1- using System ;
1+ using System ;
22using System . Collections . Generic ;
33using System . DirectoryServices ;
44using System . IO ;
@@ -24,6 +24,7 @@ _____ __ __ ___ ____ _____
2424 var parsed = ArgumentParser . Parse ( args ) ;
2525 String username = null ;
2626 String password = null ;
27+ String target = "*" ;
2728 String connectionString = "LDAP://{0}:{1}" ;
2829 DirectoryEntry ldapConnection ;
2930
@@ -36,6 +37,7 @@ _____ __ __ ___ ____ _____
3637 Console . WriteLine ( "\n Optional" ) ;
3738 Console . WriteLine ( "/user:<username> Username of the account" ) ;
3839 Console . WriteLine ( "/pass:<password> Password of the account" ) ;
40+ Console . WriteLine ( "/target:<target> computer name (if not set query all computers in AD)" ) ;
3941 Console . WriteLine ( "/out:<file> Outputting credentials to file" ) ;
4042 Console . WriteLine ( "/ssl Enable SSL (LDAPS://)" ) ;
4143
@@ -52,10 +54,15 @@ _____ __ __ ___ ____ _____
5254 {
5355 connectionString = String . Format ( connectionString , parsed . Arguments [ "/host" ] , "636" ) ;
5456 }
55-
57+
58+ // Filter computer name
59+ if ( parsed . Arguments . ContainsKey ( "/target" ) )
60+ {
61+ target = parsed . Arguments [ "/target" ] + "$" ;
62+ }
5663
5764 // Use the provided credentials or the current session
58- if ( parsed . Arguments . ContainsKey ( "/host " ) && parsed . Arguments . ContainsKey ( "/pass" ) )
65+ if ( parsed . Arguments . ContainsKey ( "/user " ) && parsed . Arguments . ContainsKey ( "/pass" ) )
5966 {
6067 Console . WriteLine ( "\n [+] Using the following credentials" ) ;
6168 Console . WriteLine ( "Host: " + connectionString ) ;
@@ -76,7 +83,7 @@ _____ __ __ ___ ____ _____
7683 ldapConnection = new DirectoryEntry ( connectionString , username , password , System . DirectoryServices . AuthenticationTypes . Secure ) ;
7784 Console . WriteLine ( "\n [+] Extracting LAPS password from LDAP" ) ;
7885 DirectorySearcher searcher = new DirectorySearcher ( ldapConnection ) ;
79- searcher . Filter = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*))" ;
86+ searcher . Filter = "(&(objectCategory=computer)(ms-MCS-AdmPwd=*)(sAMAccountName=" + target + ") )";
8087
8188 // Iterate over all the credentials
8289 List < string > output = new List < string > ( ) ;
0 commit comments