Impacket owneredit.py

Back to the Category Index / Back to the Command Index

Overview

Reads the owner from an LDAP object’s security descriptor and changes it to a specified SID.

Item	Details
Implementation	examples/owneredit.py
Category	Active Directory / LDAP / Account Management
Size	281 lines
Distribution	Installed as a script through scripts=examples/*.py in setup.py

CLI and Inputs

Check python examples/owneredit.py -h for the current option definitions.

Argument	Description
identity	domain.local/username[:password]
-ldaps / -use-ldaps	Use LDAPS instead of LDAP.
-ts	Add timestamps to log output.
-debug	Enable debug logging.
-hashes	NTLM hashes in LMHASH:NTHASH format.
-no-pass	Skip the password prompt (useful with -k).
-k	Use Kerberos authentication. Read credentials from the ccache (KRB5CCNAME) based on the target; fall back to command-line credentials if none are valid.
-aesKey	128- or 256-bit AES key for Kerberos authentication.
-dc-ip	Domain controller or Kerberos KDC IP address. Defaults to the domain (FQDN) in identity.
-dc-host	Domain controller or Kerberos KDC hostname. Uses -dc-ip if omitted.
-new-owner	New owner’s sAMAccountName.
-new-owner-sid	New owner’s security identifier.
-new-owner-dn	New owner’s distinguished name.
-target	Target sAMAccountName.
-target-sid	Target security identifier.
-target-dn	Target distinguished name.
-action	Operation on the owner attribute (choices: read, write; default: read).

Detailed Processing Flow

The command resolves the target and new owner from a name, SID, or DN, then requests the descriptor’s owner security information. read displays the current owner; write changes only the owner field through LDAP modify.

How It Works

The owner in a security descriptor is a separate field from the DACL’s ACEs. The command requests the owner portion through an LDAP security descriptor control and resolves both the target object and new owner principal from a name, SID, or DN. read converts the current owner SID to an account name if possible.

write replaces the owner field in the retrieved descriptor with a new SID and performs LDAP modify with an owner security information control mask. It does not rebuild the whole DACL, avoiding damage to unrelated ACEs, SACLs, and group data while signaling to the server that only the owner should change. Eligibility as a new owner and the caller’s right to change ownership are separate checks.

Distinguish SID resolution failures, zero or multiple object search results, and a lack of WRITE_OWNER permission. Ownership changes can affect later ACL editing rights, so on success record the target DN, old owner, and new owner without exposing secrets.

Key Implementation Elements

Symbol	Location	Entry Point for Tracing Behavior
OwnerEdit	111	__init__(), read(), write(), search_target_principal_security_descriptor(), resolveSID()
parse_args()	213	Module function
main()	250	Module function

Dependencies

Internal Impacket Modules

Module	Main Names Used
impacket	version
impacket.examples	logger, utils
impacket.ldap	ldaptypes
impacket.examples.utils	init_ldap_session, parse_identity

External Packages (Direct Use)

Import Name	Distribution Package	Usage / Declaration Status
ldap3	ldap3	Imported directly; declared dependency
ldapdomaindump	ldapdomaindump	Imported directly; declared dependency

Output, Side Effects, and Required Privileges

• Some operations change the target’s state. Confirm the target name, SID, and path before making changes.

Failure Paths and Cleanup

• On failure, use protocol status to determine whether name resolution, connection, authentication, service state, or permissions stopped the operation.

When Changing the Implementation

This command uses ldap3, ldapdomaindump, ldaptypes, and the security descriptor control. OwnerEdit resembles dacledit, which handles DACLs, but changes only the owner. Preserve the control mask and unchanged portions of the descriptor.

Verification

• Syntax: python -m py_compile examples/owneredit.py
• CLI: python examples/owneredit.py -h
• Related test: tests/SMB_RPC/test_ldap.py