Add new SMB module to extract GPO deployed privilege assignments

[Yeeb1]

Description

A new module to extract privilege assignments from GPOs by parsing the GptTmpl.inf of the Default Domain Policy and spidering for other GPO deployed privileges. The module also resolves the Security Identifiers (SIDs) via LDAP - LDAP resolution can be disabled when the NO_LDAP flag is set.

The file spidering and retrieval functionality in this module was inspired by the gpp_autologin and gpp_password modules, while the LDAPS connection logic was partially adapted from the add-computer module and a fallback to LDAP was added.

Type of change

• [X] New feature (non-breaking change which adds functionality)
• [X] This change requires a documentation update

How Has This Been Tested?

1. Parsing GPO files from an SMB share on a Windows domain controller (tested with SYSVOL read access).
2. Resolving SIDs using LDAP over SSL (LDAPS) and plaintext LDAP as fallback.
3. Validating the NO_LDAP flag to ensure LDAP queries are bypassed when enabled.
4. Tested against a couple of machines which have GptTmpl.inf deployed.

Screenshots:

Checklist:

• [X] I have ran Ruff against my changes (via poetry: poetry run python -m ruff check . --preview, use --fix to automatically fix what it can)
• [X] My code follows the style guidelines of this project (should be covered by Ruff above)
• [X] I have performed a self-review of my own code
• [X] I have commented my code, particularly in hard-to-understand areas

[NeffIsBack]

Thanks for the PR! I will take a closer look at it when i have the time.

What i quickly spotted is that it instantiates a new ldap connection. Do you need ldap3 or why is this been done?

[Yeeb1]

Hey!

This is an SMB module, which extracts GptTmpl.inf from the Default Domain Policy and from other deployed GPOs to identify permissions deployed via GPOs. The GptTmpl.inf maps assigned permissions via SIDs, so the ldap3 connection is initiated to resolve the SIDs to users and groups. Also added the no_ldap flag, which disables the LDAP connectons, so SIDs wont be resolved.

[NeffIsBack]

oh right haha, missed that

[NeffIsBack]

Fyi i replaced the share listing with a simple listPath command on the sysvol share to prevent all the --shares logic from running (including the printed privileges).