ldap protocol enhancements #4667
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
…ter and desired attributes
|
As commit bd1238d is possible to connect, authenticate and query the Ldap server with custom filters chosing which attribute to get. Example: id: ldap-test-auth-search
info:
name: Test Authentication and Search method
author: 5amu
severity: info
javascript:
- args:
DomainController: "{{Host}}"
code: |
ldap = require("nuclei/ldap");
var client = ldap.LdapClient();
var connected = client.Connect(DomainController, Port, false, false);
var authenticated = client.Authenticate(template.Domain, template.Username, template.Password);
var filter = "(&(!(userAccountControl:1.2.840.113556.1.4.803:=2))(objectCategory=person)(servicePrincipalName=*))"
var res = client.Search(filter, "sAMAccountName", "servicePrincipalName")
to_json(res)
extractors:
- type: json
json:
- '.[] | "\(.sAMAccountName[0]) => \(.servicePrincipalName.[])"' |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Features from NmapI saw the list of feateres from nmap that @tarunKoyalwar linked in the issue: https://nmap.org/nsedoc/lib/ldap.html
Extra Features
Caveats
|
|
Thanks for this contribution @5amu ! |
| serverName = c.cfg.ServerName | ||
| } | ||
| conn, err = protocolstate.Dialer.DialTLSWithConfig(context.TODO(), "tcp", net.JoinHostPort(host, port), | ||
| &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS10, ServerName: serverName}) |
Check failure
Code scanning / CodeQL
Disabled TLS certificate check High
| if c.cfg.ServerName != "" { | ||
| serverName = c.cfg.ServerName | ||
| } | ||
| if err := c.conn.StartTLS(&tls.Config{InsecureSkipVerify: true, ServerName: serverName}); err != nil { |
Check failure
Code scanning / CodeQL
Disabled TLS certificate check High
| serverName = c.cfg.ServerName | ||
| } | ||
| conn, err = protocolstate.Dialer.DialTLSWithConfig(context.TODO(), "tcp", net.JoinHostPort(host, port), | ||
| &tls.Config{InsecureSkipVerify: true, MinVersion: tls.VersionTLS10, ServerName: serverName}) |
Check failure
Code scanning / CodeQL
Insecure TLS configuration High
tarunKoyalwar
approved these changes
Feb 5, 2024
There was a problem hiding this comment.
lgtm !
$ ./nuclei -u 192.168.122.100 -t b.yaml -V Realm=mydomain.com -debug
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.1.10
projectdiscovery.io
[INF] Current nuclei version: v3.1.10 (latest)
[INF] Current nuclei-templates version: v9.7.5 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 106
[INF] Templates loaded for current scan: 1
[WRN] Executing 1 unsigned templates. Use with caution.
[INF] Targets loaded for current scan: 1
[DBG] [ldap-collect-metadata] Dumped Javascript request for 192.168.122.100:
Variables:
1. DC => ldap://192.168.122.100
2. Pass => Pa$$w0rd
3. Port =>
4. User => tarun-admin address=192.168.122.100
[DBG] [ldap-collect-metadata] Javascript Code:
const ldap = require("nuclei/ldap");
const client = new ldap.Client(DC, template.Realm)
client.Authenticate(User, Pass)
to_json(client.CollectMetadata())
[DBG] [ldap-collect-metadata] Dumped Javascript response for 192.168.122.100:
1. response => { "BaseDN": "dc=mydomai .... ame": "DC.mydomain.com" }
2. success => true address=192.168.122.100
[ldap-collect-metadata] [javascript] [info] 192.168.122.100 ["{\"BaseDN\":\"dc=mydomain,dc=com\",\"DefaultNamingContext\":\"DC=mydomain,DC=com\",\"DnsHostName\":\"DC.mydomain.com\",\"Domain\":\"\",\"DomainControllerFunctionality\":\"7\",\"DomainFunctionality\":\"7\",\"ForestFunctionality\":\"7\"}"]$ ./nuclei -u 192.168.122.100 -t a.yaml -V Realm=mydomain.com -debug
__ _
____ __ _______/ /__ (_)
/ __ \/ / / / ___/ / _ \/ /
/ / / / /_/ / /__/ / __/ /
/_/ /_/\__,_/\___/_/\___/_/ v3.1.10
projectdiscovery.io
[INF] Current nuclei version: v3.1.10 (latest)
[INF] Current nuclei-templates version: v9.7.5 (latest)
[WRN] Scan results upload to cloud is disabled.
