rusthound_ce/objects/
group.rs

1use serde::{Deserialize, Serialize};
2use serde_json::value::Value;
3use ldap3::SearchEntry;
4use log::{debug, trace};
5use std::collections::HashMap;
6use std::error::Error;
7
8use crate::enums::regex::OBJECT_SID_RE1;
9use crate::objects::common::{LdapObject, AceTemplate, SPNTarget, Link, Member};
10use crate::enums::acl::parse_ntsecuritydescriptor;
11use crate::enums::secdesc::LdapSid;
12use crate::enums::sid::{objectsid_to_vec8, sid_maker};
13use crate::utils::date::string_to_epoch;
14
15/// Group structure
16#[derive(Debug, Clone, Deserialize, Serialize, Default)]
17pub struct Group {
18    #[serde(rename = "ObjectIdentifier")]
19    object_identifier: String,
20    #[serde(rename = "IsDeleted")]
21    is_deleted: bool,
22    #[serde(rename = "IsACLProtected")]
23    is_acl_protected: bool,
24    #[serde(rename = "Properties")]
25    properties: GroupProperties,
26    #[serde(rename = "Members")]
27    members: Vec<Member>,
28    #[serde(rename = "Aces")]
29    aces: Vec<AceTemplate>,
30    #[serde(rename = "ContainedBy")]
31    contained_by: Option<Member>,
32}
33
34impl Group {
35    // New group.
36    pub fn new() -> Self { 
37        Self { ..Default::default() } 
38    }
39
40    // Immutable access.
41    pub fn members(&self) -> &Vec<Member> {
42        &self.members
43    }
44
45    // Mutable access.
46    pub fn properties_mut(&mut self) -> &mut GroupProperties {
47        &mut self.properties
48    }
49    pub fn object_identifier_mut(&mut self) -> &mut String {
50        &mut self.object_identifier
51    }
52    pub fn members_mut(&mut self) -> &mut Vec<Member> {
53        &mut self.members
54    }
55
56    /// Function to parse and replace value for group object.
57    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#groups>
58    pub fn parse(
59        &mut self,
60        result: SearchEntry,
61        domain: &str,
62        dn_sid: &mut HashMap<String, String>,
63        sid_type: &mut HashMap<String, String>,
64        domain_sid: &str,
65        schema_guid_map: &HashMap<String, String>,
66    ) -> Result<(), Box<dyn Error>> {
67        let result_dn: String = result.dn.to_uppercase();
68        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
69        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
70
71        debug!("Parse group: {result_dn}");
72
73        // Trace all result attributes
74        for (key, value) in &result_attrs {
75            trace!("  {key:?}:{value:?}");
76        }
77        // Trace all bin result attributes
78        for (key, value) in &result_bin {
79            trace!("  {key:?}:{value:?}");
80        }
81
82        // Change all values...
83        self.properties.domain = domain.to_uppercase();
84        self.properties.distinguishedname = result_dn;
85        self.properties.domainsid = domain_sid.to_string();
86
87        // With a check
88        for (key, value) in &result_attrs {
89            match key.as_str() {
90                "name" => {
91                    let name = &value[0];
92                    let email = format!("{}@{}", name.to_owned(), domain);
93                    self.properties.name = email.to_uppercase();
94                }
95                "description" => {
96                    self.properties.description = Some(value[0].to_owned());
97                }
98                "adminCount" => {
99                    let isadmin = &value[0];
100                    let mut admincount = false;
101                    if isadmin == "1" {
102                        admincount = true;
103                    }
104                    self.properties.admincount = admincount;
105                }
106                "sAMAccountName" => {
107                    self.properties.samaccountname = value[0].to_owned();
108                }
109                "member" => {
110                    if !value.is_empty() {
111                        let mut _vec_members: Vec<Member> = Vec::new();
112
113                        for member in value {
114                            let _member = member.trim();
115                            if _member.is_empty() {
116                                continue;
117                            }
118                            if _member.eq_ignore_ascii_case("SID") {
119                                continue;
120                            }
121
122                            let mut m = Member::new();
123                            *m.object_identifier_mut() = _member.to_uppercase();
124                            _vec_members.push(m);
125                        }
126                        
127                        self.members = _vec_members;
128                    }
129                }
130                "objectSid" => {
131                    // objectSid to vec and raw to string
132                    let vec_sid = objectsid_to_vec8(&value[0]);
133                    let sid = sid_maker(LdapSid::parse(&vec_sid).unwrap().1, domain);
134                    self.object_identifier = sid.to_owned();
135
136                    /*let re = Regex::new(r"^S-[0-9]{1}-[0-9]{1}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}").unwrap();
137                    for domain_sid in re.captures_iter(&sid) 
138                    {
139                        group_json["Properties"]["domainsid"] = domain_sid[0].to_owned().to_string();
140                    }*/
141
142                    // highvalue
143                    if sid.ends_with("-512") 
144                        || sid.ends_with("-516") 
145                        || sid.ends_with("-519") 
146                        || sid.ends_with("-520") 
147                    {
148                        self.properties.highvalue = true;
149                    } else if sid.ends_with("S-1-5-32-544") 
150                        || sid.ends_with("S-1-5-32-548") 
