Skip to content

Commit 415a008

Browse files
authored
Fix Args Check & Add Computer filter
Add - Filter the computer from wich you want to extract LAPS password with <target> arg. Fixed - Check credentials args ("username" instead of "host").
1 parent 1812a6c commit 415a008

File tree

1 file changed

+11
-4
lines changed

1 file changed

+11
-4
lines changed

SharpLAPS/Program.cs

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
using System;
1+
using System;
22
using System.Collections.Generic;
33
using System.DirectoryServices;
44
using System.IO;
@@ -24,6 +24,7 @@ _____ __ __ ___ ____ _____
2424
var parsed = ArgumentParser.Parse(args);
2525
String username = null;
2626
String password = null;
27+
String target = "*";
2728
String connectionString = "LDAP://{0}:{1}";
2829
DirectoryEntry ldapConnection;
2930

@@ -36,6 +37,7 @@ _____ __ __ ___ ____ _____
3637
Console.WriteLine("\nOptional");
3738
Console.WriteLine("/user:<username> Username of the account");
3839
Console.WriteLine("/pass:<password> Password of the account");
40+
Console.WriteLine("/target:<target> computer name (if not set query all computers in AD)");
3941
Console.WriteLine("/out:<file> Outputting credentials to file");
4042
Console.WriteLine("/ssl Enable SSL (LDAPS://)");
4143

@@ -52,10 +54,15 @@ _____ __ __ ___ ____ _____
5254
{
5355
connectionString = String.Format(connectionString, parsed.Arguments["/host"], "636");
5456
}
55-
57+
58+
// Filter computer name
59+
if (parsed.Arguments.ContainsKey("/target"))
60+
{
61+
target = parsed.Arguments["/target"] + "$";
62+
}
5663

5764
// Use the provided credentials or the current session
58-
if (parsed.Arguments.ContainsKey("/host") && parsed.Arguments.ContainsKey("/pass"))
65+
if (parsed.Arguments.ContainsKey("/user") && parsed.Arguments.ContainsKey("/pass"))
5966
{
6067
Console.WriteLine("\n[+] Using the following credentials");
6168
Console.WriteLine("Host: " + connectionString);
@@ -76,7 +83,7 @@ _____ __ __ ___ ____ _____
7683
ldapConnection = new DirectoryEntry(connectionString, username, password, System.DirectoryServices.AuthenticationTypes.Secure);
7784
Console.WriteLine("\n[+] Extracting LAPS password from LDAP");
7885
DirectorySearcher searcher = new DirectorySearcher(ldapConnection);
79-
searcher.Filter = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*))";
86+
searcher.Filter = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*)(sAMAccountName=" + target + "))";
8087

8188
// Iterate over all the credentials
8289
List<string> output = new List<string>();

0 commit comments

Comments
 (0)