#!/usr/bin/env python3
"""Agent for detecting noPac (CVE-2021-42278/42287) AD privilege escalation vulnerability."""

import argparse
import json
import subprocess
import sys
from datetime import datetime, timezone


def check_nopac_impacket(domain, username, password, dc_ip):
    """Check for noPac vulnerability using Impacket noPac.py."""
    cmd = [
        "noPac.py", f"{domain}/{username}:{password}",
        "-dc-ip", dc_ip, "--scan",
    ]
    try:
        result = subprocess.check_output(
            cmd, text=True, errors="replace", timeout=30
        )
        return {
            "method": "noPac.py",
            "vulnerable": "VULNERABLE" in result.upper() or "success" in result.lower(),
            "output": result[:1000],
        }
    except (subprocess.SubprocessError, FileNotFoundError):
        return {"method": "noPac.py", "status": "tool not available"}


def check_machineaccountquota(domain, username, password, dc_ip):
    """Check the MachineAccountQuota via LDAP — needed for noPac."""
    ps_cmd = (
        "([ADSI]'LDAP://DC='+($env:USERDNSDOMAIN -replace '\\.',',DC=')).'ms-DS-MachineAccountQuota'"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=10
        )
        quota = int(result.strip()) if result.strip().isdigit() else -1
        return {
            "machine_account_quota": quota,
            "exploitable": quota > 0,
            "note": "Quota > 0 means any domain user can create machine accounts",
        }
    except (subprocess.SubprocessError, ValueError):
        return {"machine_account_quota": "unknown"}


def check_patch_status():
    """Check if KB5008380 (noPac patch) is installed."""
    if sys.platform != "win32":
        return {"status": "non-windows"}
    try:
        result = subprocess.check_output(
            ["wmic", "qfe", "list", "brief"],
            text=True, errors="replace", timeout=15
        )
        patched = any(kb in result for kb in ["KB5008380", "KB5008602", "KB5008207"])
        return {
            "patched": patched,
            "relevant_kbs": ["KB5008380", "KB5008602", "KB5008207"],
        }
    except subprocess.SubprocessError:
        return {"status": "check_failed"}


def enumerate_sam_name_impersonation():
    """Check for sAMAccountName impersonation conditions."""
    ps_cmd = (
        "Get-ADComputer -Filter * -Properties sAMAccountName | "
        "Where-Object {$_.sAMAccountName -notmatch '\\$$'} | "
        "Select-Object Name,sAMAccountName | ConvertTo-Json"
    )
    try:
        result = subprocess.check_output(
            ["powershell", "-NoProfile", "-Command", ps_cmd],
            text=True, errors="replace", timeout=15
        )
        data = json.loads(result) if result.strip() else []
        return data if isinstance(data, list) else [data]
    except (subprocess.SubprocessError, json.JSONDecodeError):
        return []


def main():
    parser = argparse.ArgumentParser(
        description="Detect noPac CVE-2021-42278/42287 vulnerability (authorized testing only)"
    )
    parser.add_argument("--domain", help="AD domain")
    parser.add_argument("--username", help="Domain username")
    parser.add_argument("--password", help="Domain password")
    parser.add_argument("--dc-ip", help="Domain controller IP")
    parser.add_argument("--check-patch", action="store_true")
    parser.add_argument("--output", "-o", help="Output JSON report")
    args = parser.parse_args()

    print("[*] noPac (CVE-2021-42278/42287) Detection Agent")
    print("[!] For authorized security testing only")
    report = {"timestamp": datetime.now(timezone.utc).isoformat(), "findings": {}}

    if args.domain and args.username:
        nopac = check_nopac_impacket(
            args.domain, args.username, args.password or "", args.dc_ip or ""
        )
        report["findings"]["nopac_scan"] = nopac
        print(f"[*] noPac scan: {nopac.get('vulnerable', 'unknown')}")

        quota = check_machineaccountquota(args.domain, args.username, args.password or "", args.dc_ip or "")
        report["findings"]["machine_quota"] = quota

    if args.check_patch:
        patch = check_patch_status()
        report["findings"]["patch_status"] = patch
        print(f"[*] Patched: {patch.get('patched', 'unknown')}")

    report["risk_level"] = "CRITICAL" if any(
        v.get("vulnerable") or v.get("exploitable") for v in report["findings"].values() if isinstance(v, dict)
    ) else "LOW"

    if args.output:
        with open(args.output, "w") as f:
            json.dump(report, f, indent=2)
        print(f"[*] Report saved to {args.output}")
    else:
        print(json.dumps(report, indent=2))


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
noPac Vulnerability Scanner and Assessment Script

