rusthound_ce/objects/
ou.rs

1use serde_json::value::Value;
2use serde::{Deserialize, Serialize};
3
4use crate::objects::common::{
5    LdapObject,
6    AceTemplate,
7    GPOChange,
8    Link,
9    SPNTarget,
10    Member
11};
12
13use ldap3::SearchEntry;
14use log::{debug, trace};
15use std::collections::HashMap;
16use std::error::Error;
17
18use crate::enums::acl::parse_ntsecuritydescriptor;
19use crate::enums::gplink::parse_gplink;
20use crate::enums::sid::decode_guid_le;
21use crate::utils::date::string_to_epoch;
22
23/// Ou structure
24#[derive(Debug, Clone, Deserialize, Serialize, Default)]
25pub struct Ou {
26    #[serde(rename = "GPOChanges")]
27    gpo_changes: GPOChange,
28    #[serde(rename = "ObjectIdentifier")]
29    object_identifier: String,
30    #[serde(rename = "Properties")]
31    properties: OuProperties,
32    #[serde(rename = "Aces")]
33    aces: Vec<AceTemplate>,
34    #[serde(rename = "Links")]
35    links: Vec<Link>,
36    #[serde(rename = "ChildObjects")]
37    child_objects: Vec<Member>,
38    #[serde(rename = "IsDeleted")]
39    is_deleted: bool,
40    #[serde(rename = "IsACLProtected")]
41    is_acl_protected: bool,
42    #[serde(rename = "ContainedBy")]
43    contained_by: Option<Member>,
44}
45
46impl Ou {
47    // New computer.
48    pub fn new() -> Self { 
49        Self { ..Default::default() } 
50    }
51
52    // Immutable access.
53    pub fn properties(&self) -> &OuProperties {
54        &self.properties
55    }
56
57    // Mutable access.
58    pub fn gpo_changes_mut(&mut self) -> &mut GPOChange {
59        &mut self.gpo_changes
60    }
61    pub fn child_objects_mut(&mut self) -> &mut Vec<Member> {
62        &mut self.child_objects
63    }
64
65    /// Function to parse and replace value for OU object.
66    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#ous>
67    pub fn parse(
68        &mut self,
69        result: SearchEntry,
70        domain: &String,
71        dn_sid: &mut HashMap<String, String>,
72        sid_type: &mut HashMap<String, String>,
73        domain_sid: &String
74    ) -> Result<(), Box<dyn Error>> {
75        let result_dn: String = result.dn.to_uppercase();
76        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
77        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
78        
79        // Debug for current object
80        debug!("Parse OU: {}", result_dn);
81        // Trace all result attributes
82        for (key, value) in &result_attrs {
83             trace!("  {:?}:{:?}", key, value);
84        }
85        // Trace all bin result attributes
86        for (key, value) in &result_bin {
87             trace!("  {:?}:{:?}", key, value);
88        }
89        
90        // Change all values...
