activedirectory

package
v0.0.0-...-ee0ba66 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Nov 27, 2024 License: AGPL-3.0 Imports: 14 Imported by: 0

Documentation

Index

Constants

This section is empty.

Variables

View Source 
var (
	EdgeACLContainsDeny  = engine.NewEdge("ACLContainsDeny").RegisterProbabilityCalculator(FixedProbability(0)).Tag("Informative")
	EdgeResetPassword    = engine.NewEdge("ResetPassword").RegisterProbabilityCalculator(OnlyIfTargetAccountEnabled).Tag("Pivot")
	EdgeReadPasswordId   = engine.NewEdge("ReadPasswordId").SetDefault(false, false, false).RegisterProbabilityCalculator(FixedProbability(5))
	EdgeOwns             = engine.NewEdge("Owns").Tag("Pivot")
	EdgeGenericAll       = engine.NewEdge("GenericAll").Tag("Informative")
	EdgeWriteAll         = engine.NewEdge("WriteAll").Tag("Informative").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeWritePropertyAll = engine.NewEdge("WritePropertyAll").Tag("Informative").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeWriteExtendedAll = engine.NewEdge("WriteExtendedAll").Tag("Informative").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeTakeOwnership    = engine.NewEdge("TakeOwnership").Tag("Pivot")
	EdgeWriteDACL        = engine.NewEdge("WriteDACL").Tag("Pivot")
	EdgeWriteSPN         = engine.NewEdge("WriteSPN").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {
		if target.HasTag("account_active") {
			return 50
		}
		return 0
	}).Tag("Pivot")
	EdgeWriteValidatedSPN = engine.NewEdge("WriteValidatedSPN").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {
		if target.HasTag("account_active") {
			return 50
		}
		return 0
	}).Tag("Pivot")
	EdgeWriteAllowedToAct        = engine.NewEdge("WriteAllowedToAct").Tag("Pivot")
	EdgeWriteAllowedToDelegateTo = engine.NewEdge("WriteAllowedToDelegTo").Tag("Pivot")
	EdgeAddMember                = engine.NewEdge("AddMember").Tag("Pivot")
	EdgeAddMemberGroupAttr       = engine.NewEdge("AddMemberGroupAttr").Tag("Pivot")
	EdgeAddSelfMember            = engine.NewEdge("AddSelfMember").Tag("Pivot")
	EdgeReadGMSAPassword         = engine.NewEdge("ReadGMSAPassword").Tag("Pivot")
	EdgeHasMSA                   = engine.NewEdge("HasMSA").Tag("Granted")
	EdgeWriteUserAccountControl  = engine.NewEdge("WriteUserAccountControl").Describe("Allows attacker to set ENABLE and set DONT_REQ_PREAUTH and then to do AS_REP Kerberoasting").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {

		return 50
	}).Tag("Pivot")

	EdgeWriteKeyCredentialLink = engine.NewEdge("WriteKeyCredentialLink").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {
		if target.HasTag("account_enabled") || edges.IsSet(EdgeWriteUserAccountControl) {
			return 100
		}
		return 0
	}).Tag("Pivot")
	EdgeWriteAttributeSecurityGUID           = engine.NewEdge("WriteAttrSecurityGUID").RegisterProbabilityCalculator(FixedProbability(0)) // Only if you patch the DC, so this will actually never work
	EdgeSIDHistoryEquality                   = engine.NewEdge("SIDHistoryEquality").Tag("Pivot")
	EdgeAllExtendedRights                    = engine.NewEdge("AllExtendedRights").Tag("Informative").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeDSReplicationSyncronize              = engine.NewEdge("DSReplSync").Tag("Granted").SetDefault(false, false, false).Tag("Granted").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeDSReplicationGetChanges              = engine.NewEdge("DSReplGetChngs").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeDSReplicationGetChangesAll           = engine.NewEdge("DSReplGetChngsAll").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeDSReplicationGetChangesInFilteredSet = engine.NewEdge("DSReplGetChngsInFiltSet").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(FixedProbability(0))
	EdgeCall                                 = engine.NewEdge("Call").Describe("Call a service point")
	EdgeControls                             = engine.NewEdge("Controls").Describe("Node controls a service point")
	EdgeReadLAPSPassword                     = engine.NewEdge("ReadLAPSPassword").Tag("Pivot").Tag("Granted")
	EdgeMemberOfGroup                        = engine.NewEdge("MemberOfGroup").Tag("Granted")
	EdgeMemberOfGroupIndirect                = engine.NewEdge("MemberOfGroupIndirect").SetDefault(false, false, false).Tag("Granted")
	EdgeHasSPN                               = engine.NewEdge("HasSPN").Describe("Kerberoastable by requesting Kerberos service ticket against SPN and then bruteforcing the ticket").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {
		if target.HasTag("account_enabled") || edges.IsSet(EdgeWriteUserAccountControl) {
			return 50
		}

