasswordr#rprrKr)rIrrM)r2rPrQrRrSs r4 list_gmsazMSLDAPClient.list_gmsaso  A;++KGKGKGK+LL_______ZUC  tS      VV   ! !"2 3 3U<5H5L5LMf5g5gino{i|jAjABXjYjY[_ ______ LLL    tT1  66666 s'BB BAB B- B((B-cK d}||t23d{V\}}| d|fWVdSt|}|dfWV86dS#t$r}d|fWVYd}~dSd}~wwxYw)Nrr#)rIr MSADGMSAUserrrM)r2rprPrQrRgmsauserrSs r4 get_all_gmsazMSLDAPClient.get_all_gmsas  A;++Kn+UUZUC  9____ VV%%e,,H D. VUU    q==== 66666 s&AAA#A A9'A44A9 computernamecK |/dddtdDz}|ddur|dz }|,ddtdD}|jjd dd dd d }gd ||ddd|dd|d}d|ddd|jj}|||d{V\}}||ddgi}|j ||d{V\}}||| ||d{V\}}||| |d{V\} }||| |dfS#t$r} dd| fcYd} ~ Sd} ~ wwxYw)NzCOMP%s$r|c3lK|]/}tjtjtjzV0dSr8randomchoicestringascii_uppercasedigitsrrhs r4 z,MSLDAPClient.add_computer..s7&o&oabv}V5Kfm5['\'\&o&o&o&o&o&or6$Fc3rK|]2}tjtjtjzdzV3dS)z!@#$%+Nrrs r4rz,MSLDAPClient.add_computer..s<kk\]v}V%;fm%Kh%VWWkkkkkkr6DC=rur6)r9r8r7r rFr$z HOST/{}.{})r!rrdrzCN=z,CN=Computers,rJ)rrI) r}rangeendswithr)rrr>r?r*rr@rrM) r2rr3rBrprrhrRrrFrSs r4 add_computerzMSLDAPClient.add_computersi,rww&o&ofklmfnfn&o&o&ooooLC  E))CLwwkkafgiajajkkkkkH N , 4 4T" = = E Ec" M M U UVYZ] ^ ^6QQQ" " )00crc1BFKK ::$0#4#4#4dn6V6VW2((2z** * * * * * *61c o I,-7)""2w// / / / / / /61c o I&&r844 4 4 4 4 4 461c o I)),77777777=8S o I Hd ""  a-sF#F(( G2F<6G<GcK dd|fgi}|j||d{V\}}||dS#t$r }|cYd}~Sd}~wwxYw)Nrr)r*rrM)r2rrrrhrRrSs r4change_samaccountnamez"MSLDAPClient.change_samaccountnames   >237)""2w// / / / / / /61c o I $    888888 s/5 A AA A sdcK t|trtj|}i}i}d|t |j<d|t |j<|j&|jjD]}d|t |j <|j &|j jD]}d|t |j <|D],}| |d{V\}}}||||f||<-|dfS#t$r} d| fcYd} ~ Sd} ~ wwxYw)zDResolves all SIDs found in security descriptor, returns lookup tabler=N) rbytesr rwrrGrouprrr{Sacl resolv_sidrM) r2r lookup_tableracerrBusernamerRrSs r4 resolv_sdzMSLDAPClient.resolv_sdsMU,  ' + +B< 44BH 4BH gw|T#cg,,gw|T#cg,,++s"&//#"6"6666666FHc  Y*L    '>>>>>>sC'C,, D6C?9D?DT use_cachecNK t|}|tvrdt|dfSd}d}|ddd}||jvrt jd|zdS|j|}||jvr|j|}nTd|z}||d g 23d{V\}}|dd|fcS|d  d }/6||d dfS|d ur ||j|<||dfS#t$r} dd| fcYd} ~ Sd} ~ wwxYw)zSPerforms a SID lookup for object and returns the domain name and the samaccountnameBUILTINN-r=rzDomain SID "%s" was not found! )???rNrrr#rprT) rrMrrsplitr/r r`r.rIrrM) r2rrrBrr1rPrQrRrSs r4rzMSLDAPClient.resolv_sid1s S  3 Z jot ++ 68zz#a  #9t,,, L2Y>???    !) ,6 T_s#HH$c)K ,,[HXGY,ZZ:::::::jeS  4_l#''(899XX[  E4 4#DOC (D   a-sB9D AD AD C0 D #D 8D D$DD$D$cDK|jd{VSr8)r*whoamir:s r4rzMSLDAPClient.whoamiRs,y!! ! ! ! ! ! !!r6cKi} |d{V\}}||||d<g|d<|ddur#|dddd\}}||d <||d <||d{V\}}||t |j|d <|dt |ji|d <||j23d{V\}}|||dt |d |d |<| |d{V\}}}||||f|d |<r6|dfS#|dfcYSxYw)z Full whoamiNraw tokengroupszu:Trn\r=rBrrgroups)NAr) r startswithr=rrrerrrr) r2r rirRrBrr  group_sidrs r4 whoamifullzMSLDAPClient.whoamifullUs &KKMM!!!!!!83 o I6%=6- nnTd"" W]]433FNF8-F mmN33333333ID#  Y''F5M =  T^!4!4555F8 $ 4 4T5K L L6666666ni  i M!!