#!/usr/bin/env python3
# For authorized penetration testing and educational environments only.
# Usage against targets without prior mutual consent is illegal.
# It is the end user's responsibility to obey all applicable local, state and federal laws.
"""DCSync attack detection and analysis agent using impacket and ldap3."""

import json
import sys
import argparse
from datetime import datetime

try:
    import ldap3
    from ldap3 import Server, Connection, ALL, NTLM
except ImportError:
    print("Install: pip install ldap3")
    sys.exit(1)


def check_dcsync_permissions(server_ip, domain, username, password):
    """Check which accounts have DCSync-capable permissions (Replicating Directory Changes)."""
    server = Server(server_ip, get_info=ALL)
    conn = Connection(server, user=f"{domain}\\{username}", password=password,
                      authentication=NTLM, auto_bind=True)
    base_dn = ",".join([f"DC={p}" for p in domain.split(".")])
    conn.search(
        search_base=base_dn,
        search_filter="(objectClass=domain)",
        attributes=["nTSecurityDescriptor"],
    )
    dcsync_accounts = []
    REPL_CHANGES_GUID = "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2"
    REPL_ALL_GUID = "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2"
    conn.search(
        search_base=base_dn,
        search_filter="(&(objectCategory=person)(objectClass=user)(adminCount=1))",
        attributes=["sAMAccountName", "distinguishedName", "memberOf"],
    )
    for entry in conn.entries:
        dcsync_accounts.append({
            "account": str(entry.sAMAccountName),
            "dn": str(entry.distinguishedName),
            "admin_count": True,
            "risk": "HIGH",
            "note": "adminCount=1 — potential DCSync privilege holder",
        })
    conn.unbind()
    return dcsync_accounts


def detect_dcsync_events(log_file=None):
    """Parse Windows Security event logs for DCSync indicators (Event IDs 4662, 4624)."""
    dcsync_indicators = {
        "4662": "Directory service access — replication operation",
        "4624": "Logon event — check for NTLM from unexpected source",
    }
    REPL_GUIDS = [
        "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
        "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
        "89e95b76-444d-4c62-991a-0facbeda640c",
    ]
    detections = []
    if log_file:
        try:
            with open(log_file, "r") as f:
                events = json.load(f)
            for event in events:
                eid = str(event.get("EventID", ""))
                if eid == "4662":
                    props = event.get("Properties", "")
                    for guid in REPL_GUIDS:
                        if guid in str(props).lower():
                            detections.append({
                                "event_id": eid,
                                "timestamp": event.get("TimeCreated", ""),
                                "account": event.get("SubjectUserName", ""),
                                "operation": dcsync_indicators[eid],
                                "guid_matched": guid,
                                "severity": "CRITICAL",
                            })
        except (FileNotFoundError, json.JSONDecodeError) as e:
            detections.append({"error": str(e)})
    return detections


def generate_sigma_rule():
    """Generate Sigma detection rule for DCSync activity."""
    return {
        "title": "DCSync Attack Detected via Directory Replication",
        "status": "production",
        "logsource": {"product": "windows", "service": "security"},
        "detection": {
            "selection": {
                "EventID": 4662,
                "Properties|contains": [
                    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2",
                    "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2",
                ],
            },
            "filter": {"SubjectUserName|endswith": "$"},
            "condition": "selection and not filter",
        },
        "level": "critical",
        "tags": ["attack.credential_access", "attack.t1003.006"],
    }


def run_audit(server, domain, username, password, log_file=None):
    """Run DCSync persistence audit."""
    print(f"\n{'='*60}")
    print(f"  DCSYNC PERSISTENCE AUDIT")
    print(f"  Domain: {domain} | Server: {server}")
    print(f"  Generated: {datetime.utcnow().isoformat()} UTC")
    print(f"{'='*60}\n")

    accounts = check_dcsync_permissions(server, domain, username, password)
    print(f"--- PRIVILEGED ACCOUNTS ({len(accounts)}) ---")
    for a in accounts[:15]:
        print(f"  [{a['risk']}] {a['account']}: {a['note']}")

    events = detect_dcsync_events(log_file)
    print(f"\n--- DCSYNC DETECTIONS ({len(events)}) ---")
    for e in events[:10]:
        if "error" not in e:
            print(f"  [{e['severity']}] {e['account']} at {e['timestamp']}")

    sigma = generate_sigma_rule()
    print(f"\n--- SIGMA RULE ---")
    print(f"  {sigma['title']}")
    print(f"  Level: {sigma['level']}")

    return {"accounts": accounts, "detections": events, "sigma_rule": sigma}


def main():
    parser = argparse.ArgumentParser(description="DCSync Detection Agent")
    parser.add_argument("--server", required=True, help="Domain controller IP")
    parser.add_argument("--domain", required=True, help="AD domain (e.g., corp.local)")
    parser.add_argument("--username", required=True, help="LDAP bind username")
    parser.add_argument("--password", required=True, help="LDAP bind password")
    parser.add_argument("--log-file", help="Windows event log JSON export to analyze")
    parser.add_argument("--output", help="Save report to JSON file")
    args = parser.parse_args()

    report = run_audit(args.server, args.domain, args.username, args.password, args.log_file)
    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2, default=str)
        print(f"\n[+] Report saved to {args.output}")


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
DCSync Rights Auditor and Hash Analysis Script

Audits AD environments for accounts with DCSync rights and
analyzes dumped credential data. For authorized red team engagements only.
"""

import sys
import os
import re
import json
from datetime import datetime
from collections import defaultdict


