ad.nix (2852B)
1 # modules/features/pentest/ad.nix — Active Directory, which is most of CPTS. 2 # 3 # impacket and its aliases come from _impacket.nix, shared with python.nix, so 4 # both categories install the identical derivation rather than colliding. 5 { lib, ... }: 6 (import ./_sets.nix { inherit lib; }) { 7 name = "ad"; 8 description = "Active Directory: kerberos, LDAP, SMB, ADCS, relaying"; 9 10 packages = pkgs: 11 let 12 extra = import ./_pkgs/default.nix { inherit lib pkgs; }; 13 in 14 (import ./_impacket.nix { inherit lib pkgs; }).both 15 ++ [ 16 # krbrelayx: `printerbug` coerces authentication out of a host over 17 # MS-RPRN — the printer bug — and is the Linux counterpart to 18 # SpoolSample.exe. Also krbrelayx, addspn, dnstool. Not in nixpkgs. 19 extra.krbrelayx 20 # linWinPwn: drives the tools in this category in sequence. Its wrapper 21 # carries them all on PATH, so it works without a Kali-shaped filesystem. 22 extra.linwinpwn 23 ] 24 ++ (with pkgs; [ 25 netexec # `nxc`, the maintained CrackMapExec 26 certipy # ADCS 27 # TWO collectors, because the formats are NOT interchangeable: 28 bloodhound-py # `bloodhound-python` 1.9 -> LEGACY (pre-CE) JSON 29 rusthound-ce # `rusthound-ce` -> BloodHound CE JSON, and much faster 30 kerbrute 31 responder 32 mitm6 33 coercer 34 donpapi 35 adidnsdump 36 ldapdomaindump 37 smbmap 38 evil-winrm 39 krb5 40 openldap 41 samba 42 ]) 43 ++ (with pkgs.python3Packages; [ 44 pypykatz 45 bloodyad # `bloodyAD` 46 lsassy 47 dploot 48 masky 49 pywerview 50 ]); 51 # pywerview is installed but kept OUT of the shared python env: it is the 52 # only tool pulling ldap3-bleeding-edge while everything else pulls 53 # ldap3-2.9.1, and buildEnv cannot hold both (spec C2's documented fallback). 54 # Its own wrapper carries the bleeding-edge copy, so the command works. 55 # PowerView proper is staged at $PAYLOADS/scripts/ad/PowerView.ps1. 56 57 expectedBins = [ 58 "nxc" "certipy" "bloodhound-python" "kerbrute" "responder" "mitm6" 59 "coercer" "donpapi" "adidnsdump" "ldapdomaindump" "smbmap" "evil-winrm" 60 "pypykatz" "bloodyAD" "lsassy" "dploot" "masky" "pywerview" 61 # From _impacket.nix: proves the shared helper composes with this category. 62 "secretsdump" "ntlmrelayx" "GetUserSPNs" "secretsdump.py" 63 "rusthound-ce" 64 # From _pkgs/: the printer-bug family, and the automation front-end. 65 "printerbug" "krbrelayx" "addspn" "dnstool" "linWinPwn" 66 ]; 67 68 # The python-heavy ones, actually executed: these are the tools that resolve 69 # on PATH and then fail at import time. 70 smokeBins = [ 71 "nxc" "certipy" "bloodhound-python" "pypykatz" "bloodyAD" "lsassy" 72 "dploot" "masky" "pywerview" "donpapi" "coercer" "adidnsdump" 73 "ldapdomaindump" "smbmap" "printerbug" "krbrelayx" "secretsdump" 74 ]; 75 }