activedirectory

package

v0.0.0-...-f1573f2 Latest Latest Go to latest Published: Mar 20, 2024 License: AGPL-3.0 Imports: 14 Imported by: 0

Details

Valid go.mod file

The Go module system was introduced in Go 1.11 and is the official dependency management solution for Go.
Redistributable license

Redistributable licenses place minimal restrictions on how software can be used, modified, and redistributed.
Tagged version

Modules with tagged versions give importers more predictable builds.
Stable version

When a project reaches major version v1 it is considered stable.
Learn more about best practices

Repository

github.com/lkarlslund/adalanche

Links

Open Source Insights

Documentation ¶

Index ¶

Variables
func EncodeAttributeData(attribute engine.Attribute, values []string) engine.AttributeValues
func NotAChance(source, target *engine.Object) engine.Probability
type GPOdump
type GPOfileinfo
type GPOinfo
type RawObject

Constants ¶

This section is empty.

Variables ¶

View Source

var (
	EdgeACLContainsDeny = engine.NewEdge("ACLContainsDeny").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability { return 0 }).Tag("Informative")
	EdgeResetPassword   = engine.NewEdge("ResetPassword").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if target.HasTag("account_active") {
			return 100
		}
		return 0
	}).Tag("Pivot")
	EdgeReadPasswordId = engine.NewEdge("ReadPasswordId").SetDefault(false, false, false).RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		return 5
	})
	EdgeOwns             = engine.NewEdge("Owns").Tag("Pivot")
	EdgeGenericAll       = engine.NewEdge("GenericAll").Tag("Informative")
	EdgeWriteAll         = engine.NewEdge("WriteAll").Tag("Informative").RegisterProbabilityCalculator(NotAChance)
	EdgeWritePropertyAll = engine.NewEdge("WritePropertyAll").Tag("Informative").RegisterProbabilityCalculator(NotAChance)
	EdgeWriteExtendedAll = engine.NewEdge("WriteExtendedAll").Tag("Informative").RegisterProbabilityCalculator(NotAChance)
	EdgeTakeOwnership    = engine.NewEdge("TakeOwnership").Tag("Pivot")
	EdgeWriteDACL        = engine.NewEdge("WriteDACL").Tag("Pivot")
	EdgeWriteSPN         = engine.NewEdge("WriteSPN").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if target.HasTag("account_active") {
			return 50
		}
		return 0
	}).Tag("Pivot")
	EdgeWriteValidatedSPN = engine.NewEdge("WriteValidatedSPN").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if target.HasTag("account_active") {
			return 50
		}
		return 0
	}).Tag("Pivot")
	EdgeWriteAllowedToAct        = engine.NewEdge("WriteAllowedToAct").Tag("Pivot")
	EdgeWriteAllowedToDelegateTo = engine.NewEdge("WriteAllowedToDelegTo").Tag("Pivot")
	EdgeAddMember                = engine.NewEdge("AddMember").Tag("Pivot")
	EdgeAddMemberGroupAttr       = engine.NewEdge("AddMemberGroupAttr").Tag("Pivot")
	EdgeAddSelfMember            = engine.NewEdge("AddSelfMember").Tag("Pivot")
	EdgeReadGMSAPassword         = engine.NewEdge("ReadGMSAPassword").Tag("Pivot")
	EdgeHasMSA                   = engine.NewEdge("HasMSA").Tag("Granted")
	EdgeWriteUserAccountControl  = engine.NewEdge("WriteUserAccountControl").Describe("Allows attacker to set ENABLE and set DONT_REQ_PREAUTH and then to do AS_REP Kerberoasting").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {

		return 50
	}).Tag("Pivot")

