Ejemplo n.º 1
0
        public void StartStealthEnumeration()
        {
            var output = new BlockingCollection <Wrapper <OutputBase> >();
            var writer = _options.Uri == null
                ? StartOutputWriter(output)
                : StartRestWriter(output);

            foreach (var domainName in _utils.GetDomainList())
            {
                Console.WriteLine($"Starting stealth enumeration for {domainName}\n");
                var domainSid = _utils.GetDomainSid(domainName);
                var data      = LdapFilter.GetLdapFilter(_options.CollectMethod, _options.ExcludeDC, true);
                switch (_options.CollectMethod)
                {
                case CollectionMethod.ObjectProps:
                    Console.WriteLine("Doing stealth enumeration for object properties");
                    foreach (var entry in _utils.DoSearch(data.Filter, SearchScope.Subtree, data.Properties, domainName))
                    {
                        var        resolved = entry.ResolveAdEntry();
                        OutputBase props;
                        if (resolved.ObjectType.Equals("computer"))
                        {
                            props = ObjectPropertyHelpers.GetComputerProps(entry, resolved);
                        }
                        else
                        {
                            props = ObjectPropertyHelpers.GetUserProps(entry, resolved);
                        }
                        if (props != null)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = props
                            });
                        }
                    }
                    break;

                case CollectionMethod.Session:
                    Console.WriteLine("Doing stealth enumeration for sessions");
                    foreach (var path in SessionHelpers.CollectStealthTargets(domainName))
                    {
                        var sessions = SessionHelpers.GetNetSessions(path, domainName);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                    }
                    break;

                case CollectionMethod.ComputerOnly:
                    Console.WriteLine("Doing stealth enumeration for sessions");
                    foreach (var path in SessionHelpers.CollectStealthTargets(domainName))
                    {
                        var sessions = SessionHelpers.GetNetSessions(path, domainName);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                    }

                    Console.WriteLine("Doing stealth enumeration for admins");
                    foreach (var entry in _utils.DoSearch(
                                 data.Filter, SearchScope.Subtree,
                                 data.Properties, domainName))
                    {
                        foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = admin
                            });
                        }
                    }
                    break;

                case CollectionMethod.Default:
                    Console.WriteLine("Doing stealth enumeration for sessions");
                    foreach (var path in SessionHelpers.CollectStealthTargets(domainName))
                    {
                        var sessions = SessionHelpers.GetNetSessions(path, domainName);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                    }

                    Console.WriteLine("Doing stealth enumeration for admins");
                    foreach (var entry in _utils.DoSearch(
                                 "(&(objectCategory=groupPolicyContainer)(name=*)(gpcfilesyspath=*))", SearchScope.Subtree,
                                 new[] { "displayname", "name", "gpcfilesyspath" }, domainName))
                    {
                        foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = admin
                            });
                        }
                    }

                    Console.WriteLine("Doing stealth enumeration for groups");
                    foreach (var entry in _utils.DoSearch("(|(memberof=*)(primarygroupid=*))",
                                                          SearchScope.Subtree,
                                                          new[]
                    {
                        "samaccountname", "distinguishedname", "dnshostname", "samaccounttype",
                        "primarygroupid", "memberof", "serviceprincipalname"
                    }, domainName))
                    {
                        var resolvedEntry = entry.ResolveAdEntry();
                        foreach (var group in GroupHelpers.ProcessAdObject(entry, resolvedEntry, domainSid))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = group
                            });
                        }
                    }
                    break;

                case CollectionMethod.SessionLoop:
                    Console.WriteLine("Doing stealth enumeration for sessions");
                    foreach (var path in SessionHelpers.CollectStealthTargets(domainName))
                    {
                        var sessions = SessionHelpers.GetNetSessions(path, domainName);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                    }
                    break;

                case CollectionMethod.LoggedOn:
                    Console.WriteLine("Doing LoggedOn enumeration for stealth targets");
                    foreach (var path in SessionHelpers.CollectStealthTargets(domainName))
                    {
                        var sessions = SessionHelpers.GetNetLoggedOn(path, domainName);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                        sessions = SessionHelpers.GetRegistryLoggedOn(path);
                        foreach (var s in sessions)
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = s
                            });
                        }
                    }
                    break;

