n00py/getfgppGet Fine Grained Password Policy
LDAP를 통해 Active Directory에서 세분화된 암호 정책(FGPP, Fine Grained Password Policies)을 덤프합니다.
암호 설정 컨테이너(Password Settings Container)에 대한 읽기 권한이 필요합니다. 기본적으로 관리자만 이 권한을 갖지만, 가끔 잘못 구성되어 있는 경우도 있습니다.
pip3 install ldap3
(python-dateutil 더 이상 필요하지 않음)
usage: fgpp.py [-h] -l LDAPSERVER -d DOMAIN [-u USERNAME] [-p PASSWORD]
[-H HASHES] [--use-ldaps] [--kerberos] [--port PORT]
options:
-l, --ldapserver LDAP server (hostname or IP)
-d, --domain AD domain (e.g. corp.local)
-u, --username LDAP username
-p, --password LDAP password
-H, --hashes NTLM hashes (lmhash:nthash or :nthash)
--use-ldaps Use LDAPS (SSL/TLS)
--kerberos Use Kerberos (GSSAPI)
--port Custom port (default: 389 or 636)
비밀번호 인증:
python3 fgpp.py -l dc01.corp.local -d corp.local -u Administrator -p Password123
Pass-the-hash:
python3 fgpp.py -l 10.10.10.1 -d corp.local -u Administrator -H :aabbccddeeff00112233445566778899
LDAPS:
python3 fgpp.py -l dc01.corp.local -d corp.local -u jdoe -p Password123 --use-ldaps
Kerberos (유효한 TGT 필요):
python3 fgpp.py -l dc01.corp.local -d corp.local --kerberos
[*] Using NTLM authentication for corp.local\Administrator...
[+] LDAP bind successful.
[*] Searching for Fine Grained Password Policies...
[+] 2 FGPP policies found.
Policy Name: DA Policy
Precedence (lower = higher): 1
Minimum Password Length: 14
Password History Length: 24
Complexity Enabled: TRUE
Reversible Encryption: FALSE
Minimum Password Age: 1 days 0 hours 0 minutes 0 seconds
Maximum Password Age: 42 days 0 hours 0 minutes 0 seconds
Lockout Threshold: 3
Observation Window: 0 days 0 hours 30 minutes 0 seconds
Lockout Duration: 0 days 1 hours 0 minutes 0 seconds
Policy Applies To: CN=Domain Admins,CN=Users,DC=corp,DC=local
Policy Name: DU Policy
Precedence (lower = higher): 2
Minimum Password Length: 6
Password History Length: 0
Complexity Enabled: FALSE
Reversible Encryption: TRUE
...