var metadata = {

name: "LDAP",

description: "Modular LDAP administration toolkit for Active Directory management"

};

// Helper function to determine if input is a username or a distinguished name

function identifyInputType(input) {

const usernameRegex = /^[a-zA-Z0-9._-]{1,64}$/;

const dnRegex = /^(?:[A-Z]+=[^,]+)(?:,(?:[A-Z]+=[^,]+))*$/i;

if (dnRegex.test(input)) {

return 1;

} else if (usernameRegex.test(input)) {

return 0;

} else {

return 0;

}

}

// ============================================================================

// GET COMMANDS

// ============================================================================

// Command: get-users

var _cmd_getusers = ax.create_command(

"get-users",

"List all users in the domain",

"ldap get-users -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local -a description,mail"

);

_cmd_getusers.addArgFlagString("-ou", "ou_path", false, "OU path to search (optional)");

_cmd_getusers.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getusers.addArgFlagString("-a", "attributes", false, "Comma-separated list of attributes to retrieve (always includes sAMAccountName)");

_cmd_getusers.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getusers.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let attributes = parsed_json["attributes"] || "";

let bof_params = ax.bof_pack("cstr,cstr,int,cstr", [ou_path, dc_fqdn, use_ldaps, attributes]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-users." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Enumerating domain users...");

});

// Command: get-computers

var _cmd_getcomputers = ax.create_command(

"get-computers",

"List all computers in the domain",

"ldap get-computers -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local -a description,operatingSystem"

);

_cmd_getcomputers.addArgFlagString("-ou", "ou_path", false, "OU path to search (optional)");

_cmd_getcomputers.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getcomputers.addArgFlagString("-a", "attributes", false, "Comma-separated list of attributes to retrieve (always includes sAMAccountName)");

_cmd_getcomputers.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getcomputers.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let attributes = parsed_json["attributes"] || "";

let bof_params = ax.bof_pack("cstr,cstr,int,cstr", [ou_path, dc_fqdn, use_ldaps, attributes]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-computers." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Enumerating domain computers...");

});

// Command: get-groups

var _cmd_getgroups = ax.create_command(

"get-groups",

"List all groups in the domain",

"ldap get-groups -ou \"OU=Groups,DC=domain,DC=local\" -dc dc01.domain.local -a description,member"

);

_cmd_getgroups.addArgFlagString("-ou", "ou_path", false, "OU path to search (optional)");

_cmd_getgroups.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getgroups.addArgFlagString("-a", "attributes", false, "Comma-separated list of attributes to retrieve (always includes sAMAccountName)");

_cmd_getgroups.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getgroups.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let attributes = parsed_json["attributes"] || "";

let bof_params = ax.bof_pack("cstr,cstr,int,cstr", [ou_path, dc_fqdn, use_ldaps, attributes]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-groups." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Enumerating domain groups...");

});

// Command: get-usergroups

var _cmd_getusergroups = ax.create_command(

"get-usergroups",

"List all groups a user is a member of",

"ldap get-usergroups jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getusergroups.addArgString("user", true, "Username or DN");

_cmd_getusergroups.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getusergroups.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getusergroups.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getusergroups.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let user = parsed_json["user"];

let is_dn = identifyInputType(user);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [user, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-usergroups." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying groups for ${user}...`);

});

// Command: get-groupmembers

var _cmd_getgroupmembers = ax.create_command(

"get-groupmembers",

"List all members of a group",

"ldap get-groupmembers \"Domain Admins\" -ou \"OU=Groups,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getgroupmembers.addArgString("group", true, "Group name or DN");

_cmd_getgroupmembers.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getgroupmembers.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getgroupmembers.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let group = parsed_json["group"];

let is_dn = identifyInputType(group);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let bof_params = ax.bof_pack("cstr,int,cstr,cstr", [group, is_dn, ou_path, dc_fqdn]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-groupmembers." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying members of ${group}...`);

});

// Command: get-object

var _cmd_getobject = ax.create_command(

"get-object",

"Get all attributes of an object",

"ldap get-object jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getobject.addArgString("target", true, "Object name or DN");

_cmd_getobject.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getobject.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getobject.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getobject.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-object." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying object ${target}...`);

});

// Command: get-domaininfo

var _cmd_getdomaininfo = ax.create_command(

"get-domaininfo",

"Get domain information from rootDSE",

"ldap get-domaininfo -dc dc01.domain.local"

);

_cmd_getdomaininfo.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getdomaininfo.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getdomaininfo.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int", [dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-domaininfo." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Querying domain information...");

