@@ -51,6 +51,7 @@ def on_admin_login(self, context, connection):
5151 return False
5252
5353 admin_users = set ()
54+ usernames = set ()
5455 self .sid_to_user = {} # dictionary mapping sid string to username
5556
5657 try :
@@ -85,6 +86,7 @@ def on_admin_login(self, context, connection):
8586 username = samr .hSamrQueryInformationUser2 (dce , user_handle , samr .USER_INFORMATION_CLASS .UserAllInformation )["Buffer" ]["All" ]["UserName" ]
8687
8788 admin_users .add (f"{ domain } \\ { username } (Member of { group_name } )" )
89+ usernames .add (username )
8890
8991 # map sid string of user to username
9092 user_sid = f"{ domain_sid } -{ rid } "
@@ -101,41 +103,21 @@ def on_admin_login(self, context, connection):
101103 with suppress (Exception ):
102104 samr .hSamrCloseHandle (dce , group_handle )
103105
104- if admin_users :
105- # extract usernames only, remove domain and suffix
106- usernames = set ()
107- for user in admin_users :
108- # user format: domain\username (member of group)
109- try :
110- # split on '\' and take second part, then split on ' ' and take first token as username
111- username_part = user .split ("\\ " )[1 ]
112- username = username_part .split (" " )[0 ]
113- usernames .add (username )
114- except Exception :
115- # fallback to whole user string if parsing fails
116- usernames .add (user )
117-
118- sorted_names = sorted (usernames )
119- else :
120- context .log .info ("No privileged users found" )
121- sorted_names = []
106+ usernames = sorted (usernames )
122107
123- matched_dirs = self .check_users_directory (context , connection , sorted_names )
124- matched_tasks = self .check_tasklist (context , connection , sorted_names , connection .hostname )
108+ matched_dirs = self .check_users_directory (context , connection , usernames )
109+ matched_tasks = self .check_tasklist (context , connection , usernames , connection .hostname )
125110
126111 # collect results for printing
127112 results = {
128113 "netbios_name" : connection .hostname ,
129- "admin_users" : sorted_names ,
114+ "admin_users" : usernames ,
130115 "matched_dirs" : matched_dirs ,
131116 "matched_tasks" : matched_tasks ,
132117 }
133118
134119 # print grouped/logged results nicely
135120 self .print_grouped_results (context , connection , results )
136-
137- return True
138-
139121 except Exception as e :
140122 context .log .fail (str (e ))
141123 return False
0 commit comments