pip install -r requirements.txt

# على جهاز منضم إلى المجال — يكتشف تلقائيًا وحدة التحكم بالمجال والمجال واسم المستخدم
# يطلب كلمة المرور بشكل آمن (لا تظهر أبدًا في الطرفية أو سجل الأوامر)
python detect_spn_abuse.py

# اكتشاف تلقائي مع تقرير CSV وكشف التغييرات الأخيرة
python detect_spn_abuse.py --csv report.csv --days 7

# تحديد اسم المستخدم فقط (اكتشاف الباقي تلقائيًا)
python detect_spn_abuse.py -u svc_scanner

# يدوي بالكامل
python detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc

# استخدام LDAPS (المنفذ 636)
python detect_spn_abuse.py --use-ssl

+==============================================================+
|  CVE-2026-25177 - SPN Unicode Collision Detector              |
|  Read-only scan - safe for production                         |
+==============================================================+

[+] Connected via NTLM:389 (read-only)
[*] Scanning all accounts with SPNs...
[+] Scanned 247 accounts, 1,042 SPNs

======================================================================
  SCAN RESULTS: 1 finding(s)
  CRITICAL: 1  |  HIGH: 0  |  INFO: 0
======================================================================

  [CRITICAL] Finding 1: SPN contains 1 suspicious Unicode character(s)
  ────────────────────────────────────────────────────────────
  Account:  jsmith
  DN:       CN=jsmith,CN=Users,DC=corp,DC=local
  SPN:      HTTP​/webserver.corp.local
  SPN Hex:  48545450e2808b2f7765627365727665722e636f72702e6c6f63616c
  Modified: 2026-03-13 14:22:17+00:00
    Position 4: U+200B - Zero-Width Space [invisible]

======================================================================

  RECOMMENDED ACTIONS:
  1. Investigate accounts with CRITICAL findings immediately
  2. Remove any SPNs containing Unicode characters
  3. Check Event Log for SPN modification events (Event ID 4742)
  4. Review delegation permissions (who can write SPNs)
  5. Apply Microsoft patch for CVE-2026-25177

schtasks /create /tn "CVE-2026-25177 Scanner" /tr "python C:\path\to\detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc -p 'password' --csv C:\logs\spn_scan.csv --days 1" /sc daily /st 06:00

0 6 * * * python3 /opt/detect_spn_abuse.py -dc dc01.corp.local -d corp.local -u scanner_svc -p 'password' --csv /var/log/spn_scan.csv --days 1