});

// Command: get-maq

var _cmd_getmaq = ax.create_command(

"get-maq",

"Get machine account quota (ms-DS-MachineAccountQuota)",

"ldap get-maq -dc dc01.domain.local"

);

_cmd_getmaq.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getmaq.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getmaq.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int", [dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-maq." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Querying machine account quota...");

});

// Command: get-writable

var _cmd_getwritable = ax.create_command(

"get-writable",

"Find objects you have write access to",

"ldap get-writable -ou \"OU=Projects,DC=domain,DC=local\" -dc dc01.domain.local --detailed"

);

_cmd_getwritable.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getwritable.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getwritable.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getwritable.addArgBool("--detailed", "Show detailed output");

_cmd_getwritable.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let detailed = parsed_json["--detailed"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,cstr,int,int", [ou_path, dc_fqdn, use_ldaps, detailed]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-writable." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, "Finding writable objects...");

});

// Command: get-delegation

var _cmd_getdelegation = ax.create_command(

"get-delegation",

"Get delegation configuration for an object",

"ldap get-delegation jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getdelegation.addArgString("target", true, "Object name or DN");

_cmd_getdelegation.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getdelegation.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getdelegation.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getdelegation.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-delegation." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying delegation for ${target}...`);

});

// Command: get-uac

var _cmd_getuac = ax.create_command(

"get-uac",

"Get UAC flags for an object",

"ldap get-uac jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getuac.addArgString("target", true, "Object name or DN");

_cmd_getuac.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getuac.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getuac.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getuac.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-uac." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying UAC for ${target}...`);

});

// Command: get-attribute

var _cmd_getattribute = ax.create_command(

"get-attribute",

"Get specific attribute values (comma-separated list supported)",

"ldap get-attribute jane.doe objectSid,mail,description -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getattribute.addArgString("target", true, "Object name or DN");

_cmd_getattribute.addArgString("attributes", true, "Comma-separated list of attribute names to retrieve (always includes sAMAccountName)");

_cmd_getattribute.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getattribute.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getattribute.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getattribute.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let attributes = parsed_json["attributes"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, attributes, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-attribute." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying ${attributes} for ${target}...`);

});

// Command: get-spn

var _cmd_getspn = ax.create_command(

"get-spn",

"Get SPNs for an object",

"ldap get-spn machine01$ -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getspn.addArgString("target", true, "Object name or DN");

_cmd_getspn.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getspn.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getspn.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getspn.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-spn." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying SPNs for ${target}...`);

});

// Command: get-acl

var _cmd_getacl = ax.create_command(

"get-acl",

"Get ACL/security descriptor for an object",

"ldap get-acl jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local --resolve"

);

_cmd_getacl.addArgString("target", true, "Object name or DN");

_cmd_getacl.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getacl.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getacl.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getacl.addArgBool("--resolve", "Resolve SID names");

_cmd_getacl.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let resolve = parsed_json["--resolve"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps, resolve]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-acl." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying ACL for ${target}...`);

});

// Command: get-rbcd

var _cmd_getrbcd = ax.create_command(

"get-rbcd",

"Get RBCD configuration for an object",

"ldap get-rbcd somecomputer$ -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_getrbcd.addArgString("target", true, "Object name or DN");

_cmd_getrbcd.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_getrbcd.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_getrbcd.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_getrbcd.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [target, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/get-rbcd." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Querying RBCD for ${target}...`);

});

// ============================================================================

// ADD COMMANDS

// ============================================================================

// Command: add-user

var _cmd_adduser = ax.create_command(

"add-user",

"Add a user to the domain",

"ldap add-user jane.doe 'P@ssw0rd!' -fn Jane -ln Doe -email jane.doe@domain.local -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_adduser.addArgString("username", true, "Username or DN");

_cmd_adduser.addArgString("password", true, "Password for the user");

_cmd_adduser.addArgFlagString("-fn", "firstname", false, "First name");

_cmd_adduser.addArgFlagString("-ln", "lastname", false, "Last name");

_cmd_adduser.addArgFlagString("-email", "email", false, "Email address");

_cmd_adduser.addArgBool("--disabled", "Create account disabled");

_cmd_adduser.addArgFlagString("-ou", "ou_path", false, "Target OU path");

_cmd_adduser.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_adduser.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_adduser.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let username = parsed_json["username"];

let is_dn = identifyInputType(username);

let password = parsed_json["password"];

let firstname = parsed_json["firstname"] || "";

let lastname = parsed_json["lastname"] || "";

let email = parsed_json["email"] || "";

let disabled = parsed_json["--disabled"] ? 1 : 0;

