rusthound_ce/objects/
domain.rs

1use serde_json::value::Value;
2use serde::{Deserialize, Serialize};
3use colored::Colorize;
4use ldap3::SearchEntry;
5use log::{info, debug, trace};
6use std::collections::HashMap;
7use std::error::Error;
8
9use crate::enums::regex::OBJECT_SID_RE1;
10use crate::objects::common::{LdapObject, GPOChange, Link, AceTemplate, SPNTarget, Member};
11use crate::objects::trust::Trust;
12use crate::utils::date::{span_to_string, string_to_epoch};
13use crate::enums::acl::parse_ntsecuritydescriptor;
14use crate::enums::forestlevel::get_forest_level;
15use crate::enums::gplink::parse_gplink;
16use crate::enums::secdesc::LdapSid;
17use crate::enums::sid::sid_maker;
18
19/// Domain structure
20#[derive(Debug, Clone, Deserialize, Serialize, Default)]
21pub struct Domain {
22    #[serde(rename = "Properties")]
23    properties: DomainProperties,
24    #[serde(rename = "GPOChanges")]
25    gpo_changes: GPOChange,
26    #[serde(rename = "ChildObjects")]
27    child_objects: Vec<Member>,
28    #[serde(rename = "Trusts")]
29    trusts: Vec<Trust>,
30    #[serde(rename = "Links")]
31    links: Vec<Link>,
32    #[serde(rename = "Aces")]
33    aces: Vec<AceTemplate>,
34    #[serde(rename = "ObjectIdentifier")]
35    object_identifier: String,
36    #[serde(rename = "IsDeleted")]
37    is_deleted: bool,
38    #[serde(rename = "IsACLProtected")]
39    is_acl_protected: bool,
40    #[serde(rename = "ContainedBy")]
41    contained_by: Option<Member>,
42}
43
44impl Domain {
45    // New domain.
46    pub fn new() -> Self { 
47        Self { ..Default::default() } 
48    }
49
50    // Mutable access.
51    pub fn properties_mut(&mut self) -> &mut DomainProperties {
52        &mut self.properties
53    }
54    pub fn object_identifier_mut(&mut self) -> &mut String {
55        &mut self.object_identifier
56    }
57    pub fn gpo_changes_mut(&mut self) -> &mut GPOChange {
58        &mut self.gpo_changes
59    }
60    pub fn trusts_mut(&mut self) -> &mut Vec<Trust> {
61        &mut self.trusts
62    }
63
64    /// Function to parse and replace value for domain object.
65    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#domains>
66    pub fn parse(
67        &mut self,
68        result: SearchEntry,
69        domain_name: &str,
70        dn_sid: &mut HashMap<String, String>,
71        sid_type: &mut HashMap<String, String>,
72    ) -> Result<String, Box<dyn Error>> {
73        let result_dn: String = result.dn.to_uppercase();
74        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
75        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
76
77        // Debug for current object
78        debug!("Parse domain: {result_dn}");
79
80        // Trace all result attributes
81        for (key, value) in &result_attrs {
82            trace!("  {key:?}:{value:?}");
83        }
84        // Trace all bin result attributes
85        for (key, value) in &result_bin {
86            trace!("  {key:?}:{value:?}");
87        }
88
89        // Change all values...
90        self.properties.domain = domain_name.to_uppercase();
91        self.properties.distinguishedname = result_dn;
92
93        // Change all values...
94        #[allow(unused_assignments)]
95        let mut sid: String = "".to_owned();
96        let mut global_domain_sid: String = "DOMAIN_SID".to_owned();
97        // With a check
98        for (key, value) in &result_attrs {
99            match key.as_str() {
100                "distinguishedName" => {
101                    // name & domain & distinguishedname
102                    self.properties.distinguishedname = value[0].to_owned().to_uppercase();
103                    let name = value[0]
104                        .split(",")
105                        .filter(|x| x.starts_with("DC="))
106                        .map(|x| x.strip_prefix("DC=").unwrap_or(""))
107                        .collect::<Vec<&str>>()
108                        .join(".");
109                    self.properties.name = name.to_uppercase();
110                    self.properties.domain = name.to_uppercase();
111                }
112                "msDS-Behavior-Version" => {
113                    let level = get_forest_level(value[0].to_string());
114                    self.properties.functionallevel  = level;
115                }
116                "whenCreated" => {
117                    let epoch = string_to_epoch(&value[0])?;
118                    if epoch.is_positive() {
119                        self.properties.whencreated = epoch;
120                    }
121                }
122                "gPLink" => {
123                    self.links = parse_gplink(value[0].to_string())?;
124                }
125                "isCriticalSystemObject" => {
126                    self.properties.highvalue = value[0].contains("TRUE");
127                }
128                // The number of computer accounts that a user is allowed to create in a domain.
