$ show skelsec/msldap
msldap is a Python library and CLI tool for interacting with Microsoft Active Directory via LDAP. It provides both a low-level async connection (MSLDAPClientConnection) and a high-level client (MSLDAPClient) with convenience methods for enumerating users, computers, groups, GPOs, trusts, and more. The library supports multiple authentication methods (NTLM, Kerberos, simple, SSPI), LDAPS, SOCKS proxy, and includes an interactive console client (msldap) and a BloodHound collector (msldap-bloodhound). It also features ADCS vulnerability scanning, shadow credentials, LAPS extraction, DNS record manipulation, and an LDAP relay server. The codebase is well-organized with a modular architecture, extensive test suite (offline and live interop tests), and several reusable components such as a custom ASN.1 packetizer, LDAP filter parser, and binary structure parser. However, it has some known bugs (7 registered in known_failures.yml), vendored dependencies (asciitree, aiocmd) that may drift from upstream, and a few code quality issues (typos, dead code). Overall, it is a solid, feature-rich tool for AD security assessments.
The LLM identified 4 files worth highlighting for reuse:
LDAPPacketizer is a custom asyncio packetizer that handles ASN.1 length decoding and framing for LDAP over TCP/SSL. It is self-contained (imports only asyncio and protocol constants) and can be reused in any project requiring ASN.1-based network communication. It demonstrates non-obvious skill in implementing a streaming protocol with proper length handling.
A generic binary structure parser that allows defining structures with fields (e.g., uint32, bytes) and parsing them from raw bytes. It is completely self-contained (no internal imports) and can be extracted for any project that needs to parse binary protocols or file formats. It demonstrates clean design for declarative binary parsing.
Provides a fluent API (Attribute class) for building LDAP filter strings programmatically (e.g., Attribute('cn').equal_to('admin')). It also includes a recursive-descent parser for LDAP filter strings. The filter builder is self-contained and can be reused in any LDAP-related project. It demonstrates a clean builder pattern and robust parsing.
Implements generation of KeyCredentialLink values for shadow credentials attacks. It handles creation of X.509 certificates, RSA key pairs, and the binary KeyCredential structure. It is self-contained (imports only cryptography and a few internal helpers) and can be reused in other AD security tools. It demonstrates deep knowledge of AD authentication internals.