@@ -813,76 +813,75 @@ def resolve_and_display_hostname(name, domain_name=None):
813813 resp = self .search (search_filter , attributes , 0 )
814814 trust_resp_parse = parse_result_attributes (resp )
815815
816- if trust_resp_parse :
817- for trust in trust_resp_parse :
818- try :
819- trust_name = trust ["name" ]
820- trust_flat_name = trust ["flatName" ]
821- trust_direction = int (trust ["trustDirection" ])
822- trust_type = int (trust ["trustType" ])
823- trust_attributes = trust ["trustAttributes" ]
824-
825- # See: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c
826- trust_attribute_flags = {
827- 0x1 : "Non-Transitive" ,
828- 0x2 : "Uplevel-Only" ,
829- 0x4 : "Quarantined Domain" ,
830- 0x8 : "Forest Transitive" ,
831- 0x10 : "Cross Organization" ,
832- 0x20 : "Within Forest" ,
833- 0x40 : "Treat as External" ,
834- 0x80 : "Uses RC4 Encryption" ,
835- 0x200 : "Cross Organization No TGT Delegation" ,
836- 0x800 : "Cross Organization Enable TGT Delegation" ,
837- 0x2000 : "PAM Trust"
838- }
839-
840- # For check if multiple posibble flags, like Uplevel-Only, Treat as External
841- trust_attributes_text = ", " .join ([
842- text for flag , text in trust_attribute_flags .items ()
843- if int (trust_attributes ) & flag
844- ]) or "Other" # If Trust attrs not known
845-
846- # Convert trust direction/type to human-readable format
847- direction_text = {
848- 0 : "Disabled" ,
849- 1 : "Inbound" ,
850- 2 : "Outbound" ,
851- 3 : "Bidirectional" ,
852- }[trust_direction ]
853-
854- trust_type_text = {
855- 1 : "Windows NT" ,
856- 2 : "Active Directory" ,
857- 3 : "Kerberos" ,
858- 4 : "Unknown" ,
859- 5 : "Azure Active Directory" ,
860- }[trust_type ]
861-
862- self .logger .info (f"Processing trusted domain: { trust_name } ({ trust_flat_name } )" )
863- self .logger .info (f"Trust type: { trust_type_text } , Direction: { direction_text } , Trust Attributes: { trust_attributes_text } " )
816+ for trust in trust_resp_parse :
817+ try :
818+ trust_name = trust ["name" ]
819+ trust_flat_name = trust ["flatName" ]
820+ trust_direction = int (trust ["trustDirection" ])
821+ trust_type = int (trust ["trustType" ])
822+ trust_attributes = trust ["trustAttributes" ]
823+
824+ # See: https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/e9a2d23c-c31e-4a6f-88a0-6646fdb51a3c
825+ trust_attribute_flags = {
826+ 0x1 : "Non-Transitive" ,
827+ 0x2 : "Uplevel-Only" ,
828+ 0x4 : "Quarantined Domain" ,
829+ 0x8 : "Forest Transitive" ,
830+ 0x10 : "Cross Organization" ,
831+ 0x20 : "Within Forest" ,
832+ 0x40 : "Treat as External" ,
833+ 0x80 : "Uses RC4 Encryption" ,
834+ 0x200 : "Cross Organization No TGT Delegation" ,
835+ 0x800 : "Cross Organization Enable TGT Delegation" ,
836+ 0x2000 : "PAM Trust"
837+ }
838+
839+ # For check if multiple posibble flags, like Uplevel-Only, Treat as External
840+ trust_attributes_text = ", " .join ([
841+ text for flag , text in trust_attribute_flags .items ()
842+ if int (trust_attributes ) & flag
843+ ]) or "Other" # If Trust attrs not known
844+
845+ # Convert trust direction/type to human-readable format
846+ direction_text = {
847+ 0 : "Disabled" ,
848+ 1 : "Inbound" ,
849+ 2 : "Outbound" ,
850+ 3 : "Bidirectional" ,
851+ }[trust_direction ]
852+
853+ trust_type_text = {
854+ 1 : "Windows NT" ,
855+ 2 : "Active Directory" ,
856+ 3 : "Kerberos" ,
857+ 4 : "Unknown" ,
858+ 5 : "Azure Active Directory" ,
859+ }[trust_type ]
860+
861+ self .logger .info (f"Processing trusted domain: { trust_name } ({ trust_flat_name } )" )
862+ self .logger .info (f"Trust type: { trust_type_text } , Direction: { direction_text } , Trust Attributes: { trust_attributes_text } " )
864863
865- except Exception as e :
866- self .logger .fail (f"Failed { e } in trust entry: { trust } " )
864+ except Exception as e :
865+ self .logger .fail (f"Failed { e } in trust entry: { trust } " )
867866
868- # Only process if it's an Active Directory trust
869- if int (trust_type ) == 2 :
870- # Try to find domain controllers in trusted domain using DNS
871- # Check if we can resolve the trusted domain's DC using DNS
872- dc_dns_name = f"_ldap._tcp.dc._msdcs.{ trust_name } "
873- try :
874- srv_records = resolv .resolve (dc_dns_name , "SRV" , tcp = self .args .dns_tcp )
875- self .logger .info (f"Found domain controllers for trusted domain { trust_name } via DNS:" )
876- for srv in srv_records :
877- dc_hostname = str (srv .target ).rstrip ("." )
878- self .logger .highlight (f"Found DC in trusted domain: { colored (dc_hostname , host_info_colors [0 ])} " )
879- self .logger .highlight (f"{ trust_name } -> { direction_text } -> { trust_attributes_text } " )
880- resolve_and_display_hostname (dc_hostname )
881- except Exception as e :
882- self .logger .fail (f"Failed to resolve DCs for { trust_name } via DNS: { e } " )
883- else :
884- self .logger .display (f"Skipping non-Active Directory trust '{ trust_name } ' with type: { trust_type_text } and direction: { direction_text } " )
885- self .logger .info ("Domain Controller enumeration complete." )
867+ # Only process if it's an Active Directory trust
868+ if int (trust_type ) == 2 :
869+ # Try to find domain controllers in trusted domain using DNS
870+ # Check if we can resolve the trusted domain's DC using DNS
871+ dc_dns_name = f"_ldap._tcp.dc._msdcs.{ trust_name } "
872+ try :
873+ srv_records = resolv .resolve (dc_dns_name , "SRV" , tcp = self .args .dns_tcp )
874+ self .logger .info (f"Found domain controllers for trusted domain { trust_name } via DNS:" )
875+ for srv in srv_records :
876+ dc_hostname = str (srv .target ).rstrip ("." )
877+ self .logger .highlight (f"Found DC in trusted domain: { colored (dc_hostname , host_info_colors [0 ])} " )
878+ self .logger .highlight (f"{ trust_name } -> { direction_text } -> { trust_attributes_text } " )
879+ resolve_and_display_hostname (dc_hostname )
880+ except Exception as e :
881+ self .logger .fail (f"Failed to resolve DCs for { trust_name } via DNS: { e } " )
882+ else :
883+ self .logger .display (f"Skipping non-Active Directory trust '{ trust_name } ' with type: { trust_type_text } and direction: { direction_text } " )
884+ self .logger .info ("Domain Controller enumeration complete." )
886885
887886 def active_users (self ):
888887 if len (self .args .active_users ) > 0 :
0 commit comments