#i..111#.VHi #'??9#=#=======VXs  i$*H#5VHi  !M $, $,sC3E09E+?A0E00E8cKd}||dg23d{V\}}| d|fWVdS|diddfWVE6tjddS)Nz(&(sAMAccountType=805306369)(!(userAccountControl:1.2.840.113556.1.4.803:=8192))(userAccountControl:1.2.840.113556.1.4.803:=524288))rrprrIrr r`rs r4get_unconstrained_machinesz'MSLDAPClient.get_unconstrained_machinesxsX+**;9I8JKKAAAAAAAJE3 o )OOOO FF < $ $ ( ()9 : :D @@@@@@ L  ,./////A!cKd}||dg23d{V\}}| d|fWVdS|diddfWVE6tjddS)NzP(&(sAMAccountType=805306368)(userAccountControl:1.2.840.113556.1.4.803:=524288))rrprrrs r4get_unconstrained_usersz$MSLDAPClient.get_unconstrained_userssc+**;9I8JKKAAAAAAAJE3 o )OOOO FF < $ $ ( ()9 : :D @@@@@@ L  ,./////rcKd}||ddg23d{V\}}| d|fWVdS|didfWV26tjddS)NzV(&(|(sAMAccountType=805306369)(sAMAccountType=805306368))(msDS-AllowedToDelegateTo=*))rzmsDS-AllowedToDelegateTorprrrs r4get_all_constrainedz MSLDAPClient.get_all_constrainedsi+**;9IKe8fgg+++++++JE3 o )OOOO FF < $ $d ****** h  ,./////sAcKd}||dg23d{V\}}| d|fWVdS|diddfWVE6tjddS)Nzo(&(|(sAMAccountType=805306369)(sAMAccountType=805306368))(userAccountControl:1.2.840.113556.1.4.803:=16777216))rrprrrs r4get_all_s4u2proxyzMSLDAPClient.get_all_s4u2proxysC+**;9I8JKKAAAAAAAJE3 o )OOOO FF < $ $ ( ()9 : :D @@@@@@ L  ,./////rcK d|z}||ddg23d{V\}}|||dddfcS6dS#t$r}d|fcYd}~Sd}~wwxYw)z7Fetches the DN of an object based on the sAMAccountNamerrreNrprIrM)r2rrorQrRrSs r4sam2dnzMSLDAPClient.sam2dns > 15++E4G3UVV:::::::ZUC  Y  2 3T 9999WVV  '>>>>>>s-AAAA AAAAcK d|z}||dg23d{V\}}|||dddfcS6dS#t$r}d|fcYd}~Sd}~wwxYw)z2Fetches the DN of an object based on the objectSidrrNrpr)r2rrorQrRrSs r4sid2dnzMSLDAPClient.sid2dns c !5++E4G3HII:::::::ZUC  Y  2 3T 9999JII  '>>>>>>s-AAAA A AAAcK dt|z}||dg23d{V\}}|||dddfcS6dS#t$r}d|fcYd}~Sd}~wwxYw)z2Fetches the objectSid of an object based on the DNrGreNrprr2rrorQrRrSs r4dn2sidzMSLDAPClient.dn2sids #&9"&=&= =5++EK=AA2222222ZUC  Y  { +T 1111BAA  '>>>>>>-)AA A A A(A#A(#A(cK dt|z}||dg23d{V\}}|||dddfcS6dS#t$r}d|fcYd}~Sd}~wwxYw)z7Fetches the sAMAccountName of an object based on the DNrGrNrprrs r4dn2samzMSLDAPClient.dn2sams #&9"&=&= =5++E4D3EFF7777777ZUC  Y  / 0$ 6666GFF  '>>>>>>rcK dt|z}|||23d{V\}}|||ddfcS6dS#t$r}d|fcYd}~Sd}~wwxYw)z/Fetches attributes of an object specified by DNrGNrprr)r2rrrorQrRrSs r4dnattrszMSLDAPClient.dnattrss #&9"&=&= =5++E599%%%%%%%ZUC  Y   $$$$: *  '>>>>>>s-(A AA A A!AA!A!cK