| | | 1 | | using System; |
| | | 2 | | using System.Collections.Generic; |
| | | 3 | | using System.DirectoryServices; |
| | | 4 | | using System.Security.Cryptography.X509Certificates; |
| | | 5 | | using System.Security.Principal; |
| | | 6 | | using System.Text; |
| | | 7 | | |
| | | 8 | | namespace SharpHoundCommonLib; |
| | | 9 | | |
| | | 10 | | public class DirectoryEntryWrapper : IDirectoryObject { |
| | | 11 | | private readonly DirectoryEntry _entry; |
| | | 12 | | |
| | 2 | 13 | | public DirectoryEntryWrapper(DirectoryEntry entry) { |
| | 1 | 14 | | _entry = entry; |
| | 1 | 15 | | } |
| | | 16 | | |
| | 0 | 17 | | public bool TryGetDistinguishedName(out string value) { |
| | 0 | 18 | | return TryGetProperty(LDAPProperties.DistinguishedName, out value); |
| | 0 | 19 | | } |
| | | 20 | | |
| | 1 | 21 | | private bool CheckCache(string propertyName) { |
| | 1 | 22 | | try { |
| | 1 | 23 | | if (!_entry.Properties.Contains(propertyName)) |
| | 0 | 24 | | _entry.RefreshCache(new[] { propertyName }); |
| | | 25 | | |
| | 0 | 26 | | return _entry.Properties.Contains(propertyName); |
| | | 27 | | } |
| | 2 | 28 | | catch { |
| | 1 | 29 | | return false; |
| | | 30 | | } |
| | 1 | 31 | | } |
| | | 32 | | |
| | 0 | 33 | | public bool TryGetProperty(string propertyName, out string value) { |
| | 0 | 34 | | value = string.Empty; |
| | 0 | 35 | | if (!CheckCache(propertyName)) { |
| | 0 | 36 | | return false; |
| | | 37 | | } |
| | | 38 | | |
| | 0 | 39 | | var s = _entry.Properties[propertyName].Value; |
| | 0 | 40 | | value = s switch { |
| | 0 | 41 | | string st => st, |
| | 0 | 42 | | int i => i.ToString(), |
| | 0 | 43 | | _ => null |
| | 0 | 44 | | }; |
| | | 45 | | |
| | 0 | 46 | | return value != null; |
| | 0 | 47 | | } |
| | | 48 | | |
| | 0 | 49 | | public bool TryGetByteProperty(string propertyName, out byte[] value) { |
| | 0 | 50 | | value = Array.Empty<byte>(); |
| | 0 | 51 | | if (!CheckCache(propertyName)) { |
| | 0 | 52 | | return false; |
| | | 53 | | } |
| | | 54 | | |
| | 0 | 55 | | var prop = _entry.Properties[propertyName].Value; |
| | 0 | 56 | | if (prop is not byte[] b) return false; |
| | 0 | 57 | | value = b; |
| | 0 | 58 | | return true; |
| | 0 | 59 | | } |
| | | 60 | | |
| | 0 | 61 | | public bool TryGetArrayProperty(string propertyName, out string[] value) { |
| | 0 | 62 | | value = Array.Empty<string>(); |
| | 0 | 63 | | if (!CheckCache(propertyName)) { |
| | 0 | 64 | | return false; |
| | | 65 | | } |
| | | 66 | | |
| | 0 | 67 | | var dest = new List<string>(); |
| | 0 | 68 | | foreach (var val in _entry.Properties[propertyName]) { |
| | 0 | 69 | | if (val is string s) { |
| | 0 | 70 | | dest.Add(s); |
| | 0 | 71 | | } |
| | 0 | 72 | | } |
| | | 73 | | |
| | 0 | 74 | | value = dest.ToArray(); |
| | 0 | 75 | | return true; |
| | 0 | 76 | | } |
| | | 77 | | |
| | 0 | 78 | | public bool TryGetByteArrayProperty(string propertyName, out byte[][] value) { |
| | 0 | 79 | | value = Array.Empty<byte[]>(); |
| | 0 | 80 | | if (!CheckCache(propertyName)) { |
| | 0 | 81 | | return false; |
| | | 82 | | } |
| | | 83 | | |
| | 0 | 84 | | var raw = _entry.Properties[propertyName].Value; |
| | 0 | 85 | | if (raw is not byte[][] b) { |
| | 0 | 86 | | return false; |
| | | 87 | | } |
| | 0 | 88 | | value = b; |
| | 0 | 89 | | return true; |
| | 0 | 90 | | } |
| | | 91 | | |
| | 0 | 92 | | public bool TryGetLongProperty(string propertyName, out long value) { |
| | 0 | 93 | | value = 0; |
| | 0 | 94 | | if (!CheckCache(propertyName)) return false; |
| | | 95 | | |
| | 0 | 96 | | if (!TryGetProperty(propertyName, out var s)) { |
| | 0 | 97 | | return false; |
| | | 98 | | } |
| | | 99 | | |
| | 0 | 100 | | return long.TryParse(s, out value); |
| | 0 | 101 | | } |
| | | 102 | | |
| | 0 | 103 | | public bool TryGetCertificateArrayProperty(string propertyName, out X509Certificate2[] value) { |
| | 0 | 104 | | value = Array.Empty<X509Certificate2>(); |
| | 0 | 105 | | if (!TryGetByteArrayProperty(propertyName, out var bytes)) { |
| | 0 | 106 | | return false; |
| | | 107 | | } |
| | | 108 | | |
| | 0 | 109 | | if (bytes.Length == 0) { |
| | 0 | 110 | | return true; |
| | | 111 | | } |
| | | 112 | | |
| | 0 | 113 | | var result = new List<X509Certificate2>(); |
| | | 114 | | |
| | 0 | 115 | | foreach (var b in bytes) { |
| | 0 | 116 | | try { |
| | 0 | 117 | | var cert = new X509Certificate2(b); |
| | 0 | 118 | | result.Add(cert); |
| | 0 | 119 | | } |
| | 0 | 120 | | catch { |
| | | 121 | | //pass |
| | 0 | 122 | | } |
| | 0 | 123 | | } |
| | | 124 | | |
| | 0 | 125 | | value = result.ToArray(); |
| | 0 | 126 | | return true; |
| | 0 | 127 | | } |
| | | 128 | | |
| | 1 | 129 | | public bool TryGetSecurityIdentifier(out string securityIdentifier) { |
| | 1 | 130 | | securityIdentifier = string.Empty; |
| | 2 | 131 | | if (!CheckCache(LDAPProperties.ObjectSID)) { |
| | 1 | 132 | | return false; |
| | | 133 | | } |
| | | 134 | | |
| | 0 | 135 | | var raw = _entry.Properties[LDAPProperties.ObjectSID][0]; |
| | 0 | 136 | | try { |
| | 0 | 137 | | securityIdentifier = raw switch { |
| | 0 | 138 | | byte[] b => new SecurityIdentifier(b, 0).ToString(), |
| | 0 | 139 | | string st => new SecurityIdentifier(Encoding.ASCII.GetBytes(st), 0).ToString(), |
| | 0 | 140 | | _ => default |
| | 0 | 141 | | }; |
| | | 142 | | |
| | 0 | 143 | | return securityIdentifier != default; |
| | | 144 | | } |
| | 0 | 145 | | catch { |
| | 0 | 146 | | return false; |
| | | 147 | | } |
| | 1 | 148 | | } |
| | | 149 | | |
| | 0 | 150 | | public bool TryGetGuid(out string guid) { |
| | 0 | 151 | | guid = string.Empty; |
| | 0 | 152 | | if (!TryGetByteProperty(LDAPProperties.ObjectGUID, out var raw)) { |
| | 0 | 153 | | return false; |
| | | 154 | | } |
| | | 155 | | |
| | 0 | 156 | | try { |
| | 0 | 157 | | guid = new Guid(raw).ToString().ToUpper(); |
| | 0 | 158 | | return true; |
| | 0 | 159 | | } catch { |
| | 0 | 160 | | return false; |
| | | 161 | | } |
| | 0 | 162 | | } |
| | | 163 | | |
| | 0 | 164 | | public string GetProperty(string propertyName) { |
| | 0 | 165 | | CheckCache(propertyName); |
| | 0 | 166 | | return _entry.Properties[propertyName].Value as string; |
| | 0 | 167 | | } |
| | | 168 | | |
| | 0 | 169 | | public byte[] GetByteProperty(string propertyName) { |
| | 0 | 170 | | CheckCache(propertyName); |
| | 0 | 171 | | return _entry.Properties[propertyName].Value as byte[]; |
| | 0 | 172 | | } |
| | | 173 | | |
| | 0 | 174 | | public int PropertyCount(string propertyName) { |
| | 0 | 175 | | if (!CheckCache(propertyName)) { |
| | 0 | 176 | | return 0; |
| | | 177 | | } |
| | | 178 | | |
| | 0 | 179 | | var prop = _entry.Properties[propertyName]; |
| | 0 | 180 | | return prop.Count; |
| | | 181 | | |
| | 0 | 182 | | } |
| | | 183 | | |
| | 0 | 184 | | public IEnumerable<string> PropertyNames() { |
| | 0 | 185 | | foreach (var property in _entry.Properties.PropertyNames) |
| | 0 | 186 | | yield return property.ToString().ToLower(); |
| | 0 | 187 | | } |
| | | 188 | | } |