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = 1; // Always use LDAPS for password operations

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,int,cstr,cstr,int",

[username, is_dn, password, firstname, lastname, email, disabled, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-user." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding user ${username}...`);

});

// Command: add-computer

var _cmd_addcomputer = ax.create_command(

"add-computer",

"Add a computer to the domain",

"ldap add-computer WORKSTATION01 -p 'P@ssw0rd!' -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local --ldaps"

);

_cmd_addcomputer.addArgString("computer", true, "Computer name or DN");

_cmd_addcomputer.addArgFlagString("-p", "password", false, "Password for the computer");

_cmd_addcomputer.addArgFlagString("-ou", "ou_path", false, "Target OU path");

_cmd_addcomputer.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addcomputer.addArgBool("--disabled", "Create account disabled");

_cmd_addcomputer.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addcomputer.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let computer = parsed_json["computer"];

let is_dn = identifyInputType(computer);

let password = parsed_json["password"] || "";

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let disabled = parsed_json["--disabled"] ? 1 : 0;

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

if (password) use_ldaps = 1;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int,int",

[computer, is_dn, password, ou_path, dc_fqdn, disabled, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-computer." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding computer ${computer}...`);

});

// Command: add-group

var _cmd_addgroup = ax.create_command(

"add-group",

"Add a group to the domain",

"ldap add-group Stark -desc \"House Stark\" -scope global -ou \"OU=Groups,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addgroup.addArgString("groupname", true, "Group name or DN");

_cmd_addgroup.addArgFlagString("-desc", "description", false, "Group description");

_cmd_addgroup.addArgFlagString("-type", "type", false, "Group type: security or distribution");

_cmd_addgroup.addArgFlagString("-scope", "scope", false, "Group scope: global, domainlocal, or universal");

_cmd_addgroup.addArgFlagString("-ou", "ou_path", false, "Target OU path");

_cmd_addgroup.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addgroup.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addgroup.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let groupname = parsed_json["groupname"];

let is_dn = identifyInputType(groupname);

let description = parsed_json["description"] || "";

let type = parsed_json["type"] || "";

let scope = parsed_json["scope"] || "";

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,cstr,int",

[groupname, is_dn, description, type, scope, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-group." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding group ${groupname}...`);

});

// Command: add-groupmember

var _cmd_addgroupmember = ax.create_command(

"add-groupmember",

"Add a member to a group",

"ldap add-groupmember Stark jane.doe -ou \"OU=Groups,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addgroupmember.addArgString("group", true, "Group name or DN");

_cmd_addgroupmember.addArgString("member", true, "Member name or DN");

_cmd_addgroupmember.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addgroupmember.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addgroupmember.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addgroupmember.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let group = parsed_json["group"];

let is_group_dn = identifyInputType(group);

let member = parsed_json["member"];

let is_member_dn = identifyInputType(member);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,int",

[group, is_group_dn, member, is_member_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-groupmember." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding ${member} to ${group}...`);

});

// Command: add-ou

var _cmd_addou = ax.create_command(

"add-ou",

"Add an organizational unit",

"ldap add-ou 'OU=Research,DC=domain,DC=local' -desc \"Research OU\" -dc dc01.domain.local"

);

_cmd_addou.addArgString("ou_name", true, "OU name or DN");

_cmd_addou.addArgFlagString("-desc", "description", false, "OU description");

_cmd_addou.addArgFlagString("-parent", "parent_ou", false, "Parent OU DN");

_cmd_addou.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addou.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addou.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let ou_name = parsed_json["ou_name"];

let is_dn = identifyInputType(ou_name);

let description = parsed_json["description"] || "";

let parent_ou = parsed_json["parent_ou"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int",

[ou_name, is_dn, description, parent_ou, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-ou." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding OU ${ou_name}...`);

});

// Command: add-sidhistory

var _cmd_addsidhistory = ax.create_command(

"add-sidhistory",

"Add a SID to an object's sidHistory attribute",

"ldap add-sidhistory jane.doe S-1-5-21-123456789-123456789-123456789-500 -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addsidhistory.addArgString("target", true, "Target object name or DN");

_cmd_addsidhistory.addArgString("sid_source", true, "SID string (S-1-5-...), username, or DN to copy SID from");