d}gd}||||d23d{V\}}|||ddfWV6dS#t$r}d|fWVYd}~dSd}~wwxYw)Nz(|(objectClass=container)(objectClass=organizationalUnit)(sAMAccountType=805306369)(objectClass=group)(&(objectCategory=person)(objectClass=user))))rer!r"rrsAMAccountTyper=)rrrsrpr)r2rrorrQrRrSs r4get_childobjectszMSLDAPClient.get_childobjectss a5 m m m5++E5rPQ+RR$$$$$$$ZUC  Y  t ######SRR  q==========s A?A A AAc Kd|jzd|jzd|jzg}gd}t} |D]}d}||ddg|23d {V\}}|||d d t fd |Dr;t |j|d d}t |d } | d fWVs6d S#t$r} d | fWVYd } ~ d Sd } ~ wwxYw)z!Lists all DNS zones in the forest$CN=MicrosoftDNS,DC=DomainDnsZones,%s$CN=MicrosoftDNS,DC=ForestDnsZones,%sCN=MicrosoftDNS,CN=System,%s)RootDNSServersz..TrustAnchors_msdcsz(objectClass=dnsZone)dc dNSPropertyrNrpc3 K|]}|vV dSr8r9)rrzones r4rz,MSLDAPClient.dnslistzones..s' - -aATM - - - - - -r6c|jSr8)_id)props r4z+MSLDAPClient.dnslistzones..stxr6)key)r(rrIallmaprwsortedrM) r2dnsroots blacklistfactorydnsrootrorQrRmap_objpropsrSr s @r4 dnslistzoneszMSLDAPClient.dnslistzoness *DJ6)DJ6!DJ.()  '  w #E ,,Um?T[b,cc       jeS  i ,  %T - - - -9 - - ---G&l(;M(JKKgW"7"7888e % dc    q==========s$ C CA/C C'C""C'cKd|jzd|jzd|jzg}|23d{V\}}}|||d|z(6 |D]}d} ||gd|23d{V\}}||d |d vs|d d 'd |d vr|d d d ur|d urFd|d vrQ|d dD])} ||d d t j| dfWV*6#t $r|ntd|zYwxYwdS#t$r} ddd| fWVYd} ~ dSd} ~ wwxYw)z#Lists all DNS entries in the forestrrrNz'CN=MicrosoftDNS,DC=ForestDnsZones,DC=%sz(objectClass=dnsNode)) dnsRecord dNSTombstonedrdrrdrprTFrzZone %s not found!)r(rrrIrrwrrM) r2r with_tombstonesrrQrhrRrro recorddatarSs r4 dnsentrieszMSLDAPClient.dnsentriessj*DJ6)DJ6!DJ.( "..00FFFFFFFME1c o I ??((DI(((( 7J00$s)0000"c      D0C000028M00490000<     00000&0C0000&!!!"&00t0000200d0000.GUFno}pYGYZhZCGC11#1^11116ESDlm{nWEWXfXAEA>6XfWAOAjXjkykTXTIIsIInIIII:3B * *d3i * * * *0< ' '49 ' ' ' '8#8888$88888$8S8888 cT488888(88888(S(C8+++Z333:3H00d3i0000 %%c%%%%N32 2S 2 2 2 2 2S 2 2 2 2 2c 2 2 2 22c2s2222"2c2s2222" 2 2s 2 2 2 2 )S ) ) ) )22#22S222283C333333$3c3S3333&++S++++"EE3ES&[(9EDfDUEEEE* - -S&[(9 - - - - $3 $ $ $ $*C*#****X7777777r&&&&&&&P                      (    1C        --3-----^  #  c     1:U8 sdB"""!!!F000000000000             49       ###J****X,,,---#0##0##0#0#0#0#0#0r6r)/r?rxrrtypingrrrasyauth.common.credentialsrwinacl.dtyp.acerrwinacl.dtyp.guidr winacl.dtyp.security_descriptorr winacl.dtyp.sidr msldapr msldap.commons.commonr msldap.commons.exceptionsrmsldap.commons.targetrmsldap.commons.utilsrmsldap.connectionrmsldap.ldap_objectsmsldap.protocol.constantsrrrmsldap.protocol.messagesrmsldap.protocol.queryr#msldap.wintypes.asn1.sdflagsrequestrrmsldap.wintypes.dnsp.structuresrrrr9r6r4rKs $$$$$$$$$$444444FFFFFFFF!!!!!!??????555555444444999999......++++++444444!!!!AAAAAAAAAA,,,,,,555555FFFFFFFFJJJJJJJJA0A0A0A0A0A0A0A0A0A0r6