		return 0
	}).Tag("Pivot")
	EdgeDontReqPreauth = engine.NewEdge("DontReqPreauth").Describe("Kerberoastable by AS-REP by requesting a TGT and then bruteforcing the ticket").RegisterProbabilityCalculator(func(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability {
		if target.HasTag("account_enabled") || edges.IsSet(EdgeWriteUserAccountControl) {
			return 50
		}
		return 0
	}).Tag("Pivot")
	EdgeOverwritesACL              = engine.NewEdge("OverwritesACL")
	EdgeAffectedByGPO              = engine.NewEdge("AffectedByGPO").Tag("Granted").Tag("Pivot")
	PartOfGPO                      = engine.NewEdge("PartOfGPO").Tag("Granted").Tag("Pivot")
	EdgeLocalAdminRights           = engine.NewEdge("AdminRights").Tag("Granted").Tag("Pivot")
	EdgeLocalRDPRights             = engine.NewEdge("RDPRights").RegisterProbabilityCalculator(FixedProbability(30)).Tag("Pivot")
	EdgeLocalDCOMRights            = engine.NewEdge("DCOMRights").RegisterProbabilityCalculator(FixedProbability(30)).Tag("Pivot")
	EdgeScheduledTaskOnUNCPath     = engine.NewEdge("SchedTaskOnUNCPath").Tag("Pivot")
	EdgeMachineScript              = engine.NewEdge("MachineScript").Tag("Pivot")
	EdgeWriteAltSecurityIdentities = engine.NewEdge("WriteAltSecIdent").Tag("Pivot").RegisterProbabilityCalculator(OnlyIfTargetAccountEnabled)
	EdgeWriteProfilePath           = engine.NewEdge("WriteProfilePath").Tag("Pivot")
	EdgeWriteScriptPath            = engine.NewEdge("WriteScriptPath").Tag("Pivot")
	EdgeCertificateEnroll          = engine.NewEdge("CertificateEnroll").Tag("Granted")
	EdgeCertificateAutoEnroll      = engine.NewEdge("CertificateAutoEnroll").Tag("Granted")
	EdgeVoodooBit                  = engine.NewEdge("VoodooBit").SetDefault(false, false, false).Tag("Internal").Hidden()
)
View Source 
var (
	EdgeForeignIdentity = engine.NewEdge("ForeignIdentity")

