ms-lsad 0.1.0

MS-LSAD (Local Security Authority Domain Policy Remote Protocol) client — trusted-domain enumeration + trust-relationship read over the shared LSARPC pipe. Companion crate to ms-lsat (LSA translation). Dual-use: forest / trust audit + offensive trust manipulation for cross-forest golden ticket.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54

//! Live probe: enumerate trusts on a target DC via MS-LSAD.
//!
//! Usage:
//!
//!   cargo run --example enum_trusts -- <host> <domain> <user> <password>
//!
//! Example (against the icedracon lab):
//!
//!   cargo run --example enum_trusts -- 192.168.91.20 testlab.local labuser 'LabPass2026$'
//!
//! Prints one line per enumerated trust: `<sid>  <netbios-name>`. No trusts on a
//! stand-alone domain is a valid result (prints "0 trusts").

use std::error::Error;

use ms_lsad::LsadClient;
use smb2_client::SmbClient;

#[tokio::main(flavor = "current_thread")]
async fn main() -> Result<(), Box<dyn Error>> {
    let args: Vec<String> = std::env::args().collect();
    if args.len() < 5 {
        eprintln!(
            "usage: {} <host> <domain> <user> <password>",
            args.first().map(String::as_str).unwrap_or("enum_trusts")
        );
        std::process::exit(2);
    }
    let host = &args[1];
    let domain = &args[2];
    let user = &args[3];
    let password = &args[4];

    eprintln!("[+] connecting to \\\\{host}\\IPC$ as {domain}\\{user}");
    let mut smb = SmbClient::connect(host).await?;
    smb.login(host, domain, user, password).await?;
    smb.tree_connect(&format!("\\\\{host}\\IPC$")).await?;

    eprintln!("[+] opening \\PIPE\\lsarpc");
    let pipe = smb.open_pipe("lsarpc").await?;

    eprintln!("[+] binding MS-LSAD interface + LsarOpenPolicy2");
    let mut client = LsadClient::bind(&mut smb, pipe).await?;

    eprintln!("[+] calling LsarEnumerateTrustedDomains (opnum 13)");
    let trusts = client.enumerate_trusts("").await?;

    println!("=== {} trust(s) enumerated ===", trusts.len());
    for t in &trusts {
        println!("  {}  {}", t.sid, t.name);
    }

    Ok(())
}