msldap：一款用于审计MS AD的LDAP库

git clone https://github.com/skelsec/msldap.git

cd msldappython3 setup.py install

pip install msldap

<protocol>+<auth>://<username>:<password>@<ip_or_host>:<port>/<tree>/?<param>=<value><protocol> sets the ldap protocol following values supported:- ldap- ldaps- gc- gc_ssl<auth> can be omitted if plaintext authentication is to be performed (in that case it default to ntlm-password), otherwise:- ntlm-password- ntlm-nt- kerberos-password (dc option param must be used)- kerberos-rc4 / kerberos-nt (dc option param must be used)- kerberos-aes (dc option param must be used)- kerberos-keytab (dc option param must be used)- kerberos-ccache (dc option param must be used)- kerberos-pfx (dc option param must be used)- kerberos-pem (dc option param must be used)- kerberos-certstore (dc option param must be used, windows only)- sspi-ntlm (windows only!)- sspi-kerberos (windows only!)- anonymous- plain- simple- sicily (same format as ntlm-nt but using the SICILY authentication)<tree>:OPTIONAL. Specifies the root tree of all queries<param> can be:- timeout : connction timeout in seconds- proxytype: currently only socks5 proxy is supported- proxyhost: Ip or hostname of the proxy server- proxyport: port of the proxy server- proxytimeout: timeout ins ecodns for the proxy connection- dc: the IP address of the domain controller, MUST be used for kerberos authenticationExamples:ldap://10.10.10.2 (anonymous bind)ldaps://test.corp (anonymous bind)ldap+sspi-ntlm://test.corpldap+sspi-kerberos://test.corpldap://TEST\victim:<password>@10.10.10.2 (defaults to SASL GSSAPI NTLM)ldap+simple://TEST\victim:<password>@10.10.10.2 (SASL SIMPLE auth)ldap+plain://TEST\victim:<password>@10.10.10.2 (SASL SIMPLE auth)ldap+ntlm-password://TEST\victim:<password>@10.10.10.2ldap+ntlm-nt://TEST\victim:<nthash>@10.10.10.2ldap+kerberos-password://TEST\victim:<password>@<hostname>/?dc=10.10.10.2ldap+kerberos-rc4://TEST\victim:<rc4key>@<hostname>/?dc=10.10.10.2ldap+kerberos-aes://TEST\victim:<aes>@<hostname>/?dc=10.10.10.2ldap://TEST\victim:[email protected]/DC=test,DC=corp/ldap://TEST\victim:[email protected]/DC=test,DC=corp/?timeout=99&proxytype=socks5&proxyhost=127.0.0.1&proxyport=1080&proxytimeout=44

import asynciofrom msldap.commons.factory import LDAPConnectionFactoryurl = 'ldap+simple://TEST\victim:[email protected]'async def client(url):conn_url = LDAPConnectionFactory.from_url(url)ldap_client = conn_url.get_client()_, err = await ldap_client.connect()if err is not None:raise erruser = await ldap_client.get_user('Administrator')print(str(user))if __name__ == '__main__':asyncio.run(client(url))