goddi

Documentation

Overview

Package goddi contains ldap query functions https://msdn.microsoft.com/en-us/library/ms675090(v=vs.85).aspx https://social.technet.microsoft.com/wiki/contents/articles/5392.active-directory-ldap-syntax-filters.aspx

Index

• Constants
• func Connect(li *LdapInfo)
• func GetCWD() string
• func GetDomainAccountPolicy(conn *ldap.Conn, baseDN string)
• func GetDomainComputers(conn *ldap.Conn, baseDN string)
• func GetDomainControllers(conn *ldap.Conn, baseDN string)
• func GetDomainGPOs(conn *ldap.Conn, baseDN string)
• func GetDomainOUs(conn *ldap.Conn, baseDN string)
• func GetDomainSite(conn *ldap.Conn, baseDN string)
• func GetDomainSubnet(conn *ldap.Conn, baseDN string)
• func GetDomainTrusts(conn *ldap.Conn, baseDN string)
• func GetFSMORoles(conn *ldap.Conn, baseDN string)
• func GetGPP(conn *ldap.Conn, baseDN string, dc string, user string, pass string)
• func GetGroupMembers(conn *ldap.Conn, baseDN string, group string)
• func GetGroupsAll(conn *ldap.Conn, baseDN string)
• func GetLAPS(conn *ldap.Conn, baseDN string)
• func GetMachineAccountOldPassword(conn *ldap.Conn, baseDN string)
• func GetSPNs(conn *ldap.Conn, baseDN string)
• func GetUsers(conn *ldap.Conn, baseDN string)
• func GetUsersDeligation(conn *ldap.Conn, baseDN string)
• func GetUsersDisabled(conn *ldap.Conn, baseDN string)
• func GetUsersLocked(conn *ldap.Conn, baseDN string)
• func GetUsersNoExpire(conn *ldap.Conn, baseDN string)
• func ValidateIPHostname(ldapServer string, domain string) (string, string)
• type DataSource
• type DataSources
• type Drive
• type Drives
• type Groups
• type LdapInfo
• type NTService
• type NTServices
• type Printers
• type Properties
• type ScheduledTasks
• type SharedPrinter
• type Task
• type User

Constants

const WindowsEpochFiletime int64 = 116444736000000000

WindowsEpochFiletime January 1, 1601 UTC (coordinate universal time)

Functions

func Connect

func Connect(li *LdapInfo)

Connect authenticated bind to ldap connection

func GetCWD

func GetCWD() string

GetCWD returns executable's current directory

func GetDomainAccountPolicy

func GetDomainAccountPolicy(conn *ldap.Conn, baseDN string)

GetDomainAccountPolicy domain Account Policy Reference: Scott Sutherland (@_nullbind)

func GetDomainComputers

func GetDomainComputers(conn *ldap.Conn, baseDN string)

GetDomainComputers all domain computers Reference: Scott Sutherland (@_nullbind)

func GetDomainControllers

func GetDomainControllers(conn *ldap.Conn, baseDN string)

GetDomainControllers all domain controllers Reference: Scott Sutherland (@_nullbind)

func GetDomainGPOs

func GetDomainGPOs(conn *ldap.Conn, baseDN string)

GetDomainGPOs domain GPOs Reference: Scott Sutherland (@_nullbind)

func GetDomainOUs

func GetDomainOUs(conn *ldap.Conn, baseDN string)

GetDomainOUs domain OUs Reference: Scott Sutherland (@_nullbind)

func GetDomainSite

func GetDomainSite(conn *ldap.Conn, baseDN string)

GetDomainSite domain sites Reference: Scott Sutherland (@_nullbind)

func GetDomainSubnet

func GetDomainSubnet(conn *ldap.Conn, baseDN string)

GetDomainSubnet domain subnets Reference: Scott Sutherland (@_nullbind)

func GetDomainTrusts

func GetDomainTrusts(conn *ldap.Conn, baseDN string)

GetDomainTrusts all domain trusts and details Reference: Scott Sutherland (@_nullbind)

func GetFSMORoles

func GetFSMORoles(conn *ldap.Conn, baseDN string)

GetFSMORoles domain FSMO Roles Reference: Scott Sutherland (@_nullbind)

func GetGPP

func GetGPP(conn *ldap.Conn, baseDN string, dc string, user string, pass string)

GetGPP grabs all GPP passwords Reference: Scott Sutherland (@_nullbind), Chris Campbell (@obscuresec) https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1

func GetGroupMembers

func GetGroupMembers(conn *ldap.Conn, baseDN string, group string)

