impacket_samr_protocol_domain_enumeration_dump.py

1#!/usr/bin/env python
2# Impacket - Collection of Python classes for working with network protocols.
3#
4# SECUREAUTH LABS. Copyright (C) 2021 SecureAuth Corporation. All rights reserved.
5#
6# This software is provided under a slightly modified version
7# of the Apache Software License. See the accompanying LICENSE file
8# for more information.
9#
10# Description:
11#   SAMR dump example.
12#
13# Author:
14#   Alberto Solino (@agsolino)
15
16import sys
17import logging
18import argparse
19from impacket.examples import logger
20from impacket import version
21from impacket.dcerpc.v5 import transport, samr
22from impacket.dcerpc.v5.rpcrt import DCERPCException
23
24class SAMRDump:
25    def __init__(self, username, password, domain, gateway, remote_name, remote_host):
26        self.__username = username
27        self.__password = password
28        self.__domain = domain
29        self.__gateway = gateway
30        self.__remote_name = remote_name
31        self.__remote_host = remote_host
32
33    def dump(self):
34        stringbinding = r'ncacn_np:%s[\pipe\samr]' % self.__remote_name
35        logging.info('StringBinding %s' % stringbinding)
36        rpc_transport = transport.DCERPCTransportFactory(stringbinding)
37        rpc_transport.set_dport(445)
38        rpc_transport.set_remote_host(self.__remote_host)
39
40        if hasattr(rpc_transport, 'set_credentials'):
41            # This method exists only for selected transports
42            rpc_transport.set_credentials(self.__username, self.__password, self.__domain)
43
44        dce = rpc_transport.get_dce_rpc()
45        dce.connect()
46        dce.bind(samr.MSRPC_UUID_SAMR)
47
48        try:
49            resp = samr.hSamrConnect(dce)
50            server_handle = resp['ServerHandle'] 
51
52            resp = samr.hSamrEnumerateDomainsInSamServer(dce, server_handle)
53            domains = resp['Buffer']['Element']
54
55            print('Found %d domain(s)' % len(domains))
56            for domain in domains:
57                print("Domain: %s" % domain['Name'])
58
59            dce.disconnect()
60        except  Exception as e:
61            logging.error(str(e))
62
63if __name__ == '__main__':
64    # Init the example's logger
65    logger.init()
66    print(version.BANNER)
67
68    parser = argparse.ArgumentParser(add_help = True, description = "SAMR dump example.")
69    parser.add_argument('target', action='store', help='[[domain/]username[:password]@]<targetName or address>')
70    
71    if len(sys.argv)==1:
72        parser.print_help()
73        sys.exit(1)
74
75    options = parser.parse_args()
76
77    import re
78    domain, username, password, remote_host = re.compile('(?:(?:([^/@:]*)/)?([^@:]*)(?::([^@]*))?@)?(.*)').match(options.target).groups('')
79
80    if domain is None:
81        domain = ''
82
83    dumper = SAMRDump(username, password, domain, '', remote_host, remote_host)
84    dumper.dump()