91        self.properties.domain = domain.to_uppercase();
92        self.properties.distinguishedname = result_dn;
93        self.properties.domainsid = domain_sid.to_string();
94        
95        // Check and replace value
96        for (key, value) in &result_attrs {
97             match key.as_str() {
98                 "name" => {
99                     let name = &value[0];
100                     let email = format!("{}@{}", name.to_owned(), domain);
101                     self.properties.name = email.to_uppercase();
102                 }
103                 "description" => {
104                     self.properties.description = value.get(0).map(|s| s.clone());
105                 }
106                 "whenCreated" => {
107                     let epoch = string_to_epoch(&value[0])?;
108                     if epoch.is_positive() {
109                          self.properties.whencreated = epoch;
110                     }
111                 }
112                 "gPLink" => {
113                     self.links = parse_gplink(value[0].to_string())?;
114                 }
115                 "gPOtions" => {
116                     self.properties.blocksinheritance = value[0].parse::<i64>().unwrap_or(0) == 1;
117                 }
118                 "IsDeleted" => {
119                     self.is_deleted = true;
120                 }
121                 _ => {}
122             }
123        }
124        
125          // For all, bins attributes
126        for (key, value) in &result_bin {
127             match key.as_str() {
128                 "objectGUID" => {
129                     // objectGUID raw to string
130                     self.object_identifier = decode_guid_le(&value[0]).to_owned();
131                 }
132                 "nTSecurityDescriptor" => {
133                     // trace!("nTSecurityDescriptor ACES ACLS ?");
134                     // Needed with acl
135                     let entry_type = "OU".to_string();
136                     // nTSecurityDescriptor raw to string
137                     let relations_ace = parse_ntsecuritydescriptor(
138                          self,
139                          &value[0],
140                          entry_type,
141                          &result_attrs,
142                          &result_bin,
143                          &domain,
144                     );
145                     self.aces = relations_ace;
146                 }
147                 _ => {}
148             }
149        }
150        // Push DN and SID in HashMap
151        dn_sid.insert(
152             self.properties.distinguishedname.to_string(),
153             self.object_identifier.to_string(),
154        );
155        // Push DN and Type
156        sid_type.insert(
157            self.object_identifier.to_string(),
158             "OU".to_string(),
159        );
160        
161        // Trace and return Ou struct
162        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
163        Ok(())
164    }
165}
166
167impl LdapObject for Ou {
168    // To JSON
169    fn to_json(&self) -> Value {
170        serde_json::to_value(&self).unwrap()
171    }
172    
173    // Get values
174    fn get_object_identifier(&self) -> &String {
175        &self.object_identifier
176    }
177    fn get_is_acl_protected(&self) -> &bool {
178        &self.is_acl_protected
179    }
180    fn get_aces(&self) -> &Vec<AceTemplate> {
181        &self.aces
182    }
183    fn get_spntargets(&self) -> &Vec<SPNTarget> {
184        panic!("Not used by current object.");
185    }
186    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
187        panic!("Not used by current object.");
188    }
189    fn get_links(&self) -> &Vec<Link> {
190        &self.links
191    }
192    fn get_contained_by(&self) -> &Option<Member> {
193        &self.contained_by
194    }
195    fn get_child_objects(&self) -> &Vec<Member> {
196        &self.child_objects
197    }
198    fn get_haslaps(&self) -> &bool {
199        &false
200    }
201    
202    // Get mutable values
203    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
204        &mut self.aces
205    }
206    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
207        panic!("Not used by current object.");
208    }
209    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
210        panic!("Not used by current object.");
211    }
212    
213    // Edit values
214    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
215        self.is_acl_protected = is_acl_protected;
216        self.properties.isaclprotected = is_acl_protected;
217    }
218    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
219        self.aces = aces;
220    }
221    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
222        // Not used by current object.
223    }
224    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
225        // Not used by current object.
226    }
227    fn set_links(&mut self, links: Vec<Link>) {
228        self.links = links;
229    }
230    fn set_contained_by(&mut self, contained_by: Option<Member>) {
231        self.contained_by = contained_by;
232    }
233    fn set_child_objects(&mut self, child_objects: Vec<Member>) {
234        self.child_objects = child_objects
235    }
236}
237
238// Ou properties structure
239#[derive(Debug, Clone, Deserialize, Serialize, Default)]
240pub struct OuProperties {
241    domain: String,
242    name: String,
243    distinguishedname: String,
244    domainsid: String,
245    isaclprotected: bool,
246    highvalue: bool,
247    description: Option<String>,
248    whencreated: i64,
249    blocksinheritance: bool
250}
251
252impl OuProperties {
253    // Immutable access.
254    pub fn name(&self) -> &String {
255        &self.name
256    }
257    pub fn distinguishedname(&self) -> &String {
258        &self.distinguishedname
259    }
260
261
262    pub fn isaclprotected_mut(&mut self) -> &mut bool {
263        &mut self.isaclprotected
264    }
265}
rusthound_ce/objects/ou.rs

rusthound_ce/objects/
ou.rs