	EdgeWriteKeyCredentialLink = engine.NewEdge("WriteKeyCredentialLink").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if uac, ok := target.AttrInt(UserAccountControl); ok && uac&0x0002 != 0 {
			// Account is disabled
			var canenable bool
			source.Edges(engine.Out).Range(func(key *engine.Object, value engine.EdgeBitmap) bool {
				if key == target {
					if value.IsSet(EdgeWriteUserAccountControl) {
						canenable = true
						return false
					}
				}
				return true
			})
			if !canenable {
				return 0
			}
		}
		return 100
	}).Tag("Pivot")
	EdgeWriteAttributeSecurityGUID           = engine.NewEdge("WriteAttrSecurityGUID").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability { return 0 }) // Only if you patch the DC, so this will actually never work
	EdgeSIDHistoryEquality                   = engine.NewEdge("SIDHistoryEquality").Tag("Pivot")
	EdgeAllExtendedRights                    = engine.NewEdge("AllExtendedRights").Tag("Informative").RegisterProbabilityCalculator(NotAChance)
	EdgeDSReplicationSyncronize              = engine.NewEdge("DSReplSync").Tag("Granted").SetDefault(false, false, false).Tag("Granted").RegisterProbabilityCalculator(NotAChance)
	EdgeDSReplicationGetChanges              = engine.NewEdge("DSReplGetChngs").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(NotAChance)
	EdgeDSReplicationGetChangesAll           = engine.NewEdge("DSReplGetChngsAll").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(NotAChance)
	EdgeDSReplicationGetChangesInFilteredSet = engine.NewEdge("DSReplGetChngsInFiltSet").SetDefault(false, false, false).Tag("Granted").Tag("Granted").RegisterProbabilityCalculator(NotAChance)
	EdgeCall                                 = engine.NewEdge("Call").Describe("Call a service point")
	EdgeControls                             = engine.NewEdge("Controls").Describe("Node controls a service point")
	EdgeReadLAPSPassword                     = engine.NewEdge("ReadLAPSPassword").Tag("Pivot").Tag("Granted")
	EdgeMemberOfGroup                        = engine.NewEdge("MemberOfGroup").Tag("Granted")
	EdgeMemberOfGroupIndirect                = engine.NewEdge("MemberOfGroupIndirect").SetDefault(false, false, false).Tag("Granted")
	EdgeHasSPN                               = engine.NewEdge("HasSPN").Describe("Kerberoastable by requesting Kerberos service ticket against SPN and then bruteforcing the ticket").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if target.HasTag("account_active") {
			return 50
		}

		return 0
	}).Tag("Pivot")
	EdgeDontReqPreauth = engine.NewEdge("DontReqPreauth").Describe("Kerberoastable by AS-REP by requesting a TGT and then bruteforcing the ticket").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability {
		if uac, ok := target.AttrInt(UserAccountControl); ok && uac&0x0002 != 0 {

			return 0
		}
		return 50
	}).Tag("Pivot")
	EdgeOverwritesACL              = engine.NewEdge("OverwritesACL")
	EdgeAffectedByGPO              = engine.NewEdge("AffectedByGPO").Tag("Granted").Tag("Pivot")
	PartOfGPO                      = engine.NewEdge("PartOfGPO").Tag("Granted").Tag("Pivot")
	EdgeLocalAdminRights           = engine.NewEdge("AdminRights").Tag("Granted").Tag("Pivot")
	EdgeLocalRDPRights             = engine.NewEdge("RDPRights").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability { return 30 }).Tag("Pivot")
	EdgeLocalDCOMRights            = engine.NewEdge("DCOMRights").RegisterProbabilityCalculator(func(source, target *engine.Object) engine.Probability { return 50 }).Tag("Pivot")
	EdgeScheduledTaskOnUNCPath     = engine.NewEdge("SchedTaskOnUNCPath").Tag("Pivot")
	EdgeMachineScript              = engine.NewEdge("MachineScript").Tag("Pivot")
	EdgeWriteAltSecurityIdentities = engine.NewEdge("WriteAltSecIdent").Tag("Pivot")
	EdgeWriteProfilePath           = engine.NewEdge("WriteProfilePath").Tag("Pivot")
	EdgeWriteScriptPath            = engine.NewEdge("WriteScriptPath").Tag("Pivot")
	EdgeCertificateEnroll          = engine.NewEdge("CertificateEnroll").Tag("Granted")
	EdgeCertificateAutoEnroll      = engine.NewEdge("CertificateAutoEnroll").Tag("Granted")
	EdgeVoodooBit                  = engine.NewEdge("VoodooBit").SetDefault(false, false, false).Tag("Internal").Hidden()
)

View Source

var (
	EdgeForeignIdentity = engine.NewEdge("ForeignIdentity")