_cmd_addsidhistory.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addsidhistory.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addsidhistory.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addsidhistory.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_target_dn = identifyInputType(target);

let sid_source = parsed_json["sid_source"];

let is_sid_source_dn = identifyInputType(sid_source);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,int",

[target, is_target_dn, sid_source, is_sid_source_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-sidhistory." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding SID to ${target}'s sidHistory...`);

});

// Command: add-spn

var _cmd_addspn = ax.create_command(

"add-spn",

"Add an SPN to an object",

"ldap add-spn machine01 HOST/machine01.domain.local -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addspn.addArgString("target", true, "Object name or DN");

_cmd_addspn.addArgString("spn", true, "SPN to add");

_cmd_addspn.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addspn.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addspn.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addspn.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-spn." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding SPN ${spn} to ${target}...`);

});

// Command: add-attribute

var _cmd_addattribute = ax.create_command(

"add-attribute",

"Add a value to an attribute",

"ldap add-attribute jane.doe description 'File not found' -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addattribute.addArgString("target", true, "Object name or DN");

_cmd_addattribute.addArgString("attribute", true, "Attribute name");

_cmd_addattribute.addArgString("value", true, "Value to add");

_cmd_addattribute.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addattribute.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addattribute.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addattribute.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let attribute = parsed_json["attribute"];

let value = parsed_json["value"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,int",

[target, is_dn, attribute, value, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-attribute." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding ${attribute} value to ${target}...`);

});

// Command: add-uac

var _cmd_adduac = ax.create_command(

"add-uac",

"Add UAC flags to an object",

"ldap add-uac jane.doe TRUSTED_FOR_DELEGATION -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_adduac.addArgString("target", true, "Object name or DN");

_cmd_adduac.addArgString("flags", true, "Comma-separated UAC flags (e.g., DONT_REQ_PREAUTH,DONT_EXPIRE_PASSWD)");

_cmd_adduac.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_adduac.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_adduac.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_adduac.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let flags = parsed_json["flags"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, flags, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-uac." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding UAC flags to ${target}...`);

});

// Command: add-delegation

var _cmd_adddelegation = ax.create_command(

"add-delegation",

"Add a delegation SPN to an object",

"ldap add-delegation machine01 RestrictedKrbHost/machine01.domain.local -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_adddelegation.addArgString("target", true, "Object name or DN");

_cmd_adddelegation.addArgString("spn", true, "Delegation SPN to add");

_cmd_adddelegation.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_adddelegation.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_adddelegation.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_adddelegation.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-delegation." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding delegation SPN to ${target}...`);

});

// Command: add-ace

var _cmd_addace = ax.create_command(

"add-ace",

"Add an ACE to an object's DACL",

"ldap add-ace CN=SomeObject,OU=Data,DC=domain,DC=local jane.doe WRITE -dc dc01.domain.local"

);

_cmd_addace.addArgString("target", true, "Target object name or DN");

_cmd_addace.addArgString("trustee", true, "Trustee name or DN");

_cmd_addace.addArgString("rights", true, "Access rights (e.g., GenericAll, WriteDacl)");

_cmd_addace.addArgFlagString("-type", "ace_type", false, "ACE type: allow (default), deny");

_cmd_addace.addArgFlagString("-flags", "flags", false, "ACE inheritance flags (e.g., CI,OI)");

_cmd_addace.addArgFlagString("-guid", "guid", false, "Object type GUID");

_cmd_addace.addArgFlagString("-inherit-guid", "inherit_guid", false, "Inherited object type GUID");

_cmd_addace.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addace.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addace.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addace.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_target_dn = identifyInputType(target);

let trustee = parsed_json["trustee"];

let is_trustee_dn = identifyInputType(trustee);

let rights = parsed_json["rights"];

let ace_type = parsed_json["ace_type"] || "";

let flags = parsed_json["flags"] || "";

let guid = parsed_json["guid"] || "";

let inherit_guid = parsed_json["inherit_guid"] || "";

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,cstr,cstr,cstr,cstr,cstr,int",

[target, is_target_dn, trustee, is_trustee_dn, rights, ace_type, flags, guid, inherit_guid, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-ace." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding ACE to ${target}...`);

});

// Command: add-rbcd

var _cmd_addrbcd = ax.create_command(

"add-rbcd",

"Add an RBCD delegation",

"ldap add-rbcd targetComputer$ principalAccount$ -ou \"OU=Computers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_addrbcd.addArgString("target", true, "Target object name or DN");

_cmd_addrbcd.addArgString("delegate", true, "Object allowed to delegate");