	DistinguishedName                       = engine.NewAttribute("distinguishedName").Tag("AD").Unique().Single()
	ObjectClass                             = engine.NewAttribute("objectClass").Tag("AD")
	ObjectCategory                          = engine.NewAttribute("objectCategory").Tag("AD").Single()
	Type                                    = engine.NewAttribute("type").Single()
	StructuralObjectClass                   = engine.NewAttribute("structuralObjectClass").Tag("AD")
	NTSecurityDescriptor                    = engine.NewAttribute("nTSecurityDescriptor").Tag("AD").Single().Type(engine.AttributeTypeSecurityDescriptor)
	SAMAccountType                          = engine.NewAttribute("sAMAccountType").Tag("AD").Single()
	GroupType                               = engine.NewAttribute("groupType").Tag("AD").Single()
	MemberOf                                = engine.NewAttribute("memberOf").Tag("AD")
	Member                                  = engine.NewAttribute("member").Tag("AD")
	BadPasswordTime                         = engine.NewAttribute("badPasswordTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
	MsPKIRoamingTimeStamp                   = engine.NewAttribute("msPKIRoamingTimeStamp").Tag("AD").Type(engine.AttributeTypeTime100NS)
	CreationTime                            = engine.NewAttribute("creationTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
	AccountExpires                          = engine.NewAttribute("accountExpires").Tag("AD").Type(engine.AttributeTypeTime100NS)
	RepsTo                                  = engine.NewAttribute("repsTo").Tag("AD")
	InstanceType                            = engine.NewAttribute("instanceType").Tag("AD")
	ModifiedCount                           = engine.NewAttribute("modifiedCount").Tag("AD")
	MinPwdAge                               = engine.NewAttribute("minPwdAge").Tag("AD")
	MinPwdLength                            = engine.NewAttribute("minPwdLength").Tag("AD").Type(engine.AttributeTypeInt)
	PwdProperties                           = engine.NewAttribute("pwdProperties").Tag("AD")
	LockOutDuration                         = engine.NewAttribute("lockoutDuration").Tag("AD")
	PwdHistoryLength                        = engine.NewAttribute("pwdHistoryLength").Tag("AD").Type(engine.AttributeTypeInt)
	IsCriticalSystemObject                  = engine.NewAttribute("isCriticalSystemObject").Tag("AD")
	FSMORoleOwner                           = engine.NewAttribute("fSMORoleOwner").Tag("AD")
	NTMixedDomain                           = engine.NewAttribute("nTMixedDomain").Tag("AD")
	SystemFlags                             = engine.NewAttribute("systemFlags").Tag("AD")
	PrimaryGroupID                          = engine.NewAttribute("primaryGroupID").Tag("AD")
	LogonCount                              = engine.NewAttribute("logonCount").Tag("AD")
	UserAccountControl                      = engine.NewAttribute("userAccountControl").Tag("AD")
	LocalPolicyFlags                        = engine.NewAttribute("localPolicyFlags").Tag("AD")
	CodePage                                = engine.NewAttribute("codePage").Tag("AD")
	CountryCode                             = engine.NewAttribute("countryCode").Tag("AD")
	OperatingSystem                         = engine.NewAttribute("operatingSystem").Tag("AD")
	OperatingSystemHotfix                   = engine.NewAttribute("operatingSystemHotfix").Tag("AD")
	OperatingSystemVersion                  = engine.NewAttribute("operatingSystemVersion").Tag("AD")
	OperatingSystemServicePack              = engine.NewAttribute("operatingSystemServicePack").Tag("AD")
	AdminCount                              = engine.NewAttribute("adminCount").Tag("AD")
	LogonHours                              = engine.NewAttribute("logonHours").Tag("AD")
	BadPwdCount                             = engine.NewAttribute("badPwdCount").Tag("AD").Type(engine.AttributeTypeInt)