	DistinguishedName                       = engine.NewAttribute("distinguishedName").Tag("AD").Unique().Single()
	ObjectClass                             = engine.NewAttribute("objectClass").Tag("AD")
	ObjectCategory                          = engine.NewAttribute("objectCategory").Tag("AD").Single()
	Type                                    = engine.NewAttribute("type").Single()
	StructuralObjectClass                   = engine.NewAttribute("structuralObjectClass").Tag("AD")
	NTSecurityDescriptor                    = engine.NewAttribute("nTSecurityDescriptor").Tag("AD").Single().Type(engine.AttributeTypeSecurityDescriptor)
	SAMAccountType                          = engine.NewAttribute("sAMAccountType").Tag("AD").Single()
	GroupType                               = engine.NewAttribute("groupType").Tag("AD").Single()
	MemberOf                                = engine.NewAttribute("memberOf").Tag("AD")
	Member                                  = engine.NewAttribute("member").Tag("AD")
	BadPasswordTime                         = engine.NewAttribute("badPasswordTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
	MsPKIRoamingTimeStamp                   = engine.NewAttribute("msPKIRoamingTimeStamp").Tag("AD").Type(engine.AttributeTypeTime100NS)
	CreationTime                            = engine.NewAttribute("creationTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
	AccountExpires                          = engine.NewAttribute("accountExpires").Tag("AD").Type(engine.AttributeTypeTime100NS)
	RepsTo                                  = engine.NewAttribute("repsTo").Tag("AD")
	InstanceType                            = engine.NewAttribute("instanceType").Tag("AD")
	ModifiedCount                           = engine.NewAttribute("modifiedCount").Tag("AD")
	MinPwdAge                               = engine.NewAttribute("minPwdAge").Tag("AD")
	MinPwdLength                            = engine.NewAttribute("minPwdLength").Tag("AD").Type(engine.AttributeTypeInt)
	PwdProperties                           = engine.NewAttribute("pwdProperties").Tag("AD")
	LockOutDuration                         = engine.NewAttribute("lockoutDuration").Tag("AD")
	PwdHistoryLength                        = engine.NewAttribute("pwdHistoryLength").Tag("AD").Type(engine.AttributeTypeInt)
	IsCriticalSystemObject                  = engine.NewAttribute("isCriticalSystemObject").Tag("AD")
	FSMORoleOwner                           = engine.NewAttribute("fSMORoleOwner").Tag("AD")
	NTMixedDomain                           = engine.NewAttribute("nTMixedDomain").Tag("AD")
	SystemFlags                             = engine.NewAttribute("systemFlags").Tag("AD")
	PrimaryGroupID                          = engine.NewAttribute("primaryGroupID").Tag("AD")
	LogonCount                              = engine.NewAttribute("logonCount").Tag("AD")
	UserAccountControl                      = engine.NewAttribute("userAccountControl").Tag("AD")
	LocalPolicyFlags                        = engine.NewAttribute("localPolicyFlags").Tag("AD")
	CodePage                                = engine.NewAttribute("codePage").Tag("AD")
	CountryCode                             = engine.NewAttribute("countryCode").Tag("AD")
	OperatingSystem                         = engine.NewAttribute("operatingSystem").Tag("AD")
	OperatingSystemHotfix                   = engine.NewAttribute("operatingSystemHotfix").Tag("AD")
	OperatingSystemVersion                  = engine.NewAttribute("operatingSystemVersion").Tag("AD")
	OperatingSystemServicePack              = engine.NewAttribute("operatingSystemServicePack").Tag("AD")
	AdminCount                              = engine.NewAttribute("adminCount").Tag("AD")
	LogonHours                              = engine.NewAttribute("logonHours").Tag("AD")
	BadPwdCount                             = engine.NewAttribute("badPwdCount").Tag("AD").Type(engine.AttributeTypeInt)
	GPCFileSysPath                          = engine.NewAttribute("gPCFileSysPath").Tag("AD").Merge()
	SchemaIDGUID                            = engine.NewAttribute("schemaIDGUID").Tag("AD").Type(engine.AttributeTypeGUID)
	PossSuperiors                           = engine.NewAttribute("possSuperiors")
	SystemPossSuperiors                     = engine.NewAttribute("systemPossSuperiors")
	SubClassOf                              = engine.NewAttribute("subClassOf").Tag("AD")
	SystemMayContain                        = engine.NewAttribute("systemMayContain")
	SystemMustContain                       = engine.NewAttribute("systemMustContain")
	ServicePrincipalName                    = engine.NewAttribute("servicePrincipalName").Tag("AD")
	Name                                    = engine.NewAttribute("name").Tag("AD")
	DisplayName                             = engine.NewAttribute("displayName").Tag("AD")
	LDAPDisplayName                         = engine.NewAttribute("lDAPDisplayName").Tag("AD") // Attribute-Schema
