rdp-enum.py

#!/usr/bin/env python3
"""
RDP / AD Security Check
Uso profissional e autorizado
Enumeração segura (sem brute force)
"""

import argparse
import socket
import subprocess
from ldap3 import Server, Connection, ALL
from impacket.smbconnection import SMBConnection


def check_rdp(host):
    print(f"\n[+] Checking RDP on {host}")
    sock = socket.socket()
    sock.settimeout(3)
    try:
        sock.connect((host, 3389))
        print("    [+] RDP port 3389 OPEN")
    except Exception:
        print("    [-] RDP port CLOSED or filtered")
    finally:
        sock.close()


def smb_enum(host, user, password, domain):
    print("\n[+] SMB Enumeration")
    try:
        smb = SMBConnection(host, host, sess_port=445)
        smb.login(user, password, domain)

        print("    [+] SMB Authentication SUCCESS")

        print("    [+] Shares:")
        for share in smb.listShares():
            print(f"        - {share['shi1_netname'][:-1]}")

        print("    [+] Users:")
        for u in smb.listUsers():
            print(f"        - {u['name']}")

        smb.logoff()
    except Exception as e:
        print(f"    [-] SMB error: {e}")


def ldap_enum(dc_ip, domain, user, password):
    print("\n[+] LDAP / Active Directory Enumeration")
    try:
        server = Server(dc_ip, get_info=ALL)
        conn = Connection(
            server,
            user=f"{domain}\\{user}",
            password=password,
            authentication="NTLM",
            auto_bind=True,
        )

        base_dn = ",".join([f"DC={d}" for d in domain.split(".")])

        print("    [+] Users:")
        conn.search(base_dn, "(objectClass=user)", attributes=["sAMAccountName"])
        for e in conn.entries:
            print(f"        - {e.sAMAccountName}")

        print("\n    [+] Groups:")
        conn.search(base_dn, "(objectClass=group)", attributes=["cn"])
        for g in conn.entries:
            print(f"        - {g.cn}")

        print("\n    [+] Password-related flags:")
        conn.search(
            base_dn,
            "(objectClass=user)",
            attributes=["sAMAccountName", "userAccountControl"],
        )
        for u in conn.entries:
            uac = int(u.userAccountControl.value)
            if uac & 0x10000:
                print(f"        [!] {u.sAMAccountName} -> PasswordNeverExpires")

        conn.unbind()

    except Exception as e:
        print(f"    [-] LDAP error: {e}")


def main():
    parser = argparse.ArgumentParser(description="RDP Security & AD Enumeration (Authorized Use)")
    parser.add_argument("--target", required=True, help="Target host or DC IP")
    parser.add_argument("--domain", required=True, help="AD domain (ex: corp.local)")
    parser.add_argument("--user", required=True, help="Valid domain username")
    parser.add_argument("--password", required=True, help="Valid password")

    args = parser.parse_args()

    check_rdp(args.target)
    smb_enum(args.target, args.user, args.password, args.domain)
    ldap_enum(args.target, args.domain, args.user, args.password)


if __name__ == "__main__":
    main()