_cmd_addrbcd.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_addrbcd.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_addrbcd.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_addrbcd.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_target_dn = identifyInputType(target);

let delegate = parsed_json["delegate"];

let is_delegate_dn = identifyInputType(delegate);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,int",

[target, is_target_dn, delegate, is_delegate_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/add-rbcd." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Adding RBCD delegation to ${target}...`);

});

// ============================================================================

// SET COMMANDS

// ============================================================================

// Command: set-password

var _cmd_setpassword = ax.create_command(

"set-password",

"Set/reset a user's password",

"ldap set-password jane.doe 'N3wP@ssw0rd!' -old 'OldP@ss' -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_setpassword.addArgString("target", true, "User name or DN");

_cmd_setpassword.addArgString("password", true, "New password");

_cmd_setpassword.addArgFlagString("-old", "old_password", false, "Old password (required for self-service password change, omit for admin reset)");

_cmd_setpassword.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setpassword.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setpassword.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let password = parsed_json["password"];

let old_password = parsed_json["old_password"] || "";

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = 1; // Always use LDAPS for password operations

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,int", [target, is_dn, password, old_password, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-password." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting password for ${target}...`);

});

// Command: set-spn

var _cmd_setspn = ax.create_command(

"set-spn",

"Set/replace all SPNs on an object",

"ldap set-spn machine01$ HOST/machine01.domain.local -dc dc01.domain.local --ldaps"

);

_cmd_setspn.addArgString("target", true, "Object name or DN");

_cmd_setspn.addArgString("spn", true, "SPN to set (replaces all existing)");

_cmd_setspn.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setspn.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setspn.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_setspn.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-spn." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting SPN on ${target}...`);

});

// Command: set-delegation

var _cmd_setdelegation = ax.create_command(

"set-delegation",

"Set/replace delegation SPNs",

"ldap set-delegation appsvc RestrictedKrbHost/appsvc.domain.local -dc dc01.domain.local --ldaps"

);

_cmd_setdelegation.addArgString("target", true, "Object name or DN");

_cmd_setdelegation.addArgString("spn", true, "Delegation SPN (replaces all existing)");

_cmd_setdelegation.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setdelegation.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setdelegation.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_setdelegation.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-delegation." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting delegation on ${target}...`);

});

// Command: set-attribute

var _cmd_setattribute = ax.create_command(

"set-attribute",

"Set/replace an attribute value",

"ldap set-attribute jane.doe description 'File found' -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_setattribute.addArgString("target", true, "Object name or DN");

_cmd_setattribute.addArgString("attribute", true, "Attribute name");

_cmd_setattribute.addArgString("value", true, "Value to set");

_cmd_setattribute.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setattribute.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setattribute.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_setattribute.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let attribute = parsed_json["attribute"];

let value = parsed_json["value"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,int",

[target, is_dn, attribute, value, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-attribute." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting ${attribute} on ${target}...`);

});

// Command: set-uac

var _cmd_setuac = ax.create_command(

"set-uac",

"Set UAC flags (replaces all)",

"ldap set-uac jane.doe DONT_EXPIRE_PASSWD -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_setuac.addArgString("target", true, "Object name or DN");

_cmd_setuac.addArgString("flags", true, "Comma-separated UAC flags (replaces all)");

_cmd_setuac.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setuac.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setuac.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_setuac.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let flags = parsed_json["flags"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, flags, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-uac." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting UAC flags on ${target}...`);

});

// Command: set-owner

var _cmd_setowner = ax.create_command(

"set-owner",

"Set the owner of an object (requires WriteOwner)",

"ldap set-owner cn=resource,ou=apps,dc=domain,dc=local cn=jane.doe,ou=Users,dc=domain,dc=local -dc dc01.domain.local"

);

_cmd_setowner.addArgString("target", true, "Target object name or DN");

_cmd_setowner.addArgString("owner", true, "New owner name or DN");

_cmd_setowner.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_setowner.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_setowner.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_setowner.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_target_dn = identifyInputType(target);

let owner = parsed_json["owner"];

let is_owner_dn = identifyInputType(owner);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,int",

[target, is_target_dn, owner, is_owner_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/set-owner." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Setting owner of ${target} to ${owner}...`);

});

// ============================================================================

// MOVE COMMANDS

// ============================================================================

// Command: move-object

var _cmd_moveobject = ax.create_command(

"move-object",

"Move an object to a different OU",

"ldap move-object jane.doe \"OU=Managers,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_moveobject.addArgString("object", true, "Object name or DN to move");

