n00py/getfgppGet Fine Grained Password Policy
通过 LDAP 从 Active Directory 导出细粒度密码策略 (FGPP)。
需要对密码设置容器（Password Settings Container）具有读取权限——默认情况下只有管理员拥有该权限，但偶尔也会配置不当。
pip3 install ldap3
（不再需要 python-dateutil）
usage: fgpp.py [-h] -l LDAPSERVER -d DOMAIN [-u USERNAME] [-p PASSWORD]
[-H HASHES] [--use-ldaps] [--kerberos] [--port PORT]
options:
-l, --ldapserver LDAP server (hostname or IP)
-d, --domain AD domain (e.g. corp.local)
-u, --username LDAP username
-p, --password LDAP password
-H, --hashes NTLM hashes (lmhash:nthash or :nthash)
--use-ldaps Use LDAPS (SSL/TLS)
--kerberos Use Kerberos (GSSAPI)
--port Custom port (default: 389 or 636)
密码认证：
python3 fgpp.py -l dc01.corp.local -d corp.local -u Administrator -p Password123
哈希传递：
python3 fgpp.py -l 10.10.10.1 -d corp.local -u Administrator -H :aabbccddeeff00112233445566778899
LDAPS：
python3 fgpp.py -l dc01.corp.local -d corp.local -u jdoe -p Password123 --use-ldaps
Kerberos（需要有效的 TGT）：
python3 fgpp.py -l dc01.corp.local -d corp.local --kerberos
[*] Using NTLM authentication for corp.local\Administrator...
[+] LDAP bind successful.
[*] Searching for Fine Grained Password Policies...
[+] 2 FGPP policies found.
Policy Name: DA Policy
Precedence (lower = higher): 1
Minimum Password Length: 14
Password History Length: 24
Complexity Enabled: TRUE
Reversible Encryption: FALSE
Minimum Password Age: 1 days 0 hours 0 minutes 0 seconds
Maximum Password Age: 42 days 0 hours 0 minutes 0 seconds
Lockout Threshold: 3
Observation Window: 0 days 0 hours 30 minutes 0 seconds
Lockout Duration: 0 days 1 hours 0 minutes 0 seconds
Policy Applies To: CN=Domain Admins,CN=Users,DC=corp,DC=local
Policy Name: DU Policy
Precedence (lower = higher): 2
Minimum Password Length: 6
Password History Length: 0
Complexity Enabled: FALSE
Reversible Encryption: TRUE
...