| | 1 | | using System; |
| | 2 | | using System.Collections.Generic; |
| | 3 | | using System.DirectoryServices.Protocols; |
| | 4 | | using System.Runtime.Serialization; |
| | 5 | | using System.Security.Cryptography.X509Certificates; |
| | 6 | | using System.Security.Principal; |
| | 7 | |
|
| | 8 | | namespace SharpHoundCommonLib; |
| | 9 | | [DataContract] |
| | 10 | | public class SearchResultEntryWrapper : IDirectoryObject { |
| | 11 | | [DataMember] |
| | 12 | | private readonly SearchResultEntry _entry; |
| | 13 | |
|
| 0 | 14 | | public SearchResultEntryWrapper(SearchResultEntry entry) { |
| 0 | 15 | | _entry = entry; |
| 0 | 16 | | } |
| | 17 | |
|
| 0 | 18 | | public bool TryGetDistinguishedName(out string value) { |
| 0 | 19 | | return TryGetProperty(LDAPProperties.DistinguishedName, out value) && !string.IsNullOrWhiteSpace(value); |
| 0 | 20 | | } |
| | 21 | |
|
| 0 | 22 | | public bool TryGetProperty(string propertyName, out string value) { |
| 0 | 23 | | value = string.Empty; |
| 0 | 24 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 25 | | return false; |
| | 26 | |
|
| 0 | 27 | | var collection = _entry.Attributes[propertyName]; |
| | 28 | | //Use GetValues to auto-convert to the proper type |
| 0 | 29 | | var lookups = collection.GetValues(typeof(string)); |
| 0 | 30 | | if (lookups.Length == 0) |
| 0 | 31 | | return false; |
| | 32 | |
|
| 0 | 33 | | if (lookups[0] is not string prop || prop.Length == 0) |
| 0 | 34 | | return false; |
| | 35 | |
|
| 0 | 36 | | value = prop; |
| 0 | 37 | | return true; |
| 0 | 38 | | } |
| | 39 | |
|
| 0 | 40 | | public bool TryGetByteProperty(string propertyName, out byte[] value) { |
| 0 | 41 | | value = Array.Empty<byte>(); |
| 0 | 42 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 43 | | return false; |
| | 44 | |
|
| 0 | 45 | | var collection = _entry.Attributes[propertyName]; |
| 0 | 46 | | var lookups = collection.GetValues(typeof(byte[])); |
| | 47 | |
|
| 0 | 48 | | if (lookups.Length == 0) |
| 0 | 49 | | return false; |
| | 50 | |
|
| 0 | 51 | | if (lookups[0] is not byte[] bytes || bytes.Length == 0) |
| 0 | 52 | | return false; |
| | 53 | |
|
| 0 | 54 | | value = bytes; |
| 0 | 55 | | return true; |
| 0 | 56 | | } |
| | 57 | |
|
| 0 | 58 | | public bool TryGetArrayProperty(string propertyName, out string[] value) { |
| 0 | 59 | | value = Array.Empty<string>(); |
| 0 | 60 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 61 | | return false; |
| | 62 | |
|
| 0 | 63 | | var values = _entry.Attributes[propertyName]; |
| 0 | 64 | | var strings = values.GetValues(typeof(string)); |
| | 65 | |
|
| 0 | 66 | | if (strings.Length == 0) return true; |
| 0 | 67 | | if (strings is not string[] result) return false; |
| | 68 | |
|
| 0 | 69 | | value = result; |
| 0 | 70 | | return true; |
| 0 | 71 | | } |
| | 72 | |
|
| 0 | 73 | | public bool TryGetByteArrayProperty(string propertyName, out byte[][] value) { |
| 0 | 74 | | value = Array.Empty<byte[]>(); |
| 0 | 75 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 76 | | return false; |
| | 77 | |
|
| 0 | 78 | | var values = _entry.Attributes[propertyName]; |
| 0 | 79 | | var bytes = values.GetValues(typeof(byte[])); |
| | 80 | |
|
| 0 | 81 | | if (bytes is not byte[][] result) return false; |
| 0 | 82 | | value = result; |
| 0 | 83 | | return true; |
| 0 | 84 | | } |
| | 85 | |
|
| 0 | 86 | | public bool TryGetLongProperty(string propertyName, out long value) { |
| 0 | 87 | | if (!TryGetProperty(propertyName, out var raw)) { |
| 0 | 88 | | value = 0; |
| 0 | 89 | | return false; |
| | 90 | | } |
| | 91 | |
|
| 0 | 92 | | return long.TryParse(raw, out value); |
| 0 | 93 | | } |
| | 94 | |
|
| 0 | 95 | | public bool TryGetCertificateArrayProperty(string propertyName, out X509Certificate2[] value) { |
| 0 | 96 | | value = Array.Empty<X509Certificate2>(); |
| | 97 | |
|
