windapsearch - notes

windapsearch-commands.sh

# cd /tmp/; git clone https://github.com/ropnop/windapsearch.git
# apt install python-ldap

# Find (nested) Domain Admins
windapsearch.py --dc-ip 10.0.0.1 -u 'user01@lab.test' -p "Password123!" --da

# Find computers and resolve
./windapsearch.py --dc-ip 10.0.0.1 -u 'user01@lab.test' -p "Password123!" -C -r

# Export all data and show in columns on the commandline
OUTDIR=/tmp/out/windap
mkdir -p ${OUTDIR}
./windapsearch.py --dc-ip 10.0.0.1 -u 'user01@lab.test' -p "Password123!" -U -G -C --da -dn -o ${OUTDIR}
column -t ${OUTDIR}/*

# Export all data including attributes
OUTDIR=/tmp/out/windap
mkdir -p ${OUTDIR}
./windapsearch.py --dc-ip 10.0.0.1 -u 'user01@lab.test' -p "Password123!" -U -G -C --da -dn --full -o ${OUTDIR} | tee -a ${OUTDIR}/full.log