                case CollectionMethod.Group:
                    Console.WriteLine("Doing stealth enumeration for groups");
                    foreach (var entry in _utils.DoSearch(data.Filter,
                                                          SearchScope.Subtree,
                                                          data.Properties, domainName))
                    {
                        var resolvedEntry = entry.ResolveAdEntry();
                        foreach (var group in GroupHelpers.ProcessAdObject(entry, resolvedEntry, domainSid))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = group
                            });
                        }
                    }
                    break;

                case CollectionMethod.LocalGroup:
                    //This case will never happen
                    break;

                case CollectionMethod.GPOLocalGroup:
                    Console.WriteLine("Doing stealth enumeration for admins");
                    foreach (var entry in _utils.DoSearch(
                                 data.Filter, SearchScope.Subtree,
                                 data.Properties, domainName))
                    {
                        foreach (var admin in LocalAdminHelpers.GetGpoAdmins(entry, domainName))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = admin
                            });
                        }
                    }
                    break;

                case CollectionMethod.Trusts:
                    var trusts = DomainTrustEnumeration.DoTrustEnumeration(domainName);
                    foreach (var trust in trusts)
                    {
                        output.Add(new Wrapper <OutputBase> {
                            Item = trust
                        });
                    }
                    break;

                case CollectionMethod.ACL:
                    Console.WriteLine("Doing stealth enumeration for ACLs");
                    foreach (var entry in _utils.DoSearch(
                                 data.Filter,
                                 SearchScope.Subtree,
                                 data.Properties, domainName))
                    {
                        foreach (var acl in AclHelpers.ProcessAdObject(entry, domainName))
                        {
                            output.Add(new Wrapper <OutputBase> {
                                Item = acl
                            });
                        }
                    }
                    break;

                default:
                    throw new ArgumentOutOfRangeException();
                }
                output.CompleteAdding();
                writer.Wait();
                Console.WriteLine($"Finished stealth enumeration for {domainName}");
            }
            if (!_options.CollectMethod.Equals(CollectionMethod.SessionLoop))
            {
                return;
            }
            if (_options.MaxLoopTime != null)
            {
                if (DateTime.Now > _options.LoopEnd)
                {
                    Console.WriteLine("Exiting session loop as LoopEndTime as passed");
                    return;
                }
            }

            Console.WriteLine($"Starting next session run in {_options.LoopTime} minutes");
            new ManualResetEvent(false).WaitOne(_options.LoopTime * 60 * 1000);
            if (_options.MaxLoopTime != null)
            {
                if (DateTime.Now > _options.LoopEnd)
                {
                    Console.WriteLine("Exiting session loop as LoopEndTime as passed");
                    return;
                }
            }
            Console.WriteLine("Starting next enumeration loop");
            StartStealthEnumeration();
        }
Ejemplo n.º 2
0
        public void StartEnumeration()
        {
            //Let's determine what LDAP filter we need first
            var data       = LdapFilter.GetLdapFilter(_options.CollectMethod, _options.ExcludeDC, _options.Stealth);
            var ldapFilter = data.Filter;
            var props      = data.Properties;
            var c          = _options.CollectMethod;


            foreach (var domainName in _utils.GetDomainList())
            {
                _noPing   = 0;
                _timeouts = 0;
                Console.WriteLine($"Starting enumeration for {domainName}");

                _watch            = Stopwatch.StartNew();
                _currentDomain    = domainName;
                _currentDomainSid = _utils.GetDomainSid(domainName);
                _currentCount     = 0;
                var outputQueue = new BlockingCollection <Wrapper <OutputBase> >();

                if (_options.ComputerFile == null)
                {
                    var inputQueue = new BlockingCollection <Wrapper <SearchResultEntry> >(1000);

                    var taskhandles = new Task[_options.Threads];

                    var writer = _options.Uri == null
                        ? StartOutputWriter(outputQueue)
                        : StartRestWriter(outputQueue);

                    if (c.Equals(CollectionMethod.Trusts) ||
                        c.Equals(CollectionMethod.Default))
                    {
                        foreach (var domain in DomainTrustEnumeration.DoTrustEnumeration(domainName))
                        {
                            outputQueue.Add(new Wrapper <OutputBase> {
                                Item = domain
                            });
                        }
                        if (_options.CollectMethod.Equals(CollectionMethod.Trusts))
                        {
                            outputQueue.CompleteAdding();
                            writer.Wait();
                            continue;
                        }
                    }

                    if (c.Equals(CollectionMethod.Container))
                    {
                        foreach (var container in ContainerHelpers.GetContainersForDomain(domainName))
                        {
                            outputQueue.Add(new Wrapper <OutputBase> {
                                Item = container
                            });
                        }
                        if (_options.CollectMethod.Equals(CollectionMethod.Container))
                        {
                            outputQueue.CompleteAdding();
                            writer.Wait();
                            continue;
                        }
                    }

                    for (var i = 0; i < _options.Threads; i++)
                    {
                        taskhandles[i] = StartRunner(inputQueue, outputQueue);
                    }