| 0 | 98 | | if (!TryGetByteArrayProperty(propertyName, out var bytes)) { |
| 0 | 99 | | return false; |
| | 100 | | } |
| | 101 | |
|
| 0 | 102 | | if (bytes.Length == 0) { |
| 0 | 103 | | return true; |
| | 104 | | } |
| | 105 | |
|
| 0 | 106 | | var result = new List<X509Certificate2>(); |
| | 107 | |
|
| 0 | 108 | | foreach (var b in bytes) { |
| 0 | 109 | | try { |
| 0 | 110 | | var cert = new X509Certificate2(b); |
| 0 | 111 | | result.Add(cert); |
| 0 | 112 | | } catch { |
| | 113 | | //pass |
| 0 | 114 | | } |
| 0 | 115 | | } |
| | 116 | |
|
| 0 | 117 | | value = result.ToArray(); |
| 0 | 118 | | return true; |
| 0 | 119 | | } |
| | 120 | |
|
| 0 | 121 | | public bool TryGetSecurityIdentifier(out string securityIdentifier) { |
| 0 | 122 | | securityIdentifier = string.Empty; |
| 0 | 123 | | if (!_entry.Attributes.Contains(LDAPProperties.ObjectSID)) return false; |
| | 124 | |
|
| | 125 | | object[] s; |
| 0 | 126 | | try { |
| 0 | 127 | | s = _entry.Attributes[LDAPProperties.ObjectSID].GetValues(typeof(byte[])); |
| 0 | 128 | | } catch (NotSupportedException) { |
| 0 | 129 | | return false; |
| | 130 | | } |
| | 131 | |
|
| 0 | 132 | | if (s.Length == 0) |
| 0 | 133 | | return false; |
| | 134 | |
|
| 0 | 135 | | if (s[0] is not byte[] sidBytes || sidBytes.Length == 0) |
| 0 | 136 | | return false; |
| | 137 | |
|
| 0 | 138 | | try { |
| 0 | 139 | | var sid = new SecurityIdentifier(sidBytes, 0); |
| 0 | 140 | | securityIdentifier = sid.Value.ToUpper(); |
| 0 | 141 | | return true; |
| 0 | 142 | | } catch { |
| 0 | 143 | | return false; |
| | 144 | | } |
| 0 | 145 | | } |
| | 146 | |
|
| 0 | 147 | | public bool TryGetGuid(out string guid) { |
| 0 | 148 | | guid = string.Empty; |
| 0 | 149 | | if (!TryGetByteProperty(LDAPProperties.ObjectGUID, out var raw)) { |
| 0 | 150 | | return false; |
| | 151 | | } |
| | 152 | |
|
| 0 | 153 | | try { |
| 0 | 154 | | guid = new Guid(raw).ToString().ToUpper(); |
| 0 | 155 | | return true; |
| 0 | 156 | | } catch { |
| 0 | 157 | | return false; |
| | 158 | | } |
| 0 | 159 | | } |
| | 160 | |
|
| 0 | 161 | | public string GetProperty(string propertyName) { |
| 0 | 162 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 163 | | return null; |
| | 164 | |
|
| 0 | 165 | | var collection = _entry.Attributes[propertyName]; |
| | 166 | | //Use GetValues to auto-convert to the proper type |
| 0 | 167 | | var lookups = collection.GetValues(typeof(string)); |
| 0 | 168 | | if (lookups.Length == 0) |
| 0 | 169 | | return null; |
| | 170 | |
|
| 0 | 171 | | if (lookups[0] is not string prop || prop.Length == 0) |
| 0 | 172 | | return null; |
| | 173 | |
|
| 0 | 174 | | return prop; |
| 0 | 175 | | } |
| | 176 | |
|
| 0 | 177 | | public byte[] GetByteProperty(string propertyName) { |
| 0 | 178 | | if (!_entry.Attributes.Contains(propertyName)) |
| 0 | 179 | | return null; |
| | 180 | |
|
| 0 | 181 | | var collection = _entry.Attributes[propertyName]; |
| 0 | 182 | | var lookups = collection.GetValues(typeof(byte[])); |
| | 183 | |
|
| 0 | 184 | | if (lookups.Length == 0) |
| 0 | 185 | | return Array.Empty<byte>(); |
| | 186 | |
|
| 0 | 187 | | if (lookups[0] is not byte[] bytes || bytes.Length == 0) |
| 0 | 188 | | return Array.Empty<byte>(); |
| | 189 | |
|
| 0 | 190 | | return bytes; |
| 0 | 191 | | } |
| | 192 | |
|
| 0 | 193 | | public int PropertyCount(string propertyName) { |
| 0 | 194 | | if (!_entry.Attributes.Contains(propertyName)) return 0; |
| 0 | 195 | | var prop = _entry.Attributes[propertyName]; |
| 0 | 196 | | return prop.Count; |
| 0 | 197 | | } |
| | 198 | |
|
| 0 | 199 | | public IEnumerable<string> PropertyNames() { |
| 0 | 200 | | if (_entry.Attributes.AttributeNames != null) |
| 0 | 201 | | foreach (var property in _entry.Attributes.AttributeNames) |
| 0 | 202 | | yield return property.ToString().ToLower(); |
| 0 | 203 | | } |
| | 204 | | } |