GetGroupMembers all members of given group Reference: Scott Sutherland (@_nullbind)

func GetGroupsAll

func GetGroupsAll(conn *ldap.Conn, baseDN string)

GetGroupsAll all groups Reference: Scott Sutherland (@_nullbind)

func GetLAPS

func GetLAPS(conn *ldap.Conn, baseDN string)

GetLAPS LAPs passwords Reference: Scott Sutherland (@_nullbind), Karl Fosaaen (@kfosaaen), @_RastaMouse https://blog.netspi.com/running-laps-around-clearcleartext-passwords/ https://rastamouse.me/2018/03/laps---part-2/

func GetMachineAccountOldPassword

func GetMachineAccountOldPassword(conn *ldap.Conn, baseDN string)

GetMachineAccountOldPassword machine accounts with password older than 45 days Reference: Scott Sutherland (@_nullbind)

func GetSPNs

func GetSPNs(conn *ldap.Conn, baseDN string)

GetSPNs all SPNs and check for DA Reference: Scott Sutherland (@_nullbind)

func GetUsers

func GetUsers(conn *ldap.Conn, baseDN string)

GetUsers all domain users and checks for sensitive data in Description Reference: Scott Sutherland (@_nullbind)

func GetUsersDeligation

func GetUsersDeligation(conn *ldap.Conn, baseDN string)

GetUsersDeligation domain delegation Reference: Scott Sutherland (@_nullbind)

func GetUsersDisabled

func GetUsersDisabled(conn *ldap.Conn, baseDN string)

GetUsersDisabled disabled users Reference: Scott Sutherland (@_nullbind)

func GetUsersLocked

func GetUsersLocked(conn *ldap.Conn, baseDN string)

GetUsersLocked locked out users Reference: Scott Sutherland (@_nullbind)

func GetUsersNoExpire

func GetUsersNoExpire(conn *ldap.Conn, baseDN string)

GetUsersNoExpire users with passwords not set to expire Reference: Scott Sutherland (@_nullbind)

func ValidateIPHostname

func ValidateIPHostname(ldapServer string, domain string) (string, string)

ValidateIPHostname parses and returns hostname and ip for dc

Types

type DataSource

type DataSource struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

DataSource datasources.xml

type DataSources

type DataSources struct {
	XMLName     xml.Name     `xml:"DataSources"`
	DataSources []DataSource `xml:"DataSource"`
}

DataSources datasources.xml

type Drive

type Drive struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

Drive drive.xml

type Drives

type Drives struct {
	XMLName xml.Name `xml:"Drives"`
	Drives  []Drive  `xml:"Drive"`
}

Drives drives.xml

type Groups

type Groups struct {
	XMLName xml.Name `xml:"Groups"`
	Users   []User   `xml:"User"`
}

Groups groups.xml

type LdapInfo

type LdapInfo struct {
	LdapServer  string
	LdapIP      string
	LdapPort    uint16
	LdapTLSPort uint16
	User        string
	Usergpp     string
	Pass        string
	Domain      string
	Conn        *ldap.Conn
	Unsafe      bool
	StartTLS    bool
}

LdapInfo contains connection info

type NTService

type NTService struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

NTService services.xml

type NTServices

type NTServices struct {
	XMLName    xml.Name    `xml:"NTServices"`
	NTServices []NTService `xml:"NTService"`
}

NTServices services.xml

type Printers

type Printers struct {
	XMLName  xml.Name        `xml:"Printers"`
	Printers []SharedPrinter `xml:"SharedPrinter"`
}

Printers printers.xml

type Properties

type Properties struct {
	Runas       string `xml:"runAs,attr"`
	Accountname string `xml:"accountName,attr"`
	Username    string `xml:"userName,attr"`
	Cpassword   string `xml:"cpassword,attr"`
	Newname     string `xml:"newName,attr"`
}

Properties groups.xml, drives.xml, datasources.xml, services.xml, printers.xml, scheduledtasks.xml

type ScheduledTasks

type ScheduledTasks struct {
	XMLName        xml.Name `xml:"ScheduledTasks"`
	ScheduledTasks []Task   `xml:"Task"`
}

ScheduledTasks scheduledtasks.xml

type SharedPrinter

type SharedPrinter struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

SharedPrinter printers.xml

type Task

type Task struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

Task scheduledtasks.xml

type User

type User struct {
	Properties Properties `xml:"Properties"`
	Changed    string     `xml:"changed,attr"`
}

User groups.xml