企业内部AD脆弱密码审计

这个是前段时间做的个小脚本，没什么用，审计内部AD脆弱密码的。做这样一些简单的工作，脚本语言确实挺合适的。需要一个普通的AD账号，导出账户名，过滤掉禁用的，然后开始扫描。密码字典按照自己公司的实际情况写就好了，支持%USERNAME%123这样的格式。 脚本里面的各种参数我写死了，因为自己用，不必要敲参数。如果想要用用看，自己改就是了，perl这种东西简单的学一下的话，一个上午就够了。下午不行，这种天气下午只适合睡觉，或者吃点冰绿豆汤之类的东西，反正是不适合看代码。 #!/usr/bin/perl use warnings; use strict; use Win32::OLE; use Data::Dumper; use Authen::Simple::ActiveDirectory; use constant ADS_UF_ACCOUNTDISABLE => 2; use constant ADS_SCOPE_SUBTREE => 2; my $server = 'bj.microsoft.com'; my $domain = 'bj.microsoft.com'; my %users; my @pwds; select( STDOUT ); $| = 1; print "Loading account from ad..."; &LoadUser( ); print "done!n"; print scalar(keys(%users))." users loaded!n"; print "Loading password from dic..."; &LoadPwd( ); print "done!n"; open( REPORT, ">report.txt" ) || die "create report error: $!n"; select( REPORT ); $| = 1; select( STDOUT ); foreach my $user( keys(%users) ) { foreach my $pwd( @pwds ) { $pwd =~ s/%USERNAME%/$user/; my $ret = &TestPwd( $user, $pwd ); if( $ret == 1 ) { print "cracked! username=$user,password=$pwd,mail=".$users{$user}."n"; print REPORT "cracked! username=$user,password=$pwd,mail=".$users{$user}."n"; last; } #print "testing [$user/$pwd] ...n"; } } close( REPORT ); sub LoadUser { my $objConnection = Win32::OLE->new( "ADODB.Connection" ); my $objCommand = Win32::OLE->new( "ADODB.Command" ); # open ad $objConnection -> open( "Provider=ADsDSOObject;" ); $objCommand -> {"ActiveConnection"} = $objConnection; # search what and how my $cmd = "select userAccountControl,distinguishedName,mail from 'GC://dc=bj,dc=microsoft,dc=com' where objectCategory='user'"; $objCommand -> {"CommandText"} = $cmd; # import all users $objCommand -> Properties -> {"Page Size"} = 1000; # search all subtree $objCommand -> Properties -> {"searchscope"} = ADS_SCOPE_SUBTREE; my $objRecordSet = Win32::OLE->new( "ADODB.Recordset" ); $objRecordSet = $objCommand->Execute( ) || die "query data from active directory error,exitn"; while( not $objRecordSet -> eof ) { my $intUAC = $objRecordSet -> Fields("userAccountControl") -> value; # remove diable account if( not ( $intUAC & ADS_UF_ACCOUNTDISABLE ) ) { my $longName = $objRecordSet -> Fields("distinguishedName") -> value; my $mail = $objRecordSet -> Fields("mail") -> value; if( (!defined($mail)) or $mail eq "" ) { $mail = "null"; } if( $longName =~ /^CN=([w.-_]+),/ ) { #print ."n"; my $userName = $1; chomp( $mail ); chomp( $userName ); $users{$userName} = $mail; } } $objRecordSet -> MoveNext(); } } sub LoadPwd { open( FH, "<pass.txt" ) || die "Open password dict error,exit!n"; @pwds = <FH>; chomp( @pwds ); } sub TestPwd { my $username = shift; my $password = shift; my $ad = Authen::Simple::ActiveDirectory -> new( host => $server, principal => $domain ) || die "Connected error: $!"; if ( $ad->authenticate( $username, $password ) ) { return 1; } else { return 0; } }

OVER