adhammer 1.5.2

ADhammer — Active Directory security assessment and offensive tradecraft in Rust, with a from-scratch DCE/RPC · NTLM · SMB2 · Kerberos stack.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147

//! **1.5.2 H-F**: `enum ldap-info` — no-cred anonymous RootDSE fingerprint.
//!
//! Every AD DC serves RootDSE anonymously by design (RFC 4511 §4.4). This
//! verb makes that one probe a first-class first-touch command: SASL mechs
//! offered, functional levels, whether the DC is synchronized to a replica,
//! how many extended controls it supports, and the `ldapServiceName` that
//! reveals the realm short-name and the DC computer account.
//!
//! Zero credentials, zero side effects. Fast fallback when
//! `scan --anonymous` is more surface than the engagement needs.
//! Complements [`crate::doctor`] (transport-level checks) with
//! LDAP-content facts. Heavy lifting lives in
//! [`adhammer_collector::read_rootdse_rich`].

use adhammer_collector::{read_rootdse_rich, RootDseRich};
use anyhow::Result;
use clap::Parser;
use serde_json::json;

#[derive(Parser)]
pub(crate) struct LdapInfoArgs {
    /// LDAP(S) URL of the target DC, e.g. `ldaps://dc.corp.local` or
    /// `ldap://10.0.0.10`. LDAPS on 636 is preferred; 389 works when the DC
    /// still accepts anonymous simple binds (RootDSE stays readable either way
    /// on standard AD deployments).
    #[arg(long)]
    pub url: String,
    /// Accept a self-signed / hostname-mismatched TLS certificate — the lab
    /// / self-signed CA path. Same flag semantics as `doctor --insecure`.
    #[arg(long)]
    pub insecure: bool,
    /// Emit JSON instead of the human summary. `AttackResult`-shaped envelope
    /// with the full RootDSE payload under `evidence`.
    #[arg(long)]
    pub json: bool,
}

pub(crate) async fn ldap_info(a: LdapInfoArgs) -> Result<()> {
    let sp = crate::ui::Spinner::start(format!("anonymous RootDSE probe → {}", a.url));

    let dse = match read_rootdse_rich(&a.url, a.insecure).await {
        Ok(d) => d,
        Err(e) => {
            sp.done_warn(&format!("RootDSE probe failed: {e}"));
            return Err(e);
        }
    };

    sp.done(&format!(
        "RootDSE served — realm {}",
        dse.realm_short.as_deref().unwrap_or("<unknown>")
    ));

    if a.json {
        println!(
            "{}",
            serde_json::to_string_pretty(&json!({
                "command": "adhammer enum ldap-info",
                "success": true,
                "evidence": dse,
            }))?
        );
    } else {
        print_human(&dse);
        eprintln!();
        eprintln!(
            "next: authenticated preflight — `adhammer doctor --url {url} --user <u> --password env:ADHAMMER_PASSWORD`",
            url = a.url
        );
    }
    Ok(())
}

fn print_human(d: &RootDseRich) {
    let line = |k: &str, v: &str| {
        if !v.is_empty() {
            eprintln!("  {k:<26} {v}");
        }
    };
    eprintln!();
    eprintln!("== RootDSE ==");
    line("dnsHostName", d.dns_host.as_deref().unwrap_or(""));
    line(
        "ldapServiceName",
        d.ldap_service_name.as_deref().unwrap_or(""),
    );
    line("realm (derived)", d.realm_short.as_deref().unwrap_or(""));
    line(
        "DC account (derived)",
        d.dc_account.as_deref().unwrap_or(""),
    );
    line(
        "defaultNamingContext",
        d.default_nc.as_deref().unwrap_or(""),
    );
    line(
        "rootDomainNamingContext",
        d.root_domain_nc.as_deref().unwrap_or(""),
    );
    line(
        "configurationNamingContext",
        d.configuration_nc.as_deref().unwrap_or(""),
    );
    line("isSynchronized", d.is_synchronized.as_deref().unwrap_or(""));
    line(
        "isGlobalCatalogReady",
        d.is_global_catalog_ready.as_deref().unwrap_or(""),
    );
    line(
        "domainFunctionality",
        d.domain_functionality.as_deref().unwrap_or(""),
    );
    line(
        "forestFunctionality",
        d.forest_functionality.as_deref().unwrap_or(""),
    );
    line(
        "dcFunctionality",
        d.domain_controller_functionality.as_deref().unwrap_or(""),
    );
    line(
        "highestCommittedUSN",
        d.highest_committed_usn.as_deref().unwrap_or(""),
    );
    line("currentTime", d.current_time.as_deref().unwrap_or(""));
    eprintln!(
        "  supportedControl           {} OID(s)",
        d.supported_controls
    );
    eprintln!(
        "  supportedCapabilities      {} OID(s)",
        d.supported_capabilities
    );
    eprintln!(
        "  supportedLDAPVersion       {}",
        d.supported_ldap_version.join(", ")
    );
    if !d.sasl.is_empty() {
        eprintln!("  supportedSASLMechanisms    {}", d.sasl.join(", "));
    }
    if !d.naming_contexts.is_empty() {
        eprintln!("  namingContexts ({}):", d.naming_contexts.len());
        for nc in &d.naming_contexts {
            eprintln!("    · {nc}");
        }
    }
}