[INF] New templates added in latest release: 106
[INF] Templates loaded for current scan: 1
[WRN] Executing 1 unsigned templates. Use with caution.
[INF] Targets loaded for current scan: 1
[DBG] [ldap-get-spn] Dumped Javascript request for 192.168.122.100:
Variables:
1. DC => ldap://192.168.122.100
2. Pass => Pa$$w0rd
3. Port =>
4. User => tarun-admin address=192.168.122.100
[DBG] [ldap-get-spn] Javascript Code:
const ldap = require("nuclei/ldap");
const client = new ldap.Client(DC, template.Realm)
client.Authenticate(User, Pass)
var res = client.Search(ldap.FilterHasServicePrincipalName, "servicePrincipalName")
to_json(res)
[DBG] [ldap-get-spn] Dumped Javascript response for 192.168.122.100:
1. response => [ { "servicePrincip .... min/changepw" ] } ]
2. success => true address=192.168.122.100
[ldap-get-spn] [javascript] [info] 192.168.122.100 ["null => ldap/DC.mydomain.com/ForestDnsZones.mydomain.com","null => GC/DC.mydomain.com/mydomain.com","null => HOST/DC.mydomain.com","null => ldap/e8526d24-8019-4ab8-b5be-df51fb892a01._msdcs.mydomain.com","null => kadmin/changepw","null => Dfsr-12F9A27C-BF97-4787-9364-D31B6C55EB04/DC.mydomain.com","null => ldap/DC.mydomain.com/MYDOMAIN","null => HOST/CLIENT1","null => HOST/DC","null => DNS/DC.mydomain.com","null => WSMAN/CLIENT1.mydomain.com","null => HOST/CLIENT1.mydomain.com","null => ldap/DC","null => ldap/DC.mydomain.com/DomainDnsZones.mydomain.com","null => RestrictedKrbHost/DC.mydomain.com","null => RPC/e8526d24-8019-4ab8-b5be-df51fb892a01._msdcs.mydomain.com","null => HOST/DC.mydomain.com/mydomain.com","null => E3514235-4B06-11D1-AB04-00C04FC2DCD2/e8526d24-8019-4ab8-b5be-df51fb892a01/mydomain.com","null => ldap/DC/MYDOMAIN","null => HOST/DC/MYDOMAIN","null => ldap/DC.mydomain.com","null => ldap/DC.mydomain.com/mydomain.com","null => WSMAN/CLIENT1","null => RestrictedKrbHost/CLIENT1","null => HOST/DC.mydomain.com/MYDOMAIN","null => RestrictedKrbHost/DC","null => RestrictedKrbHost/CLIENT1.mydomain.com"]Great Work @5amu , i especially appreciate hardcoded OID's and flexible search and filter methods 🔥
I could not use the fastdialer net.Conn as underlying connection for the ldap client, so I used the vanilla net.Conn, created with ldap.Dial and ldap.DialTLS.
I used ldap.NewConn and passed conn created by fastdialer that took care of default dialer issue
|
Hi @tarunKoyalwar! Thank you for the improvements! It is really easier to use in a template. It should be stored in the object as the BaseDN is built from the Realm (and it is necessary to query active directory). For example: func NewClient(call goja.ConstructorCall, runtime *goja.Runtime) *goja.Object {
// omitted for brevity
// validate arguments
c.nj.Require(ldapUrl != "", "ldap url cannot be empty")
c.nj.Require(realm != "", "realm cannot be empty")
c.Realm = realm // this is the line to add
// omitted for brevity
}I don't know what's the etiquette in this situation, but please add this before release. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Closes #4645
I'm implementing the following features:
I'm still working on it, I'm starting the PR just to track progress 😄