Created
September 12, 2018 20:59
-
-
Save 0xquad/5c1191b2866cdaabbaad13e493390342 to your computer and use it in GitHub Desktop.
Sample flask app that enumerates domain admins
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#!/usr/bin/env python | |
# To be run on windows, must have pywin32 installed (win32.win32* modules) | |
# Intended to be used within a flask-app-template virtualenv directory | |
from flask import Flask, request, url_for, jsonify, redirect, abort | |
from flask_genshi import Genshi, render_template | |
try: | |
# virtualenv.exe on windows doesn't make use of the python system | |
# site-packages directory, so we need to append that path to sys.path | |
# to use win32 (unless win32 has been installed in the virtualenv, | |
# but let's assume it's unlikely) | |
import sys, os | |
# find the original python interpreter directory | |
# (one that ends in \lib and doesn't start with the current | |
# virtualenv directory name, which should point to another directory) | |
paths = [p for p in sys.path | |
if p.lower().endswith('lib') | |
and not p.lower().startswith(os.getcwd().lower())] | |
if paths: | |
newpath = os.path.join(paths[0], 'site-packages') | |
sys.path.append(newpath) | |
from win32 import win32net | |
except ImportError: | |
print("couldn't load win32 module") | |
app = Flask('newapp') | |
genshi = Genshi(app) | |
genshi.extensions['html'] = 'html5' | |
def render(template, **kwargs): | |
"""Render a Genshi template with some extra helpers.""" | |
kwargs.update({ | |
'static' : lambda res: url_for('static', filename=res) | |
}) | |
return render_template(template, kwargs) | |
@app.route('/', methods=['GET', 'POST']) | |
def home(): | |
"""Display homepage""" | |
if request.environ['REQUEST_METHOD'] == 'POST': | |
pass | |
dc = win32net.NetGetDCName()[2:] | |
users = win32net.NetGroupGetUsers(dc, 'Domain Admins', 1) | |
return render('home.html', output=users) | |
if __name__ == '__main__': | |
app.run() |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment