<s> import sys <EOL> import codecs <EOL> import logging <EOL> from impacket . nt_errors import STATUS_MORE_ENTRIES <EOL> from impacket . dcerpc . v5 import transport , samr <EOL> from impacket . dcerpc . v5 . rpcrt import DCERPCException <EOL> from time import strftime , gmtime <EOL> class PassPolDump : <EOL> KNOWN_PROTOCOLS = { <EOL> '<STR_LIT>' : ( r'<STR_LIT>' , <NUM_LIT> ) , <EOL> '<STR_LIT>' : ( r'<STR_LIT>' , <NUM_LIT> ) , <EOL> } <EOL> def __init__ ( self , logger , protocol , connection ) : <EOL> self . logger = logger <EOL> self . addr = connection . host <EOL> self . protocol = protocol <EOL> self . username = connection . username <EOL> self . password = connection . password <EOL> self . domain = connection . domain <EOL> self . hash = connection . hash <EOL> self . lmhash = '<STR_LIT>' <EOL> self . nthash = '<STR_LIT>' <EOL> self . aesKey = None <EOL> self . doKerberos = False <EOL> if self . hash is not None : <EOL> self . lmhash , self . nthash = self . hash . split ( '<STR_LIT::>' ) <EOL> if self . password is None : <EOL> self . password = '<STR_LIT>' <EOL> def enum ( self ) : <EOL> entries = [ ] <EOL> protodef = PassPolDump . KNOWN_PROTOCOLS [ '<STR_LIT>' . format ( self . protocol ) ] <EOL> port = protodef [ <NUM_LIT:1> ] <EOL> logging . info ( "<STR_LIT>" % self . protocol ) <EOL> rpctransport = transport . SMBTransport ( self . addr , port , r'<STR_LIT>' , self . username , self . password , self . domain , self . lmhash , self . nthash , self . aesKey , doKerberos = self . doKerberos ) <EOL> dce = rpctransport . get_dce_rpc ( ) <EOL> dce . connect ( ) <EOL> dce . bind ( samr . MSRPC_UUID_SAMR ) <EOL> resp = samr . hSamrConnect ( dce ) <EOL> serverHandle = resp [ '<STR_LIT>' ] <EOL> resp = samr . hSamrEnumerateDomainsInSamServer ( dce , serverHandle ) <EOL> domains = resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> resp = samr . hSamrLookupDomainInSamServer ( dce , serverHandle , domains [ <NUM_LIT:0> ] [ '<STR_LIT:Name>' ] ) <EOL> resp = samr . hSamrOpenDomain ( dce , serverHandle = serverHandle , domainId = resp [ '<STR_LIT>' ] ) <EOL> domainHandle = resp [ '<STR_LIT>' ] <EOL> self . logger . success ( '<STR_LIT>' ) <EOL> self . get_pass_pol ( self . addr , rpctransport , dce , domainHandle ) <EOL> def convert ( self , low , high , no_zero ) : <EOL> if low == <NUM_LIT:0> and hex ( high ) == "<STR_LIT>" : <EOL> return "<STR_LIT>" <EOL> if low == <NUM_LIT:0> and high == <NUM_LIT:0> : <EOL> return "<STR_LIT:None>" <EOL> if no_zero : <EOL> if ( low != <NUM_LIT:0> ) : <EOL> high = <NUM_LIT:0> - ( high + <NUM_LIT:1> ) <EOL> else : <EOL> high = <NUM_LIT:0> - ( high ) <EOL> low = <NUM_LIT:0> - low <EOL> tmp = low + ( high ) * <NUM_LIT:16> ** <NUM_LIT:8> <EOL> tmp *= ( <NUM_LIT> ) <EOL> try : <EOL> minutes = int ( strftime ( "<STR_LIT>" , gmtime ( tmp ) ) ) <EOL> except ValueError , e : <EOL> return "<STR_LIT>" <EOL> hours = int ( strftime ( "<STR_LIT>" , gmtime ( tmp ) ) ) <EOL> days = int ( strftime ( "<STR_LIT>" , gmtime ( tmp ) ) ) - <NUM_LIT:1> <EOL> time = "<STR_LIT>" <EOL> if days > <NUM_LIT:1> : <EOL> time = str ( days ) + "<STR_LIT>" <EOL> elif days == <NUM_LIT:1> : <EOL> time = str ( days ) + "<STR_LIT>" <EOL> if hours > <NUM_LIT:1> : <EOL> time += str ( hours ) + "<STR_LIT>" <EOL> elif hours == <NUM_LIT:1> : <EOL> time = str ( days ) + "<STR_LIT>" <EOL> if minutes > <NUM_LIT:1> : <EOL> time += str ( minutes ) + "<STR_LIT>" <EOL> elif minutes == <NUM_LIT:1> : <EOL> time = str ( days ) + "<STR_LIT>" <EOL> return time <EOL> def get_pass_pol ( self , host , rpctransport , dce , domainHandle ) : <EOL> resp = samr . hSamrQueryInformationDomain ( dce , domainHandle , samr . DOMAIN_INFORMATION_CLASS . DomainPasswordInformation ) <EOL> min_pass_len = resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> pass_hst_len = resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] <EOL> self . logger . highlight ( '<STR_LIT>' . format ( min_pass_len ) ) <EOL> self . logger . highlight ( '<STR_LIT>' . format ( pass_hst_len ) ) <EOL> max_pass_age = self . convert ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] , <EOL> resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] , <EOL> <NUM_LIT:1> ) <EOL> min_pass_age = self . convert ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] , <EOL> resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] , <EOL> <NUM_LIT:1> ) <EOL> self . logger . highlight ( '<STR_LIT>' . format ( max_pass_age ) ) <EOL> self . logger . highlight ( '<STR_LIT>' . format ( min_pass_age ) ) <EOL> resp = samr . hSamrQueryInformationDomain2 ( dce , domainHandle , samr . DOMAIN_INFORMATION_CLASS . DomainLockoutInformation ) <EOL> lock_threshold = int ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) <EOL> self . logger . highlight ( "<STR_LIT>" . format ( lock_threshold ) ) <EOL> lock_duration = None <EOL> if lock_threshold != <NUM_LIT:0> : lock_duration = int ( resp [ '<STR_LIT>' ] [ '<STR_LIT>' ] [ '<STR_LIT>' ] ) / - <NUM_LIT> <EOL> self . logger . highlight ( "<STR_LIT>" . format ( lock_duration ) ) </s>
