from __future__ import division

from __future__ import print_function

import argparse

import logging

import sys

from impacket import version

from impacket.dcerpc.v5.samr import UF_ACCOUNTDISABLE, UF_TRUSTED_FOR_DELEGATION, UF_TRUSTED_TO_AUTHENTICATE_FOR_DELEGATION

from impacket.examples import logger

from impacket.examples.utils import parse_credentials

from impacket.ldap import ldap, ldapasn1

from impacket.ldap import ldaptypes

from impacket.smbconnection import SMBConnection, SessionError

def checkIfSPNExists(ldapConnection, sAMAccountName, rights):

return spnExists

class FindDelegation:

print("No entries found!")

if __name__ == '__main__':

print(version.BANNER)

parser = argparse.ArgumentParser(add_help = True, description = "Queries target domain for delegation relationships ")

parser.add_argument('target', action='store', help='domain[/username[:password]]')

parser.add_argument('-target-domain', action='store', help='Domain to query/request if different than the domain of the user. '

'Allows for retrieving delegation info across trusts.')

parser.add_argument('-ts', action='store_true', help='Adds timestamp to every logging output')

parser.add_argument('-debug', action='store_true', help='Turn DEBUG output ON')

group = parser.add_argument_group('authentication')

group.add_argument('-hashes', action="store", metavar = "LMHASH:NTHASH", help='NTLM hashes, format is LMHASH:NTHASH')

group.add_argument('-no-pass', action="store_true", help='don\'t ask for password (useful for -k)')

group.add_argument('-k', action="store_true", help='Use Kerberos authentication. Grabs credentials from ccache file '

'(KRB5CCNAME) based on target parameters. If valid credentials '

'cannot be found, it will use the ones specified in the command '

'line')

group.add_argument('-aesKey', action="store", metavar = "hex key", help='AES key to use for Kerberos Authentication '

'(128 or 256 bits)')

group = parser.add_argument_group('connection')

group.add_argument('-dc-ip', action='store', metavar='ip address', help='IP Address of the domain controller. If '

'ommited it use the domain part (FQDN) '

'specified in the target parameter. Ignored'

'if -target-domain is specified.')

group.add_argument('-dc-host', action='store', metavar='hostname', help='Hostname of the domain controller to use. '

'If ommited, the domain part (FQDN) '

'specified in the account parameter will be used')

if len(sys.argv)==1:

parser.print_help()

sys.exit(1)

options = parser.parse_args()

# Init the example's logger theme

logger.init(options.ts)

if options.debug is True:

logging.getLogger().setLevel(logging.DEBUG)

# Print the Library's installation path

logging.debug(version.getInstallationPath())

else:

logging.getLogger().setLevel(logging.INFO)

userDomain, username, password = parse_credentials(options.target)

if userDomain == '':

logging.critical('userDomain should be specified!')

sys.exit(1)

if options.target_domain:

targetDomain = options.target_domain

else:

targetDomain = userDomain

if password == '' and username != '' and options.hashes is None and options.no_pass is False and options.aesKey is None:

from getpass import getpass

password = getpass("Password:")

if options.aesKey is not None:

options.k = True

try:

executer = FindDelegation(username, password, userDomain, targetDomain, options)

executer.run()

except Exception as e:

if logging.getLogger().level == logging.DEBUG:

import traceback

traceback.print_exc()

logging.error(str(e))