rusthound-ce 2.4.91

Active Directory data collector for Bloodhound Community Edition written in rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52

use std::collections::HashMap;
use ldap3::SearchEntry;
use log::{debug, trace};

use crate::enums::decode_guid_le;

pub struct Schema;

impl Schema {
    /// New Schema
    pub fn new() -> Self {
        Schema
    }

    /// Function to parse value for Schema object.
    pub fn parse(
        &self,
        result: SearchEntry,
        schema_guid_map: &mut HashMap<String, String>,
    ) -> Result<(), Box<dyn std::error::Error>> {
        
        let result_dn: String = result.dn.to_uppercase();
        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;

        // Debug for current object
        debug!("Parse schema: {result_dn}");

        // Trace all result attributes
        for (key, value) in &result_attrs {
            trace!("  {key:?}:{value:?}");
        }
        // Trace all bin result attributes
        for (key, value) in &result_bin {
            trace!("  {key:?}:{value:?}");
        }

        // Only get name:schemaIDGUID
        if let (Some(names), Some(guids)) = (
            result_attrs.get("name"),
            result_bin.get("schemaIDGUID"),
        ) {
            if let (Some(name), Some(guid_bytes)) = (names.first(), guids.first()) {
                let guid = decode_guid_le(guid_bytes);
                trace!("Parse Schema object .to_lowercase(): {}:{}", name.to_lowercase(), guid.to_lowercase());
                schema_guid_map.insert(name.to_lowercase(), guid.to_lowercase());
            }
        }
        
        Ok(())
    }
}