	GPCFileSysPath                          = engine.NewAttribute("gPCFileSysPath").Tag("AD").Merge()
	SchemaIDGUID                            = engine.NewAttribute("schemaIDGUID").Tag("AD").Type(engine.AttributeTypeGUID)
	PossSuperiors                           = engine.NewAttribute("possSuperiors")
	SystemPossSuperiors                     = engine.NewAttribute("systemPossSuperiors")
	SubClassOf                              = engine.NewAttribute("subClassOf").Tag("AD")
	SystemMayContain                        = engine.NewAttribute("systemMayContain")
	SystemMustContain                       = engine.NewAttribute("systemMustContain")
	ServicePrincipalName                    = engine.NewAttribute("servicePrincipalName").Tag("AD")
	Name                                    = engine.NewAttribute("name").Tag("AD")
	DisplayName                             = engine.NewAttribute("displayName").Tag("AD")
	LDAPDisplayName                         = engine.NewAttribute("lDAPDisplayName").Tag("AD") // Attribute-Schema
	Description                             = engine.NewAttribute("description").Tag("AD")
	SAMAccountName                          = engine.NewAttribute("sAMAccountName").Tag("AD")
	ObjectSid                               = engine.NewAttribute("objectSid").Tag("AD").Merge().Single().Type(engine.AttributeTypeSID)
	CreatorSID                              = engine.NewAttribute("mS-DS-CreatorSID").Tag("AD").Single().Type(engine.AttributeTypeSID)
	MSDSAllowedToActOnBehalfOfOtherIdentity = engine.NewAttribute("msDS-AllowedToActOnBehalfOfOtherIdentity").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDSAllowedToDelegateTo                 = engine.NewAttribute("msDS-AllowedToDelegateTo").Tag("AD")
	FRSRootSecurity                         = engine.NewAttribute("fRSRootSecurity").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDFSLinkSecurityDescriptorv2           = engine.NewAttribute("msDFS-LinkSecurityDescriptorv2").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	PKIEnrollmentAccess                     = engine.NewAttribute("pKIEnrollmentAccess").Tag("AD")
	ObjectGUID                              = engine.NewAttribute("objectGUID").Tag("AD").Merge()
	PwdLastSet                              = engine.NewAttribute("pwdLastSet").Tag("AD").Type(engine.AttributeTypeTime)
	WhenCreated                             = engine.NewAttribute("whenCreated").Type(engine.AttributeTypeTime)
	WhenChanged                             = engine.NewAttribute("whenChanged").Type(engine.AttributeTypeTime)
	DsCorePropagationData                   = engine.NewAttribute("dsCorePropagationData").Type(engine.AttributeTypeTime)
	MsExchLastUpdateTime                    = engine.NewAttribute("msExchLastUpdateTime").Type(engine.AttributeTypeTime)
	GWARTLastModified                       = engine.NewAttribute("gWARTLastModified").Type(engine.AttributeTypeTime)
	SpaceLastComputed                       = engine.NewAttribute("spaceLastComputed").Type(engine.AttributeTypeTime)
	MsExchPolicyLastAppliedTime             = engine.NewAttribute("msExchPolicyLastAppliedTime").Type(engine.AttributeTypeTime)
	MsExchWhenMailboxCreated                = engine.NewAttribute("msExchWhenMailboxCreated").Type(engine.AttributeTypeTime)
	SIDHistory                              = engine.NewAttribute("sIDHistory").Tag("AD").Type(engine.AttributeTypeSID)
	LastLogon                               = engine.NewAttribute("lastLogon").Type(engine.AttributeTypeTime)
	LastLogonTimestamp                      = engine.NewAttribute("lastLogonTimestamp").Type(engine.AttributeTypeTime)
	MSDSGroupMSAMembership                  = engine.NewAttribute("msDS-GroupMSAMembership").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDSHostServiceAccount                  = engine.NewAttribute("msDS-HostServiceAccount").Tag("AD")
	MSDSHostServiceAccountBL                = engine.NewAttribute("msDS-HostServiceAccountBL").Tag("AD")

