Get domain users list
(self, limit=10, verbose=True)
| 217 | return False |
| 218 | |
| 219 | def get_domain_users(self, limit=10, verbose=True): |
| 220 | """Get domain users list""" |
| 221 | try: |
| 222 | if verbose: |
| 223 | logger.debug(f"Searching for users in domain {self.domain}") |
| 224 | |
| 225 | # For Kerberos, skip this to avoid delays |
| 226 | if self.use_kerberos and self.kerberos_ticket: |
| 227 | if verbose: |
| 228 | logger.debug("Skipping user enumeration for Kerberos (speed optimization)") |
| 229 | return [] |
| 230 | |
| 231 | ldapConnection = LDAPConnection(f'ldap://{self.target}') |
| 232 | |
| 233 | # Authentication |
| 234 | if self.use_kerberos and self.kerberos_ticket: |
| 235 | if not self._load_kerberos_ticket(): |
| 236 | return [] |
| 237 | ldapConnection.kerberosLogin(self.username, self.password, self.domain, |
| 238 | self.lm_hash, self.nt_hash, useCache=True) |
| 239 | elif self.ntlm_hash: |
| 240 | ldapConnection.login(self.username, self.password, self.domain, |
| 241 | self.lm_hash, self.nt_hash) |
| 242 | else: |
| 243 | ldapConnection.login(self.username, self.password, self.domain) |
| 244 | |
| 245 | # Search for users |
| 246 | base_dn = f"DC={self.domain.replace('.', ',DC=')}" |
| 247 | search_filter = "(&(objectClass=user)(objectCategory=person))" |
| 248 | attributes = ['sAMAccountName', 'displayName', 'mail', 'lastLogon'] |
| 249 | |
| 250 | resp = ldapConnection.search( |
| 251 | searchBase=base_dn, |
| 252 | scope=2, # SCOPE_SUBTREE |
| 253 | searchFilter=search_filter, |
| 254 | attributes=attributes, |
| 255 | sizeLimit=limit |
| 256 | ) |
| 257 | |
| 258 | users = [] |
| 259 | for item in resp: |
| 260 | if isinstance(item, ldapasn1.SearchResultEntry): |
| 261 | user_info = {} |
| 262 | for attr in item['attributes']: |
| 263 | attr_name = str(attr['type']) |
| 264 | attr_values = [str(val) for val in attr['vals']] |
| 265 | user_info[attr_name] = attr_values[0] if attr_values else "" |
| 266 | users.append(user_info) |
| 267 | |
| 268 | if verbose: |
| 269 | logger.debug(f"Found {len(users)} users:") |
| 270 | for user in users: |
| 271 | logger.debug(f" - {user.get('sAMAccountName', 'N/A')} ({user.get('displayName', 'N/A')})") |
| 272 | |
| 273 | ldapConnection.close() |
| 274 | return users |
| 275 | |
| 276 | except Exception as e: |
no test coverage detected