Recursive function to split LDAP searches when size limit is exceeded Args: ldapConnection: LDAP connection object search_base: LDAP search base DN search_filter: Base search filter (e.g., "(objectClass=computer)") attributes:
(self, ldapConnection, search_base, search_filter, attributes,
prefix="", max_depth=7, current_depth=0, auth_label="", skipped_prefixes=None)
| 357 | return ip_address |
| 358 | |
| 359 | def _recursive_split_search(self, ldapConnection, search_base, search_filter, attributes, |
| 360 | prefix="", max_depth=7, current_depth=0, auth_label="", skipped_prefixes=None): |
| 361 | """ |
| 362 | Recursive function to split LDAP searches when size limit is exceeded |
| 363 | |
| 364 | Args: |
| 365 | ldapConnection: LDAP connection object |
| 366 | search_base: LDAP search base DN |
| 367 | search_filter: Base search filter (e.g., "(objectClass=computer)") |
| 368 | attributes: List of attributes to retrieve |
| 369 | prefix: Current prefix being searched (e.g., "S", "SA", "SAB") |
| 370 | max_depth: Maximum recursion depth (default 7 characters) |
| 371 | current_depth: Current recursion depth |
| 372 | auth_label: Label for logging (e.g., "Kerberos", "Password") |
| 373 | skipped_prefixes: List to track skipped prefixes (for reporting) |
| 374 | |
| 375 | Returns: |
| 376 | List of search results |
| 377 | """ |
| 378 | from impacket.ldap import ldapasn1 |
| 379 | |
| 380 | # Initialize skipped_prefixes list if this is the first call |
| 381 | if skipped_prefixes is None: |
| 382 | skipped_prefixes = [] |
| 383 | |
| 384 | all_results = [] |
| 385 | |
| 386 | # Create filter with current prefix |
| 387 | if prefix: |
| 388 | combined_filter = f"(&{search_filter}(cn={prefix}*))" |
| 389 | else: |
| 390 | combined_filter = search_filter |
| 391 | |
| 392 | log_prefix = f"{auth_label}: " if auth_label else "" |
| 393 | logger.debug(f"{log_prefix}Searching {prefix if prefix else 'all'}*... (depth {current_depth})") |
| 394 | |
| 395 | try: |
| 396 | resp = ldapConnection.search( |
| 397 | searchBase=search_base, |
| 398 | scope=2, |
| 399 | searchFilter=combined_filter, |
| 400 | attributes=attributes, |
| 401 | sizeLimit=0 |
| 402 | ) |
| 403 | |
| 404 | # Collect results |
| 405 | batch_count = 0 |
| 406 | for item in resp: |
| 407 | if isinstance(item, ldapasn1.SearchResultEntry): |
| 408 | all_results.append(item) |
| 409 | batch_count += 1 |
| 410 | |
| 411 | if batch_count > 0: |
| 412 | logger.debug(f"{log_prefix}Found {batch_count} computers with prefix '{prefix}', total: {len(all_results)}") |
| 413 | |
| 414 | return all_results |
| 415 | |
| 416 | except Exception as search_error: |
no test coverage detected