Skip to content

Instantly share code, notes, and snippets.

@0xquad
Created September 12, 2018 20:59
Show Gist options
  • Save 0xquad/5c1191b2866cdaabbaad13e493390342 to your computer and use it in GitHub Desktop.
Save 0xquad/5c1191b2866cdaabbaad13e493390342 to your computer and use it in GitHub Desktop.
Sample flask app that enumerates domain admins
#!/usr/bin/env python
# To be run on windows, must have pywin32 installed (win32.win32* modules)
# Intended to be used within a flask-app-template virtualenv directory
from flask import Flask, request, url_for, jsonify, redirect, abort
from flask_genshi import Genshi, render_template
try:
# virtualenv.exe on windows doesn't make use of the python system
# site-packages directory, so we need to append that path to sys.path
# to use win32 (unless win32 has been installed in the virtualenv,
# but let's assume it's unlikely)
import sys, os
# find the original python interpreter directory
# (one that ends in \lib and doesn't start with the current
# virtualenv directory name, which should point to another directory)
paths = [p for p in sys.path
if p.lower().endswith('lib')
and not p.lower().startswith(os.getcwd().lower())]
if paths:
newpath = os.path.join(paths[0], 'site-packages')
sys.path.append(newpath)
from win32 import win32net
except ImportError:
print("couldn't load win32 module")
app = Flask('newapp')
genshi = Genshi(app)
genshi.extensions['html'] = 'html5'
def render(template, **kwargs):
"""Render a Genshi template with some extra helpers."""
kwargs.update({
'static' : lambda res: url_for('static', filename=res)
})
return render_template(template, kwargs)
@app.route('/', methods=['GET', 'POST'])
def home():
"""Display homepage"""
if request.environ['REQUEST_METHOD'] == 'POST':
pass
dc = win32net.NetGetDCName()[2:]
users = win32net.NetGroupGetUsers(dc, 'Domain Admins', 1)
return render('home.html', output=users)
if __name__ == '__main__':
app.run()
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment