Recupera la descripción de las cuentas de AD y busca contraseñas en ella.
El propósito de esta herramienta es comprobar si hay contraseñas almacenadas en texto claro en la descripción de las cuentas de Active Directory.
Los requisitos son:
Si no tiene Python, puede usar la versión .exe de los scripts en la carpeta binary de este repositorio.
Quiere comprobar si hay contraseñas almacenadas en el campo de descripción de las cuentas de Active Directory de su organización.
Post-explotación: Ha volcado correctamente el ntds.dit y el hive SYSTEM y, mientras crackea los hashes, quiere comprobar si hay contraseñas en texto plano disponibles en el campo de descripción de las cuentas de Active Directory.
Instale los requisitos
$ git clone https://github.com/AssuranceMaladieSec/AD-description-password-finder.git
$ pip3 install -r requirements.txt
> python check_description.py -h
usage: check_description.py [-h] [-system SYSTEM] [-ntds NTDS] [-ts] [-debug]
optional arguments:
-h, --help show this help message and exit
-system SYSTEM SYSTEM hive to parse. MANDATORY
-ntds NTDS NTDS.DIT file to parse. MANDATORY
-ts Adds timestamp to every logging output during hashes extraction
-debug Turn DEBUG output ON during hashes extraction
> python check_description.py -ntds ntds\ntds.dit -system ntds\SYSTEM
Extracting hash and descriptions in the ntds
Saving output to ntds/output.ntds
Creating hash file in './output/description_hashes.json' and plain text file in './output/description_plain.json'
Done!
Loading ./output/description_hashes.json
Loading ./output/description_plain.json
Loading ./ntds/output.ntds
We have 9 user's descriptions to analyze
Done!
We found 4 CONFIRMED password in the accounts description
2 accounts are SUSPECTED of exposing their passwords and need to be verified by a HUMAN
You can find the results in the file ./results/2022-07-21_17h8_results.txt
That's all folks!
CONFIRMED_LEAK - Disabled user - password for user adm-test-alice2 found in description: Achanger6Achanger6!
CONFIRMED_LEAK - Enabled (probably) user - password for user adm-test-alice found in description: Achanger1Achanger2!
SUSPECTED_LEAK - Enabled (probably) user - SUSPECTED password for user anakin in the description: here we go "pwd=test01!"
SUSPECTED_LEAK - Enabled (probably) user - SUSPECTED password for user ahsoka in the description: The new one for test (password=test054!)
CONFIRMED_LEAK - Enabled (probably) user - password for user mariatest02 found in description: test02!
CONFIRMED_LEAK - Enabled (probably) user - password for user blanqui found in description: woof01!
Esta herramienta utiliza una versión modificada del código de secretdump de la librería Impacket.
Impacket es una herramienta de SECUREAUTH LABS. Copyright (C) 2022 SecureAuth Corporation. Todos los derechos reservados.
GNU GENERAL PUBLIC LICENSE (GPL) Version 3