	MSmcsAdmPwdExpirationTime    = engine.NewAttribute("ms-mcs-AdmPwdExpirationTime").Tag("AD").Type(engine.AttributeTypeTime)    // LAPS V1 password timeout
	MSLAPSPasswordExpirationTime = engine.NewAttribute("ms-LAPS-PasswordExpirationTime").Tag("AD").Type(engine.AttributeTypeTime) // LAPS V2 password timeout

	SecurityIdentifier       = engine.NewAttribute("securityIdentifier").Type(engine.AttributeTypeSID)
	TrustDirection           = engine.NewAttribute("trustDirection").Type(engine.AttributeTypeInt)
	TrustAttributes          = engine.NewAttribute("trustAttributes")
	TrustPartner             = engine.NewAttribute("trustPartner")
	TrustType                = engine.NewAttribute("trustType")
	DsHeuristics             = engine.NewAttribute("dsHeuristics").Tag("AD")
	AttributeSecurityGUID    = engine.NewAttribute("attributeSecurityGUID").Tag("AD")
	MSDSConsistencyGUID      = engine.NewAttribute("mS-DS-ConsistencyGuid")
	RightsGUID               = engine.NewAttribute("rightsGUID").Tag("AD").Type(engine.AttributeTypeGUID)
	GPLink                   = engine.NewAttribute("gPLink").Tag("AD")
	GPOptions                = engine.NewAttribute("gPOptions").Tag("AD")
	ScriptPath               = engine.NewAttribute("scriptPath").Tag("AD").Single()
	MSPKICertificateNameFlag = engine.NewAttribute("msPKI-Certificate-Name-Flag").Tag("AD").Type(engine.AttributeTypeInt)
	PKIExtendedUsage         = engine.NewAttribute("pKIExtendedKeyUsage").Tag("AD")
	PKIExpirationPeriod      = engine.NewAttribute("pKIExpirationPeriod").Tag("AD")
	PKIOverlapPeriod         = engine.NewAttribute("pKIOverlapPeriod").Tag("AD")
	MsDSBehaviourVersion     = engine.NewAttribute("msDS-Behavior-Version").Type(engine.AttributeTypeInt)
	DNSHostName              = engine.NewAttribute("dnsHostName").Tag("AD")
)

Functions

func EncodeAttributeData 

func EncodeAttributeData(attribute engine.Attribute, values []string) engine.AttributeValues

func FixedProbability 

func FixedProbability(probability int) engine.ProbabilityCalculatorFunction

func OnlyIfTargetAccountEnabled 

func OnlyIfTargetAccountEnabled(source, target *engine.Object, edges *engine.EdgeBitmap) engine.Probability

Types

type GPOdump 

type GPOdump struct {
	basedata.Common
	GPOinfo
}

type GPOfileinfo 

type GPOfileinfo struct {
	Timestamp    time.Time           `json:",omitempty"`
	RelativePath string              `json:",omitempty"`
	OwnerSID     windowssecurity.SID `json:",omitempty"`
	DACL         []byte              `json:",omitempty"`
	Contents     []byte              `json:",omitempty"`
	Size         int64               `json:",omitempty"`
	IsDir        bool                `json:",omitempty"`
}

type GPOinfo 

type GPOinfo struct {
	DomainDN      string        `json:",omitempty"`
	DomainNetbios string        `json:",omitempty"`
	Path          string        `json:",omitempty"`
	Files         []GPOfileinfo `json:",omitempty"`
	GUID          uuid.UUID     `json:",omitempty"`
}

type RawObject 

type RawObject struct {
	Attributes        map[string][]string
	DistinguishedName string
}

func (*RawObject) DecodeMsg 

func (z *RawObject) DecodeMsg(dc *msgp.Reader) (err error)

DecodeMsg implements msgp.Decodable

func (*RawObject) EncodeMsg 

func (z *RawObject) EncodeMsg(en *msgp.Writer) (err error)

EncodeMsg implements msgp.Encodable

func (*RawObject) IngestLDAP 

func (item *RawObject) IngestLDAP(source *ldap.Entry) error

func (*RawObject) Init 

func (r *RawObject) Init()

func (*RawObject) MarshalMsg 

func (z *RawObject) MarshalMsg(b []byte) (o []byte, err error)

MarshalMsg implements msgp.Marshaler

func (*RawObject) Msgsize 

func (z *RawObject) Msgsize() (s int)

Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message

func (*RawObject) ToObject 

func (r *RawObject) ToObject(onlyKnownAttributes bool) *engine.Object

func (*RawObject) UnmarshalMsg 

func (z *RawObject) UnmarshalMsg(bts []byte) (o []byte, err error)

UnmarshalMsg implements msgp.Unmarshaler

Source Files

View all Source files

Directories

Path Synopsis

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.