	Description                             = engine.NewAttribute("description").Tag("AD")
	SAMAccountName                          = engine.NewAttribute("sAMAccountName").Tag("AD")
	ObjectSid                               = engine.NewAttribute("objectSid").Tag("AD").Merge().Single().Type(engine.AttributeTypeSID)
	CreatorSID                              = engine.NewAttribute("mS-DS-CreatorSID").Tag("AD").Single().Type(engine.AttributeTypeSID)
	MSDSAllowedToActOnBehalfOfOtherIdentity = engine.NewAttribute("msDS-AllowedToActOnBehalfOfOtherIdentity").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDSAllowedToDelegateTo                 = engine.NewAttribute("msDS-AllowedToDelegateTo").Tag("AD")
	FRSRootSecurity                         = engine.NewAttribute("fRSRootSecurity").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDFSLinkSecurityDescriptorv2           = engine.NewAttribute("msDFS-LinkSecurityDescriptorv2").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	PKIEnrollmentAccess                     = engine.NewAttribute("pKIEnrollmentAccess").Tag("AD")
	ObjectGUID                              = engine.NewAttribute("objectGUID").Tag("AD").Merge()
	PwdLastSet                              = engine.NewAttribute("pwdLastSet").Tag("AD").Type(engine.AttributeTypeTime)
	WhenCreated                             = engine.NewAttribute("whenCreated").Type(engine.AttributeTypeTime)
	WhenChanged                             = engine.NewAttribute("whenChanged").Type(engine.AttributeTypeTime)
	DsCorePropagationData                   = engine.NewAttribute("dsCorePropagationData").Type(engine.AttributeTypeTime)
	MsExchLastUpdateTime                    = engine.NewAttribute("msExchLastUpdateTime").Type(engine.AttributeTypeTime)
	GWARTLastModified                       = engine.NewAttribute("gWARTLastModified").Type(engine.AttributeTypeTime)
	SpaceLastComputed                       = engine.NewAttribute("spaceLastComputed").Type(engine.AttributeTypeTime)
	MsExchPolicyLastAppliedTime             = engine.NewAttribute("msExchPolicyLastAppliedTime").Type(engine.AttributeTypeTime)
	MsExchWhenMailboxCreated                = engine.NewAttribute("msExchWhenMailboxCreated").Type(engine.AttributeTypeTime)
	SIDHistory                              = engine.NewAttribute("sIDHistory").Tag("AD").Type(engine.AttributeTypeSID)
	LastLogon                               = engine.NewAttribute("lastLogon").Type(engine.AttributeTypeTime)
	LastLogonTimestamp                      = engine.NewAttribute("lastLogonTimestamp").Type(engine.AttributeTypeTime)
	MSDSGroupMSAMembership                  = engine.NewAttribute("msDS-GroupMSAMembership").Tag("AD").Type(engine.AttributeTypeSecurityDescriptor)
	MSDSHostServiceAccount                  = engine.NewAttribute("msDS-HostServiceAccount").Tag("AD")
	MSDSHostServiceAccountBL                = engine.NewAttribute("msDS-HostServiceAccountBL").Tag("AD")
	MSmcsAdmPwdExpirationTime               = engine.NewAttribute("ms-mcs-AdmPwdExpirationTime").Tag("AD").Type(engine.AttributeTypeTime) // LAPS password timeout
	SecurityIdentifier                      = engine.NewAttribute("securityIdentifier").Type(engine.AttributeTypeSID)
	TrustDirection                          = engine.NewAttribute("trustDirection").Type(engine.AttributeTypeInt)
	TrustAttributes                         = engine.NewAttribute("trustAttributes")
	TrustPartner                            = engine.NewAttribute("trustPartner")
	TrustType                               = engine.NewAttribute("trustType")
	DsHeuristics                            = engine.NewAttribute("dsHeuristics").Tag("AD")
	AttributeSecurityGUID                   = engine.NewAttribute("attributeSecurityGUID").Tag("AD")
	MSDSConsistencyGUID                     = engine.NewAttribute("mS-DS-ConsistencyGuid")
	RightsGUID                              = engine.NewAttribute("rightsGUID").Tag("AD").Type(engine.AttributeTypeGUID)
	GPLink                                  = engine.NewAttribute("gPLink").Tag("AD")
	GPOptions                               = engine.NewAttribute("gPOptions").Tag("AD")
	ScriptPath                              = engine.NewAttribute("scriptPath").Tag("AD").Single()
	MSPKICertificateNameFlag                = engine.NewAttribute("msPKI-Certificate-Name-Flag").Tag("AD").Type(engine.AttributeTypeInt)
	PKIExtendedUsage                        = engine.NewAttribute("pKIExtendedKeyUsage").Tag("AD")
	PKIExpirationPeriod                     = engine.NewAttribute("pKIExpirationPeriod").Tag("AD")
	PKIOverlapPeriod                        = engine.NewAttribute("pKIOverlapPeriod").Tag("AD")
	MsDSBehaviourVersion                    = engine.NewAttribute("msDS-Behavior-Version").Type(engine.AttributeTypeInt)
	DNSHostName                             = engine.NewAttribute("dnsHostName").Tag("AD")
)

