def dump_trusts(self, filename='trusts.csv'):
entries = self.get_trusts()
try:
logging.debug('Opening file for writing: %s' % filename)
out = codecs.open(filename, 'w', 'utf-8')
except:
logging.warning('Could not write file: %s' % filename)
return
logging.debug('Writing trusts to file: %s' % filename)
out.write(
'SourceDomain,TargetDomain,TrustDirection,TrustType,Transitive\n')
entriesNum = 0
for entry in entries:
entriesNum += 1
# TODO: self.ad is currently only a single domain. In multi domain mode
# this will need to be updated
trust = ADDomainTrust(self.ad.domain, entry['attributes']['name'],
entry['attributes']['trustDirection'],
entry['attributes']['trustType'],
entry['attributes']['trustAttributes'])
out.write(trust.to_output() + '\n')
logging.info('Found %u trusts', entriesNum)
logging.debug('Finished writing trusts')
out.close()
def dump_trusts(self, filename='domains.json'):
"""
Dump trusts. This is currently the only domain info we support, so
this function handles the entire domain dumping.
"""
entries = self.addc.get_trusts()
try:
logging.debug('Opening file for writing: %s' % filename)
out = codecs.open(filename, 'w', 'utf-8')
except:
logging.warning('Could not write file: %s' % filename)
return
# If the logging level is DEBUG, we ident the objects
if logging.getLogger().getEffectiveLevel() == logging.DEBUG:
indent_level = 1
else:
indent_level = None
logging.debug('Writing trusts to file: %s' % filename)
# Todo: fix this properly. Current code is quick fix to work with domains
# that have custom casing in their DN
domain_object = None
for domain in self.addomain.domains.keys():
if domain.lower() == self.addomain.baseDN.lower():
domain_object = self.addomain.domains[domain]
break
if not domain_object:
logging.error(
'Could not find domain object. Abortint trust enumeration')
return
# Initialize json structure
datastruct = {"domains": [], "meta": {"type": "domains", "count": 0}}
domain = {
"Name": self.addomain.domain,
"Properties": {
"highvalue": True,
"objectsid": domain_object['attributes']['objectSid']
},
"Trusts": [],
# The below is all for GPO collection, unsupported as of now.
"Links": [],
"Aces": [],
"Users": [],
"Computers": [],
"ChildOus": []
}
num_entries = 0
for entry in entries:
num_entries += 1
# TODO: self.addomain is currently only a single domain. In multi domain mode
# this might need to be updated
trust = ADDomainTrust(self.addomain.domain,
entry['attributes']['name'],
entry['attributes']['trustDirection'],
entry['attributes']['trustType'],
entry['attributes']['trustAttributes'])
domain['Trusts'].append(trust.to_output())
logging.info('Found %u trusts', num_entries)
# Single domain only
datastruct['meta']['count'] = 1
datastruct['domains'].append(domain)
json.dump(datastruct, out, indent=indent_level)
logging.debug('Finished writing trusts')
out.close()
def dump_domain(self, collect, filename='domains.json'):
"""
Dump trusts. This is currently the only domain info we support, so
this function handles the entire domain dumping.
"""
if 'trusts' in collect:
entries = self.addc.get_trusts()
else:
entries = []
try:
logging.debug('Opening file for writing: %s' % filename)
out = codecs.open(filename, 'w', 'utf-8')
except:
logging.warning('Could not write file: %s' % filename)
return
# If the logging level is DEBUG, we ident the objects
if logging.getLogger().getEffectiveLevel() == logging.DEBUG:
indent_level = 1
else:
indent_level = None
# Todo: fix this properly. Current code is quick fix to work with domains
# that have custom casing in their DN
domain_object = None
for domain in self.addomain.domains.keys():
if domain.lower() == self.addomain.baseDN.lower():
domain_object = self.addomain.domains[domain]
break
if not domain_object:
logging.error(
'Could not find domain object. Aborting domain enumeration')
return
# Initialize json structure
datastruct = {
"domains": [],
"meta": {
"type": "domains",
"count": 0,
"version": 3
}
}
# Get functional level
level_id = ADUtils.get_entry_property(domain_object,
'msds-behavior-version')
try:
functional_level = ADUtils.FUNCTIONAL_LEVELS[int(level_id)]
except KeyError:
functional_level = 'Unknown'
domain = {
"ObjectIdentifier": domain_object['attributes']['objectSid'],
"Properties": {
"name":
self.addomain.domain.upper(),
"domain":
self.addomain.domain.upper(),
"highvalue":
True,
"objectid":
ADUtils.get_entry_property(domain_object, 'objectSid'),
"distinguishedname":
ADUtils.get_entry_property(domain_object, 'distinguishedName'),
"description":
ADUtils.get_entry_property(domain_object, 'description'),
"functionallevel":
functional_level
},
"Trusts": [],
"Aces": [],
# The below is all for GPO collection, unsupported as of now.
"Links": [],
"Users": [],
"Computers": [],
"ChildOus": []
}
if 'acl' in collect:
resolver = AceResolver(self.addomain, self.addomain.objectresolver)
_, aces = parse_binary_acl(
domain, 'domain',
ADUtils.get_entry_property(domain_object,
'nTSecurityDescriptor'),
self.addc.objecttype_guid_map)
domain['Aces'] = resolver.resolve_aces(aces)
if 'trusts' in collect:
num_entries = 0
for entry in entries:
num_entries += 1
trust = ADDomainTrust(
ADUtils.get_entry_property(entry, 'name'),
ADUtils.get_entry_property(entry, 'trustDirection'),
ADUtils.get_entry_property(entry, 'trustType'),
ADUtils.get_entry_property(entry, 'trustAttributes'),
ADUtils.get_entry_property(entry, 'securityIdentifier'))
domain['Trusts'].append(trust.to_output())
logging.info('Found %u trusts', num_entries)
# Single domain only
datastruct['meta']['count'] = 1
datastruct['domains'].append(domain)
json.dump(datastruct, out, indent=indent_level)
logging.debug('Finished writing domain info')
out.close()