Add LDAP Channel Binding to GetUserSPNs.py

[deadjakk]

I made this for myself and thought I'd throw it up here in case anyone else wanted it.
It should fix this issue by adding LDAP channel binding support via ly4k's ldap3 fork.

I will say the solution is a little less than elegant given it uses ldap3 for all connection attempts except Kerberos which still uses the old python-ldap and SPN processing logic.

It will automagically end up using LDAP channel binding by running through the bind failures or you can force it with -ldap-channel-binding

Tested working.

[wesgreentree]

Working as of Feb 2024. Nice work @deadjakk , hopefully they merge it soon?

[FrankSpierings]

I've installed this code in a venv including the ldap3, but using this code results in the following.

Impacket v0.12.0.dev1+20231121.174316.ffccf9b - Copyright 2023 Fortra

[*] Successfully authenticated
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error list index out of range
No entries found!

Lab environment consists of a Windows 2016 DC. I'll attempt to debug the cause of the issue, but for now I believe it has something to do with ldap3 returning a different style of parameters than expected by GetUserSPNs.py.

[deadjakk]

I've installed this code in a venv including the ldap3, but using this code results in the following.

Impacket v0.12.0.dev1+20231121.174316.ffccf9b - Copyright 2023 Fortra

[*] Successfully authenticated
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error 'attributes'
[-] Skipping item, cannot process due to error list index out of range
No entries found!

Lab environment consists of a Windows 2016 DC. I'll attempt to debug the cause of the issue, but for now I believe it has something to do with ldap3 returning a different style of parameters than expected by GetUserSPNs.py.

Apologies, I did not see this, I guess the notification from GitHub slipped by me.
It is hitting this error because of the searchResRef entries, which as far as I know, are not useful to the process anyways.

I just pushed another commit that filters these out (and handles null group membership).
Screenshot below shows it working with the new commit, I'll keep a closer (read: manual) eye on this PR in case there are any more issues.

[anadrianmanrique]

Setting this PR on-hold as we are not linking either through requirements or code, against dev version of our dependencies. Let's hope ldap3 new version gets released soon. Thanks