| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | using System.DirectoryServices.Protocols; |
| | | 4 | | using System.Linq; |
| | | 5 | | using System.Threading.Tasks; |
| | | 6 | | using Microsoft.Extensions.Logging; |
| | | 7 | | using SharpHoundCommonLib.DirectoryObjects; |
| | | 8 | | using SharpHoundCommonLib.Enums; |
| | | 9 | | using SharpHoundCommonLib.LDAPQueries; |
| | | 10 | | using SharpHoundCommonLib.OutputTypes; |
| | | 11 | | |
| | | 12 | | namespace SharpHoundCommonLib.Processors |
| | | 13 | | { |
| | | 14 | | public class ContainerProcessor |
| | | 15 | | { |
| | | 16 | | private readonly ILogger _log; |
| | | 17 | | private readonly ILdapUtils _utils; |
| | | 18 | | |
| | 6 | 19 | | public ContainerProcessor(ILdapUtils utils, ILogger log = null) |
| | 6 | 20 | | { |
| | 6 | 21 | | _utils = utils; |
| | 6 | 22 | | _log = log ?? Logging.LogProvider.CreateLogger("ContainerProc"); |
| | 6 | 23 | | } |
| | | 24 | | |
| | | 25 | | private static bool IsDistinguishedNameFiltered(string distinguishedName) |
| | 7 | 26 | | { |
| | 7 | 27 | | var dn = distinguishedName.ToUpper(); |
| | 8 | 28 | | if (dn.Contains("CN=PROGRAM DATA,DC=")) return true; |
| | | 29 | | |
| | 9 | 30 | | if (dn.Contains("CN=SYSTEM,DC=")) return true; |
| | | 31 | | |
| | 3 | 32 | | return false; |
| | 7 | 33 | | } |
| | | 34 | | |
| | | 35 | | /// <summary> |
| | | 36 | | /// Helper function to pass commonlib types to GetContainingObject |
| | | 37 | | /// </summary> |
| | | 38 | | /// <param name="entry"></param> |
| | | 39 | | /// <returns></returns> |
| | | 40 | | public async Task<(bool Success, TypedPrincipal principal)> GetContainingObject(IDirectoryObject entry) |
| | 0 | 41 | | { |
| | 0 | 42 | | if (entry.TryGetDistinguishedName(out var dn)) { |
| | 0 | 43 | | _log.LogTrace("Reading containing object for {DN}", dn); |
| | 0 | 44 | | return await GetContainingObject(dn); |
| | | 45 | | } |
| | | 46 | | |
| | 0 | 47 | | return (false, default); |
| | 0 | 48 | | } |
| | | 49 | | |
| | | 50 | | /// <summary> |
| | | 51 | | /// Uses the distinguishedname of an object to get its containing object by stripping the first part and using t |
| | | 52 | | /// Saves lots of LDAP calls compared to enumerating container info directly |
| | | 53 | | /// </summary> |
| | | 54 | | /// <param name="distinguishedName"></param> |
| | | 55 | | /// <returns></returns> |
| | | 56 | | public async Task<(bool Success, TypedPrincipal Principal)> GetContainingObject(string distinguishedName) |
| | 4 | 57 | | { |
| | 4 | 58 | | var containerDn = Helpers.RemoveDistinguishedNamePrefix(distinguishedName); |
| | | 59 | | |
| | | 60 | | //If the container is the builtin container, we want to redirect the containing object to the domain of the |
| | 4 | 61 | | if (containerDn.StartsWith("CN=BUILTIN", StringComparison.OrdinalIgnoreCase)) |
| | 1 | 62 | | { |
| | | 63 | | //This is always safe |
| | 1 | 64 | | var domain = Helpers.DistinguishedNameToDomain(distinguishedName); |
| | 2 | 65 | | if (await _utils.GetDomainSidFromDomainName(domain) is (true, var domainSid)) { |
| | 1 | 66 | | return (true, new TypedPrincipal(domainSid, Label.Domain)); |
| | | 67 | | } |
| | | 68 | | |
| | 0 | 69 | | return (false, default); |
| | | 70 | | } |
| | | 71 | | |
| | 3 | 72 | | return await _utils.ResolveDistinguishedName(containerDn); |
| | 4 | 73 | | } |
| | | 74 | | |
| | | 75 | | /// <summary> |
| | | 76 | | /// Helper function using commonlib types to pass to GetContainerChildObjects |
| | | 77 | | /// </summary> |
| | | 78 | | /// <param name="result"></param> |
| | | 79 | | /// <param name="entry"></param> |
| | | 80 | | /// <returns></returns> |
| | | 81 | | public IAsyncEnumerable<TypedPrincipal> GetContainerChildObjects(ResolvedSearchResult result, |
| | | 82 | | IDirectoryObject entry) |
| | 0 | 83 | | { |
| | 0 | 84 | | var name = result.DisplayName; |
| | 0 | 85 | | if (entry.TryGetDistinguishedName(out var dn)) { |
| | 0 | 86 | | return GetContainerChildObjects(dn, name); |
| | | 87 | | } |
| | | 88 | | |
| | 0 | 89 | | return AsyncEnumerable.Empty<TypedPrincipal>(); |
| | 0 | 90 | | } |
| | | 91 | | |
| | | 92 | | /// <summary> |
| | | 93 | | /// Finds all immediate child objects of a container. |
| | | 94 | | /// </summary> |
| | | 95 | | /// <param name="distinguishedName"></param> |
| | | 96 | | /// <param name="containerName"></param> |
| | | 97 | | /// <returns></returns> |
| | | 98 | | public async IAsyncEnumerable<TypedPrincipal> GetContainerChildObjects(string distinguishedName, string containe |
| | 1 | 99 | | { |
| | 1 | 100 | | var filter = new LdapFilter().AddComputers().AddUsers().AddGroups().AddOUs().AddContainers(); |
| | 1 | 101 | | filter.AddCertificateAuthorities().AddCertificateTemplates().AddEnterpriseCertificationAuthorities(); |
| | 17 | 102 | | await foreach (var childEntryResult in _utils.Query(new LdapQueryParameters { |
| | 1 | 103 | | DomainName = Helpers.DistinguishedNameToDomain(distinguishedName), |
| | 1 | 104 | | SearchScope = SearchScope.OneLevel, |
| | 1 | 105 | | Attributes = CommonProperties.ObjectID, |
| | 1 | 106 | | LDAPFilter = filter.GetFilter(), |
| | 1 | 107 | | SearchBase = distinguishedName |
| | 8 | 108 | | })) { |
| | 7 | 109 | | if (!childEntryResult.IsSuccess) { |
| | 0 | 110 | | _log.LogWarning("Error while getting container child objects for {DistinguishedName}: {Reason}", dis |
| | 0 | 111 | | yield break; |
| | | 112 | | } |
| | | 113 | | |
| | 7 | 114 | | var childEntry = childEntryResult.Value; |
| | 11 | 115 | | if (!childEntry.TryGetDistinguishedName(out var dn) || IsDistinguishedNameFiltered(dn)) { |
| | 4 | 116 | | _log.LogTrace("Skipping filtered child {Child} for {Container}", dn, containerName); |
| | 4 | 117 | | continue; |
| | | 118 | | } |
| | | 119 | | |
| | 4 | 120 | | if (!childEntry.GetObjectIdentifier(out var id)) { |
| | 1 | 121 | | _log.LogTrace("Got null ID for {ChildDN} under {Container}", dn, |
| | 1 | 122 | | containerName); |
| | 1 | 123 | | continue; |
| | | 124 | | } |
| | | 125 | | |
| | 2 | 126 | | var res = await _utils.ResolveIDAndType(id, Helpers.DistinguishedNameToDomain(dn)); |
| | 3 | 127 | | if (res.Success) { |
| | 1 | 128 | | yield return res.Principal; |
| | 1 | 129 | | } |
| | 2 | 130 | | } |
| | 1 | 131 | | } |
| | | 132 | | |
| | | 133 | | public IAsyncEnumerable<GPLink> ReadContainerGPLinks(ResolvedSearchResult result, IDirectoryObject entry) |
| | 0 | 134 | | { |
| | 0 | 135 | | if (entry.TryGetProperty(LDAPProperties.GPLink, out var links)) { |
| | 0 | 136 | | return ReadContainerGPLinks(links); |
| | | 137 | | } |
| | | 138 | | |
| | 0 | 139 | | return AsyncEnumerable.Empty<GPLink>(); |
| | 0 | 140 | | } |
| | | 141 | | |
| | | 142 | | /// <summary> |
| | | 143 | | /// Reads the "gplink" property from a SearchResult and converts the links into the acceptable SharpHound fo |
| | | 144 | | /// </summary> |
| | | 145 | | /// <param name="gpLink"></param> |
| | | 146 | | /// <returns></returns> |
| | | 147 | | public async IAsyncEnumerable<GPLink> ReadContainerGPLinks(string gpLink) |
| | 3 | 148 | | { |
| | 3 | 149 | | if (gpLink == null) |
| | 1 | 150 | | yield break; |
| | | 151 | | |
| | 14 | 152 | | foreach (var link in Helpers.SplitGPLinkProperty(gpLink)) |
| | 4 | 153 | | { |
| | 4 | 154 | | var enforced = link.Status.Equals("2"); |
| | | 155 | | |
| | 4 | 156 | | var res = await _utils.ResolveDistinguishedName(link.DistinguishedName); |
| | | 157 | | |
| | 7 | 158 | | if (res.Success) { |
| | 3 | 159 | | yield return new GPLink |
| | 3 | 160 | | { |
| | 3 | 161 | | GUID = res.Principal.ObjectIdentifier, |
| | 3 | 162 | | IsEnforced = enforced |
| | 3 | 163 | | }; |
| | 3 | 164 | | } |
| | 4 | 165 | | } |
| | 3 | 166 | | } |
| | | 167 | | |
| | | 168 | | /// <summary> |
| | | 169 | | /// Checks if a container blocks privilege inheritance |
| | | 170 | | /// </summary> |
| | | 171 | | /// <param name="gpOptions"></param> |
| | | 172 | | /// <returns></returns> |
| | | 173 | | public static bool ReadBlocksInheritance(string gpOptions) |
| | 3 | 174 | | { |
| | 3 | 175 | | return gpOptions is "1"; |
| | 3 | 176 | | } |
| | | 177 | | } |
| | | 178 | | } |