129                "ms-DS-MachineAccountQuota" => {
130                    let machine_account_quota = value[0].parse::<i32>().unwrap_or(0);
131                    self.properties.machineaccountquota = machine_account_quota;
132                    if machine_account_quota > 0 {
133                        info!("MachineAccountQuota: {}", machine_account_quota.to_string().yellow().bold());
134                    }
135                }
136                "IsDeleted" => {
137                    self.is_deleted = true;
138                }
139                "msDS-ExpirePasswordsOnSmartCardOnlyAccounts" => {
140                    self.properties.expirepasswordsonsmartcardonlyaccounts = true;
141                }
142                "minPwdLength" => {
143                    self.properties.minpwdlength = value[0].parse::<i32>().unwrap_or(0);
144                }
145                "pwdProperties" => {
146                    self.properties.pwdproperties = value[0].parse::<i32>().unwrap_or(0);
147                }
148                "pwdHistoryLength" => {
149                    self.properties.pwdhistorylength = value[0].parse::<i32>().unwrap_or(0);
150                }
151                "lockoutThreshold" => {
152                    self.properties.lockoutthreshold = value[0].parse::<i32>().unwrap_or(0);
153                }
154                "minPwdAge" => {
155                    self.properties.minpwdage = span_to_string(value[0].parse::<i64>().unwrap_or(0));
156                }
157                "maxPwdAge" => {
158                    self.properties.maxpwdage = span_to_string(value[0].parse::<i64>().unwrap_or(0));
159                }
160                "lockoutDuration" => {
161                    self.properties.lockoutduration = span_to_string(value[0].parse::<i64>().unwrap_or(0));
162                }
163                "lockOutObservationWindow" => {
164                    self.properties.lockoutobservationwindow = value[0].parse::<i64>().unwrap_or(0);
165                }
166                _ => {}
167            }
168        }
169
170        // For all, bins attributes
171        for (key, value) in &result_bin {
172            match key.as_str() {
173                "objectSid" => {
174                    // objectSid raw to string
175                    sid = sid_maker(LdapSid::parse(&value[0]).unwrap().1, domain_name);
176                    self.object_identifier = sid.to_owned();
177
178                    for domain_sid in OBJECT_SID_RE1.captures_iter(&sid) {
179                        self.properties.domainsid = domain_sid[0].to_owned().to_string();
180                        global_domain_sid = domain_sid[0].to_owned().to_string();
181                    }
182
183                    // Data Quality flag
184                    self.properties.collected = true;
185                }
186                "nTSecurityDescriptor" => {
187                    // nTSecurityDescriptor raw to string
188                    let relations_ace = parse_ntsecuritydescriptor(
189                        self,
190                        &value[0],
191                        "Domain",
192                        &result_attrs,
193                        &result_bin,
194                        domain_name,
195                    );
196                    self.aces = relations_ace;
197                }
198                _ => {}
199            }
200        }
201
202        // Push DN and SID in HashMap
203        dn_sid.insert(
204        self.properties.distinguishedname.to_string(),
205        self.object_identifier.to_string()
206        );
207        // Push DN and Type
208        sid_type.insert(
209            self.object_identifier.to_string(),
210            "Domain".to_string(),
211        );
212
213        // Trace and return Domain struct
214        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
215        Ok(global_domain_sid)
216    }
217}
218
219impl LdapObject for Domain {
220    // To JSON
221    fn to_json(&self) -> Value {
222        serde_json::to_value(self).unwrap()
223    }
224
225    // Get values
226    fn get_object_identifier(&self) -> &String {
227        &self.object_identifier
228    }
229    fn get_is_acl_protected(&self) -> &bool {
230        &self.is_acl_protected
231    }
232    fn get_aces(&self) -> &Vec<AceTemplate> {
233        &self.aces
234    }
235    fn get_spntargets(&self) -> &Vec<SPNTarget> {
236        panic!("Not used by current object.");
237    }
238    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
239        panic!("Not used by current object.");
240    }
241    fn get_links(&self) -> &Vec<Link> {
242        &self.links
243    }
244    fn get_contained_by(&self) -> &Option<Member> {
245        &self.contained_by
246    }
247    fn get_child_objects(&self) -> &Vec<Member> {
248        &self.child_objects
249    }
250    fn get_haslaps(&self) -> &bool {
251        &false
252    }
253    
254    // Get mutable values
255    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
256        &mut self.aces
257    }
258    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
259        panic!("Not used by current object.");
260    }
261    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
262        panic!("Not used by current object.");
263    }
264    
265    // Edit values
266    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
267        self.is_acl_protected = is_acl_protected;
268        self.properties.isaclprotected = is_acl_protected;
269    }
270    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
271        self.aces = aces;
272    }
273    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
274        // Not used by current object.
275    }
276    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
277        // Not used by current object.
278    }
279    fn set_links(&mut self, links: Vec<Link>) {
280        self.links = links;
281    }
282    fn set_contained_by(&mut self, contained_by: Option<Member>) {
283        self.contained_by = contained_by;
284    }
285    fn set_child_objects(&mut self, child_objects: Vec<Member>) {
286        self.child_objects = child_objects
287    }
288}
289
290// Domain properties structure
291#[derive(Debug, Clone, Deserialize, Serialize, Default)]
292pub struct DomainProperties {
293    domain: String,
294    name: String,
295    distinguishedname: String,
296    domainsid: String,
297    isaclprotected: bool,
298    highvalue: bool,
299    description: Option<String>,
300    whencreated: i64,
301    machineaccountquota: i32,
302    expirepasswordsonsmartcardonlyaccounts: bool,
303    minpwdlength: i32,
304    pwdproperties: i32,
305    pwdhistorylength: i32,
306    lockoutthreshold: i32,
307    minpwdage: String,
308    maxpwdage: String,
309    lockoutduration: String,
310    lockoutobservationwindow: i64,
311    functionallevel: String,
312    collected: bool
313}
314
315impl DomainProperties {
316    // Mutable access.
317    pub fn domain_mut(&mut self) -> &mut String {
318       &mut self.domain
319    }
320    pub fn name_mut(&mut self) -> &mut String {
321       &mut self.name
322    }
323    pub fn highvalue_mut(&mut self) -> &mut bool {
324        &mut self.highvalue
325     }
326    pub fn distinguishedname_mut(&mut self) -> &mut String {
327        &mut self.distinguishedname
328     }
329}
rusthound_ce/objects/domain.rs

rusthound_ce/objects/
domain.rs