                    _statusTimer.Start();

                    IEnumerable <Wrapper <SearchResultEntry> > items;

                    if ((c.Equals(CollectionMethod.ComputerOnly) || c.Equals(CollectionMethod.Session) ||
                         c.Equals(CollectionMethod.LocalGroup) || c.Equals(CollectionMethod.LoggedOn)) &&
                        _options.Ou != null)
                    {
                        items = _utils.DoWrappedSearch(ldapFilter, SearchScope.Subtree, props, domainName, _options.Ou);
                    }
                    else
                    {
                        items = _utils.DoWrappedSearch(ldapFilter, SearchScope.Subtree, props, domainName);
                    }

                    foreach (var item in items)
                    {
                        inputQueue.Add(item);
                    }

                    inputQueue.CompleteAdding();
                    Utils.Verbose("Waiting for enumeration threads to finish");
                    Task.WaitAll(taskhandles);

                    _statusTimer.Stop();

                    if (_options.CollectMethod.Equals(CollectionMethod.ACL))
                    {
                        foreach (var a in AclHelpers.GetSyncers())
                        {
                            outputQueue.Add(new Wrapper <OutputBase> {
                                Item = a
                            });
                        }
                        AclHelpers.ClearSyncers();
                    }
                    PrintStatus();
                    outputQueue.CompleteAdding();
                    Utils.Verbose("Waiting for writer thread to finish");
                    writer.Wait();
                    _watch.Stop();
                    Console.WriteLine($"Finished enumeration for {domainName} in {_watch.Elapsed}");
                    Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout.");
                    _watch = null;
                }
                else
                {
                    var inputQueue = new BlockingCollection <Wrapper <string> >(1000);

                    var taskhandles = new Task[_options.Threads];

                    var writer = _options.Uri == null?StartOutputWriter(outputQueue) : StartRestWriter(outputQueue);

                    for (var i = 0; i < _options.Threads; i++)
                    {
                        taskhandles[i] = StartCompListRunner(inputQueue, outputQueue);
                    }

                    _statusTimer.Start();

                    using (var reader = new StreamReader(_options.ComputerFile))
                    {
                        string line;
                        while ((line = reader.ReadLine()) != null)
                        {
                            inputQueue.Add(new Wrapper <string> {
                                Item = line
                            });
                        }
                        inputQueue.CompleteAdding();
                    }
                    Utils.Verbose("Waiting for enumeration threads to finish");
                    Task.WaitAll(taskhandles);

                    _statusTimer.Stop();
                    PrintStatus();
                    outputQueue.CompleteAdding();
                    Utils.Verbose("Waiting for writer thread to finish");
                    writer.Wait();
                    _watch.Stop();
                    Console.WriteLine($"Finished enumeration for {domainName} in {_watch.Elapsed}");
                    Console.WriteLine($"{_noPing} hosts failed ping. {_timeouts} hosts timedout.");
                    _watch = null;
                }
            }

            if (!_options.CollectMethod.Equals(CollectionMethod.SessionLoop))
            {
                return;
            }
            if (_options.MaxLoopTime != null)
            {
                if (DateTime.Now > _options.LoopEnd)
                {
                    Console.WriteLine("Exiting session loop as LoopEndTime as passed");
                    return;
                }
            }

            Console.WriteLine($"Starting next session run in {_options.LoopTime} minutes");
            new ManualResetEvent(false).WaitOne(_options.LoopTime * 60 * 1000);
            if (_options.MaxLoopTime != null)
            {
                if (DateTime.Now > _options.LoopEnd)
                {
                    Console.WriteLine("Exiting session loop as LoopEndTime as passed");
                    return;
                }
            }
            Console.WriteLine("Starting next enumeration loop");
            StartEnumeration();
        }