Functions ¶

func EncodeAttributeData ¶

func EncodeAttributeData(attribute engine.Attribute, values []string) engine.AttributeValues

func NotAChance ¶

func NotAChance(source, target *engine.Object) engine.Probability

Types ¶

type GPOdump ¶

type GPOdump struct {
	basedata.Common
	GPOinfo
}

type GPOfileinfo ¶

type GPOfileinfo struct {
	RelativePath string `json:",omitempty"`
	IsDir        bool   `json:",omitempty"`

	Size      int64               `json:",omitempty"`
	Timestamp time.Time           `json:",omitempty"`
	OwnerSID  windowssecurity.SID `json:",omitempty"`
	DACL      []byte              `json:",omitempty"`

	Contents []byte `json:",omitempty"`
}

type GPOinfo ¶

type GPOinfo struct {
	GUID          uuid.UUID     `json:",omitempty"`
	DomainDN      string        `json:",omitempty"`
	DomainNetbios string        `json:",omitempty"`
	Path          string        `json:",omitempty"`
	Files         []GPOfileinfo `json:",omitempty"`
}

type RawObject ¶

type RawObject struct {
	DistinguishedName string
	Attributes        map[string][]string
}

func (*RawObject) DecodeMsg ¶

func (z *RawObject) DecodeMsg(dc *msgp.Reader) (err error)

DecodeMsg implements msgp.Decodable

func (*RawObject) EncodeMsg ¶

func (z *RawObject) EncodeMsg(en *msgp.Writer) (err error)

EncodeMsg implements msgp.Encodable

func (*RawObject) IngestLDAP ¶

func (item *RawObject) IngestLDAP(source *ldap.Entry) error

func (*RawObject) Init ¶

func (r *RawObject) Init()

func (*RawObject) MarshalMsg ¶

func (z *RawObject) MarshalMsg(b []byte) (o []byte, err error)

MarshalMsg implements msgp.Marshaler

func (*RawObject) Msgsize ¶

func (z *RawObject) Msgsize() (s int)

Msgsize returns an upper bound estimate of the number of bytes occupied by the serialized message

func (*RawObject) ToObject ¶

func (r *RawObject) ToObject(onlyKnownAttributes bool) *engine.Object

func (*RawObject) UnmarshalMsg ¶

func (z *RawObject) UnmarshalMsg(bts []byte) (o []byte, err error)

UnmarshalMsg implements msgp.Unmarshaler

Source Files ¶

View all Source files

Directories ¶

Path	Synopsis
analyze
collect

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL