n00py/getfgppObtén una política de contraseñas de grano fino
Extrae las Directivas de Contraseña de Grano Fino (FGPP) de Active Directory mediante LDAP.
Requiere acceso de lectura al Contenedor de Configuración de Contraseñas; por defecto solo los administradores tienen este derecho, pero en ocasiones está mal configurado.
pip3 install ldap3
(ya no se requiere python-dateutil)
usage: fgpp.py [-h] -l LDAPSERVER -d DOMAIN [-u USERNAME] [-p PASSWORD]
[-H HASHES] [--use-ldaps] [--kerberos] [--port PORT]
options:
-l, --ldapserver LDAP server (hostname or IP)
-d, --domain AD domain (e.g. corp.local)
-u, --username LDAP username
-p, --password LDAP password
-H, --hashes NTLM hashes (lmhash:nthash or :nthash)
--use-ldaps Use LDAPS (SSL/TLS)
--kerberos Use Kerberos (GSSAPI)
--port Custom port (default: 389 or 636)
Autenticación con contraseña:
python3 fgpp.py -l dc01.corp.local -d corp.local -u Administrator -p Password123
Pass-the-hash:
python3 fgpp.py -l 10.10.10.1 -d corp.local -u Administrator -H :aabbccddeeff00112233445566778899
LDAPS:
python3 fgpp.py -l dc01.corp.local -d corp.local -u jdoe -p Password123 --use-ldaps
Kerberos (requiere un TGT válido):
python3 fgpp.py -l dc01.corp.local -d corp.local --kerberos
[*] Using NTLM authentication for corp.local\Administrator...
[+] LDAP bind successful.
[*] Searching for Fine Grained Password Policies...
[+] 2 FGPP policies found.
Policy Name: DA Policy
Precedence (lower = higher): 1
Minimum Password Length: 14
Password History Length: 24
Complexity Enabled: TRUE
Reversible Encryption: FALSE
Minimum Password Age: 1 days 0 hours 0 minutes 0 seconds
Maximum Password Age: 42 days 0 hours 0 minutes 0 seconds
Lockout Threshold: 3
Observation Window: 0 days 0 hours 30 minutes 0 seconds
Lockout Duration: 0 days 1 hours 0 minutes 0 seconds
Policy Applies To: CN=Domain Admins,CN=Users,DC=corp,DC=local
Policy Name: DU Policy
Precedence (lower = higher): 2
Minimum Password Length: 6
Password History Length: 0
Complexity Enabled: FALSE
Reversible Encryption: TRUE
...