rusthound_ce/objects/
gpo.rs

1use serde_json::value::Value;
2use serde::{Deserialize, Serialize};
3use ldap3::SearchEntry;
4use log::{debug, trace};
5use std::collections::HashMap;
6use std::error::Error;
7
8use crate::objects::common::{LdapObject, AceTemplate, Link, SPNTarget, Member};
9use crate::enums::decode_guid_le;
10use crate::enums::acl::parse_ntsecuritydescriptor;
11use crate::utils::date::string_to_epoch;
12
13/// Gpo structure
14#[derive(Debug, Clone, Deserialize, Serialize, Default)]
15pub struct Gpo {
16    #[serde(rename = "Properties")]
17    properties: GpoProperties,
18    #[serde(rename = "Aces")]
19    aces: Vec<AceTemplate>,
20    #[serde(rename = "ObjectIdentifier")]
21    object_identifier: String,
22    #[serde(rename = "IsDeleted")]
23    is_deleted: bool,
24    #[serde(rename = "IsACLProtected")]
25    is_acl_protected: bool,
26    #[serde(rename = "ContainedBy")]
27    contained_by: Option<Member>,
28    #[serde(rename = "Links")]
29    links: Vec<Link>,
30}
31
32impl Gpo {
33    // New gpo.
34    pub fn new() -> Self { 
35        Self { ..Default::default() } 
36    }
37    
38    /// Function to parse and replace value for GPO object.
39    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#gpos>
40    pub fn parse(
41        &mut self,
42        result: SearchEntry,
43        domain: &str,
44        dn_sid: &mut HashMap<String, String>,
45        sid_type: &mut HashMap<String, String>,
46        domain_sid: &str,
47        schema_guid_map: &HashMap<String, String>,
48    ) -> Result<(), Box<dyn Error>> {
49        let result_dn: String = result.dn.to_uppercase();
50        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
51        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
52
53        // Debug for current object
54        debug!("Parse gpo: {result_dn}");
55
56        // Trace all result attributes
57        for (key, value) in &result_attrs {
58            trace!("  {key:?}:{value:?}");
59        }
60        // Trace all bin result attributes
61        for (key, value) in &result_bin {
62            trace!("  {key:?}:{value:?}");
63        }
64
65        // Change all values...
66        self.properties.domain = domain.to_uppercase();
67        self.properties.distinguishedname = result_dn;
68        self.properties.domainsid = domain_sid.to_string();
69
70        // Check and replace value
71        for (key, value) in &result_attrs {
72            match key.as_str() {
73                "displayName" => {
74                    let name = &value[0];
75                    let email = format!("{}@{}", name.to_owned(), domain);
76                    self.properties.name = email.to_uppercase();
77                }
78                "description" => {
79                    self.properties.description = value.first().cloned();
80                }
81                "whenCreated" => {
82                    let epoch = string_to_epoch(&value[0])?;
83                    if epoch.is_positive() {
84                        self.properties.whencreated = epoch;
85                    }
86                }
87                "gPCFileSysPath" => {
88                    self.properties.gpcpath = value[0].to_owned();
89                }
90                "IsDeleted" => {
91                    self.is_deleted = true;
92                }
93                _ => {}
94            }
95        }
96
97        // For all, bins attributes
98        for (key, value) in &result_bin {
99            match key.as_str() {
100                "objectGUID" => {
101                    // objectGUID raw to string
102                    self.object_identifier = decode_guid_le(&value[0]).to_owned();
103                }
104                "nTSecurityDescriptor" => {
105                    // nTSecurityDescriptor raw to string
106                    let relations_ace = parse_ntsecuritydescriptor(
107                        self,
108                        &value[0],
109                        "Gpo",
110                        &result_attrs,
111                        &result_bin,
112                        domain,
113                        schema_guid_map,
114                    );
115                    self.aces = relations_ace;
116                }
117                _ => {}
118            }
119        }
120
121        // Push DN and SID in HashMap
122        dn_sid.insert(
123            self.properties.distinguishedname.to_string(),
124            self.object_identifier.to_string(),
125        );
126        // Push DN and Type
127        sid_type.insert(
128            self.object_identifier.to_string(),
129            "Gpo".to_string(),
130        );
131
132        // Trace and return Gpo struct
133        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
134        Ok(())
135    }
136}
137
138impl LdapObject for Gpo {
139    // To JSON
140    fn to_json(&self) -> Value {
141        serde_json::to_value(self).unwrap()
142    }
143
144    // Get values
145    fn get_object_identifier(&self) -> &String {
146        &self.object_identifier
147    }
148    fn get_is_acl_protected(&self) -> &bool {
149        &self.is_acl_protected
150    }
151    fn get_aces(&self) -> &Vec<AceTemplate> {
152        &self.aces
153    }
154    fn get_spntargets(&self) -> &Vec<SPNTarget> {
155        panic!("Not used by current object.");
156    }
157    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
158        panic!("Not used by current object.");
159    }
160    fn get_links(&self) -> &Vec<Link> {
161        panic!("Not used by current object.");
162    }
163    fn get_contained_by(&self) -> &Option<Member> {
164        &self.contained_by
165    }
166    fn get_child_objects(&self) -> &Vec<Member> {
167        panic!("Not used by current object.");
168    }
169    fn get_haslaps(&self) -> &bool {
170        &false
171    }
172    
173    // Get mutable values
174    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
175        &mut self.aces
176    }
177    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
178        panic!("Not used by current object.");
179    }
180    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
181        panic!("Not used by current object.");
182    }
183    
184    // Edit values
185    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
186        self.is_acl_protected = is_acl_protected;
187        self.properties.isaclprotected = is_acl_protected;
188    }
189    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
190        self.aces = aces;
191    }
192    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
193        // Not used by current object.
194    }
195    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
196        // Not used by current object.
197    }
198    fn set_links(&mut self, links: Vec<Link>) {
199        self.links = links;
200    }
201    fn set_contained_by(&mut self, contained_by: Option<Member>) {
202        self.contained_by = contained_by;
203    }
204    fn set_child_objects(&mut self, _child_objects: Vec<Member>) {
205        // Not used by current object.
206    }
207}
208
209// Gpo properties structure
210#[derive(Debug, Clone, Deserialize, Serialize, Default)]
211pub struct GpoProperties {
212   domain: String,
213   name: String,
214   distinguishedname: String,
215   domainsid: String,
216   isaclprotected: bool,
217   highvalue: bool,
218   description: Option<String>,
219   whencreated: i64,
220   gpcpath: String
221}
rusthound_ce/objects/gpo.rs

rusthound_ce/objects/
gpo.rs