REPLICATION_GUIDS = {
    "1131f6aa-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes",
    "1131f6ad-9c07-11d1-f79f-00c04fc2dcd2": "DS-Replication-Get-Changes-All",
    "89e95b76-444d-4c62-991a-0facbeda640c": "DS-Replication-Get-Changes-In-Filtered-Set",
}


def parse_secretsdump_output(filepath: str) -> dict:
    """Parse Impacket secretsdump.py output for hash extraction."""
    results = {
        "ntds_hashes": [],
        "kerberos_keys": [],
        "cleartext_passwords": [],
        "machine_accounts": [],
        "user_accounts": [],
        "krbtgt_hash": None,
        "admin_hash": None
    }

    try:
        with open(filepath, "r") as f:
            lines = f.readlines()
    except FileNotFoundError:
        print(f"File not found: {filepath}")
        return results

    ntds_pattern = re.compile(r"^(.+?):([\d]+):([a-fA-F0-9]{32}):([a-fA-F0-9]{32}):::")
    cleartext_pattern = re.compile(r"^(.+?):CLEARTEXT:(.+)$")

    for line in lines:
        line = line.strip()

        ntds_match = ntds_pattern.match(line)
        if ntds_match:
            username = ntds_match.group(1)
            rid = ntds_match.group(2)
            lm_hash = ntds_match.group(3)
            nt_hash = ntds_match.group(4)

            entry = {
                "username": username,
                "rid": rid,
                "lm_hash": lm_hash,
                "nt_hash": nt_hash,
                "is_machine": username.endswith("$")
            }

            results["ntds_hashes"].append(entry)

            if entry["is_machine"]:
                results["machine_accounts"].append(entry)
            else:
                results["user_accounts"].append(entry)

            if username.lower() == "krbtgt":
                results["krbtgt_hash"] = entry
            elif username.lower() == "administrator":
                results["admin_hash"] = entry

        cleartext_match = cleartext_pattern.match(line)
        if cleartext_match:
            results["cleartext_passwords"].append({
                "username": cleartext_match.group(1),
                "password": cleartext_match.group(2)
            })

    return results


def analyze_password_reuse(hashes: list) -> dict:
    """Identify password reuse across accounts."""
    hash_groups = defaultdict(list)

    for entry in hashes:
        if entry["nt_hash"] != "31d6cfe0d16ae931b73c59d7e0c089c0":  # Skip empty passwords
            hash_groups[entry["nt_hash"]].append(entry["username"])

    reuse = {nt_hash: users for nt_hash, users in hash_groups.items() if len(users) > 1}
    return reuse


def generate_dcsync_report(results: dict, source_file: str) -> str:
    """Generate DCSync credential analysis report."""
    report = [
        "=" * 70,
        "DCSync Credential Analysis Report",
        f"Generated: {datetime.now().isoformat()}",
        f"Source: {source_file}",
        "=" * 70,
        "",
        "[Summary]",
        f"  Total Hashes: {len(results['ntds_hashes'])}",
        f"  User Accounts: {len(results['user_accounts'])}",
        f"  Machine Accounts: {len(results['machine_accounts'])}",
        f"  Cleartext Passwords: {len(results['cleartext_passwords'])}",
        ""
    ]

    # KRBTGT hash (most critical)
    if results["krbtgt_hash"]:
        report.append("[CRITICAL] KRBTGT Hash Recovered:")
        report.append(f"  NT Hash: {results['krbtgt_hash']['nt_hash']}")
        report.append("  Impact: Golden Ticket creation possible")
        report.append("")

    # Administrator hash
    if results["admin_hash"]:
        report.append("[CRITICAL] Administrator Hash Recovered:")
        report.append(f"  NT Hash: {results['admin_hash']['nt_hash']}")
        report.append("  Impact: Direct Domain Admin access via Pass-the-Hash")
        report.append("")

    # Password reuse analysis
    reuse = analyze_password_reuse(results["user_accounts"])
    if reuse:
        report.append(f"[HIGH] Password Reuse Detected ({len(reuse)} shared passwords):")
        for nt_hash, users in list(reuse.items())[:10]:
            report.append(f"  Hash ...{nt_hash[-8:]}: {', '.join(users[:5])}")
        report.append("")

    # Cleartext passwords
    if results["cleartext_passwords"]:
        report.append(f"[HIGH] Cleartext Passwords Found ({len(results['cleartext_passwords'])}):")
        for entry in results["cleartext_passwords"][:10]:
            report.append(f"  {entry['username']}: [REDACTED]")
        report.append("")

    report.extend([
        "[Persistence Opportunities]",
        "  1. Golden Ticket: Use KRBTGT hash for indefinite domain access",
        "  2. Silver Tickets: Use machine account hashes for service impersonation",
        "  3. Pass-the-Hash: Use NT hashes for immediate lateral movement",
        "  4. Password Cracking: Offline cracking of user hashes",
        "",
        "=" * 70
    ])

    return "\n".join(report)


def main():
    """Main entry point."""
    if len(sys.argv) < 2:
        print("Usage: python process.py <secretsdump_output.txt>")
        return

    source_file = sys.argv[1]
    results = parse_secretsdump_output(source_file)

    if not results["ntds_hashes"]:
        print("No NTDS hashes found in the input file.")
        return

    report = generate_dcsync_report(results, source_file)
    print(report)

    report_file = f"dcsync_analysis_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
    with open(report_file, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {report_file}")


if __name__ == "__main__":
    main()