_cmd_moveobject.addArgString("destination", true, "Destination OU DN");

_cmd_moveobject.addArgFlagString("-n", "newname", false, "New name for the object (optional)");

_cmd_moveobject.addArgFlagString("-ou", "ou_path", false, "OU path to search for object");

_cmd_moveobject.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_moveobject.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_moveobject.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let object = parsed_json["object"];

let is_dn = identifyInputType(object);

let destination = parsed_json["destination"];

let newname = parsed_json["newname"] || "";

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,cstr,int", [object, is_dn, destination, newname, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/move-object." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Moving ${object} to ${destination}...`);

});

// ============================================================================

// REMOVE COMMANDS

// ============================================================================

// Command: remove-groupmember

var _cmd_removegroupmember = ax.create_command(

"remove-groupmember",

"Remove a member from a group",

"ldap remove-groupmember Stark jane.doe -dc dc01.domain.local"

);

_cmd_removegroupmember.addArgString("group", true, "Group name or DN");

_cmd_removegroupmember.addArgString("member", true, "Member name or DN");

_cmd_removegroupmember.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_removegroupmember.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_removegroupmember.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_removegroupmember.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let group = parsed_json["group"];

let is_group_dn = identifyInputType(group);

let member = parsed_json["member"];

let is_member_dn = identifyInputType(member);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,int,cstr,cstr,int",

[group, is_group_dn, member, is_member_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/remove-groupmember." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Removing ${member} from ${group}...`);

});

// Command: remove-object

var _cmd_removeobject = ax.create_command(

"remove-object",

"Remove an object from the domain",

"ldap remove-object jane.doe -ou \"OU=Users,DC=domain,DC=local\" -dc dc01.domain.local"

);

_cmd_removeobject.addArgString("object", true, "Object name or DN");

_cmd_removeobject.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_removeobject.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_removeobject.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_removeobject.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let object = parsed_json["object"];

let is_dn = identifyInputType(object);

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,int", [object, is_dn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/remove-object." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Removing ${object}...`);

});

// Command: remove-spn

var _cmd_removespn = ax.create_command(

"remove-spn",

"Remove an SPN from an object",

"ldap remove-spn machine01$ HOST/machine01.domain.local -dc dc01.domain.local"

);

_cmd_removespn.addArgString("target", true, "Object name or DN");

_cmd_removespn.addArgString("spn", true, "SPN to remove");

_cmd_removespn.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_removespn.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_removespn.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_removespn.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/remove-spn." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Removing SPN ${spn} from ${target}...`);

});

// Command: remove-delegation

var _cmd_removedelegation = ax.create_command(

"remove-delegation",

"Remove a delegation SPN",

"ldap remove-delegation machine01$ RestrictedKrbHost/machine01.domain.local -dc dc01.domain.local"

);

_cmd_removedelegation.addArgString("target", true, "Object name or DN");

_cmd_removedelegation.addArgString("spn", true, "Delegation SPN to remove");

_cmd_removedelegation.addArgFlagString("-ou", "ou_path", false, "OU path to search");

_cmd_removedelegation.addArgFlagString("-dc", "dc_fqdn", false, "Domain Controller FQDN");

_cmd_removedelegation.addArgBool("--ldaps", "Use LDAPS (port 636)");

_cmd_removedelegation.setPreHook(function (id, cmdline, parsed_json, ...parsed_lines){

let target = parsed_json["target"];

let is_dn = identifyInputType(target);

let spn = parsed_json["spn"];

let ou_path = parsed_json["ou_path"] || "";

let dc_fqdn = parsed_json["dc_fqdn"] || "";

let use_ldaps = parsed_json["--ldaps"] ? 1 : 0;

let bof_params = ax.bof_pack("cstr,int,cstr,cstr,cstr,int", [target, is_dn, spn, ou_path, dc_fqdn, use_ldaps]);

let bof_path = ax.script_dir() + "_bin/LDAP/remove-delegation." + ax.arch(id) + ".o";

ax.execute_alias(id, cmdline, `execute bof ${bof_path} ${bof_params}`, `Removing delegation SPN from ${target}...`);

});

// Command: remove-attribute

var _cmd_removeattribute = ax.create_command(

"remove-attribute",

"Remove an attribute or attribute value",

"ldap remove-attribute jane.doe description -value 'File not found' -dc dc01.domain.local"

);

_cmd_removeattribute.addArgString("target", true, "Object name or DN");

_cmd_removeattribute.addArgString("attribute", true, "Attribute name");