Checks Active Directory environments for CVE-2021-42278/42287 vulnerability
by verifying patch status and MachineAccountQuota settings.
For authorized red team engagements only.
"""

import subprocess
import sys
import json
import os
from datetime import datetime


def check_machine_account_quota(dc_ip: str, domain: str, username: str, password: str) -> dict:
    """Check MachineAccountQuota via LDAP query."""
    try:
        result = subprocess.run(
            [
                "python3", "-c",
                f"""
import ldap3
server = ldap3.Server('{dc_ip}')
conn = ldap3.Connection(server, '{domain}\\\\{username}', '{password}', auto_bind=True)
conn.search('{",".join(["DC=" + p for p in domain.split(".")])}', '(objectClass=domain)',
            attributes=['ms-DS-MachineAccountQuota'])
if conn.entries:
    print(conn.entries[0]['ms-DS-MachineAccountQuota'])
else:
    print('QUERY_FAILED')
"""
            ],
            capture_output=True, text=True, timeout=30
        )
        quota = result.stdout.strip()
        return {
            "status": "success",
            "quota": int(quota) if quota.isdigit() else -1,
            "exploitable": int(quota) > 0 if quota.isdigit() else False
        }
    except Exception as e:
        return {"status": "error", "error": str(e)}


def run_nopac_scanner(dc_ip: str, domain: str, username: str, password: str) -> dict:
    """Run noPac scanner to check vulnerability status."""
    try:
        result = subprocess.run(
            ["python3", "scanner.py", f"{domain}/{username}:{password}", "-dc-ip", dc_ip],
            capture_output=True, text=True, timeout=60
        )
        output = result.stdout + result.stderr
        vulnerable = "VULNERABLE" in output.upper() or "vulnerable" in output.lower()
        return {
            "status": "success",
            "vulnerable": vulnerable,
            "output": output.strip()[:1000]
        }
    except FileNotFoundError:
        return {"status": "error", "error": "noPac scanner not found. Clone from https://github.com/cube0x0/noPac"}
    except Exception as e:
        return {"status": "error", "error": str(e)}


def generate_assessment_report(dc_ip: str, domain: str, quota_result: dict, scan_result: dict) -> str:
    """Generate noPac vulnerability assessment report."""
    report = [
        "=" * 60,
        "noPac (CVE-2021-42278/42287) Vulnerability Assessment",
        f"Generated: {datetime.now().isoformat()}",
        "=" * 60,
        "",
        f"Target DC: {dc_ip}",
        f"Domain: {domain}",
        "",
        "[MachineAccountQuota Check]",
    ]

    if quota_result["status"] == "success":
        quota = quota_result["quota"]
        report.append(f"  MachineAccountQuota: {quota}")
        if quota > 0:
            report.append(f"  Status: EXPLOITABLE - Users can create up to {quota} machine accounts")
        elif quota == 0:
            report.append("  Status: MITIGATED - Machine account creation disabled")
        else:
            report.append("  Status: UNKNOWN - Could not determine quota")
    else:
        report.append(f"  Error: {quota_result.get('error', 'Unknown error')}")

    report.append("")
    report.append("[noPac Scanner Result]")
    if scan_result["status"] == "success":
        status = "VULNERABLE" if scan_result["vulnerable"] else "NOT VULNERABLE"
        report.append(f"  Status: {status}")
        report.append(f"  Details: {scan_result['output'][:500]}")
    else:
        report.append(f"  Error: {scan_result.get('error', 'Unknown error')}")

    report.extend([
        "",
        "[Remediation]",
        "  1. Apply KB5008380 (CVE-2021-42287 Kerberos PAC fix)",
        "  2. Apply KB5008602 (CVE-2021-42278 sAMAccountName fix)",
        "  3. Set MachineAccountQuota to 0:",
        "     Set-ADDomain -Identity domain.local -Replace @{'ms-DS-MachineAccountQuota'='0'}",
        "  4. Monitor Event 4741 (machine account creation) and 4742 (modification)",
        "",
        "=" * 60
    ])

    return "\n".join(report)


def main():
    """Main entry point."""
    if len(sys.argv) < 4:
        print("Usage: python process.py <dc_ip> <domain> <username> <password>")
        print("Example: python process.py 10.10.10.1 domain.local user Password123")
        return

    dc_ip = sys.argv[1]
    domain = sys.argv[2]
    username = sys.argv[3]
    password = sys.argv[4] if len(sys.argv) > 4 else ""

    print(f"Checking noPac vulnerability for {domain} at {dc_ip}...")
    quota_result = check_machine_account_quota(dc_ip, domain, username, password)
    scan_result = run_nopac_scanner(dc_ip, domain, username, password)

    report = generate_assessment_report(dc_ip, domain, quota_result, scan_result)
    print(report)

    report_file = f"nopac_assessment_{datetime.now().strftime('%Y%m%d_%H%M%S')}.txt"
    with open(report_file, "w") as f:
        f.write(report)
    print(f"\nReport saved to: {report_file}")


if __name__ == "__main__":
    main()