151                        || sid.ends_with("S-1-5-32-549")
152                        || sid.ends_with("S-1-5-32-550") 
153                        || sid.ends_with("S-1-5-32-551")
154                    {
155                        self.properties.highvalue = true;
156                    } else {
157                        self.properties.highvalue = false;
158                    }
159                }
160                "whenCreated" => {
161                    let epoch = string_to_epoch(&value[0])?;
162                    if epoch.is_positive() {
163                        self.properties.whencreated = epoch;
164                    }
165                }
166                "IsDeleted" => {
167                    self.is_deleted = true;
168                }
169                _ => {}
170            }
171        }
172
173        // For all, bins attributs
174        for (key, value) in &result_bin {
175            match key.as_str() {
176                "objectSid" => {
177                    // objectSid raw to string
178                    let sid = sid_maker(LdapSid::parse(&value[0]).unwrap().1, domain);
179                    self.object_identifier = sid.to_owned();
180
181                    for domain_sid in OBJECT_SID_RE1.captures_iter(&sid) {
182                        self.properties.domainsid = domain_sid[0].to_owned().to_string();
183                    }
184    
185                    // highvalue
186                    if sid.ends_with("-512") 
187                        || sid.ends_with("-516") 
188                        || sid.ends_with("-519") 
189                        || sid.ends_with("-520") 
190                    {
191                        self.properties.highvalue = true;
192                    }
193                    else if sid.ends_with("S-1-5-32-544") 
194                        || sid.ends_with("S-1-5-32-548") 
195                        || sid.ends_with("S-1-5-32-549")
196                        || sid.ends_with("S-1-5-32-550") 
197                        || sid.ends_with("S-1-5-32-551") 
198                    {
199                        self.properties.highvalue = true;
200                    }
201                    else {
202                        self.properties.highvalue = false;
203                    }
204                }
205                "nTSecurityDescriptor" => {
206                    // nTSecurityDescriptor raw to string
207                    let relations_ace = parse_ntsecuritydescriptor(
208                        self,
209                        &value[0],
210                        "Group",
211                        &result_attrs,
212                        &result_bin,
213                        domain,
214                        schema_guid_map,
215                    );
216                    self.aces = relations_ace;
217                }
218                _ => {}
219            }
220        }
221
222        // Push DN and SID in HashMap
223        dn_sid.insert(
224            self.properties.distinguishedname.to_string(),
225            self.object_identifier.to_string(),
226        );
227        // Push DN and Type
228        sid_type.insert(
229            self.object_identifier.to_string(),
230            "Group".to_string(),
231        );
232
233        // Trace and return Group struct
234        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
235        Ok(())
236    }
237}
238
239impl LdapObject for Group {
240    // To JSON
241    fn to_json(&self) -> Value {
242        serde_json::to_value(self).unwrap()
243    }
244
245    // Get values
246    fn get_object_identifier(&self) -> &String {
247        &self.object_identifier
248    }
249    fn get_is_acl_protected(&self) -> &bool {
250        &self.is_acl_protected
251    }
252    fn get_aces(&self) -> &Vec<AceTemplate> {
253        &self.aces
254    }
255    fn get_spntargets(&self) -> &Vec<SPNTarget> {
256        panic!("Not used by current object.");
257    }
258    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
259        panic!("Not used by current object.");
260    }
261    fn get_links(&self) -> &Vec<Link> {
262        panic!("Not used by current object.");
263    }
264    fn get_contained_by(&self) -> &Option<Member> {
265        &self.contained_by
266    }
267    fn get_child_objects(&self) -> &Vec<Member> {
268        panic!("Not used by current object.");
269    }
270    fn get_haslaps(&self) -> &bool {
271        &false
272    }
273    
274    // Get mutable values
275    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
276        &mut self.aces
277    }
278    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
279        panic!("Not used by current object.");
280    }
281    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
282        panic!("Not used by current object.");
283    }
284    
285    // Edit values
286    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
287        self.is_acl_protected = is_acl_protected;
288        self.properties.isaclprotected = is_acl_protected;
289    }
290    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
291        self.aces = aces;
292    }
293    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
294        // Not used by current object.
295    }
296    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
297        // Not used by current object.
298    }
299    fn set_links(&mut self, _links: Vec<Link>) {
300        // Not used by current object.
301    }
302    fn set_contained_by(&mut self, contained_by: Option<Member>) {
303        self.contained_by = contained_by;
304    }
305    fn set_child_objects(&mut self, _child_objects: Vec<Member>) {
306        // Not used by current object.
307    }
308}
309
310// Group properties structure
311#[derive(Debug, Clone, Deserialize, Serialize, Default)]
312pub struct GroupProperties {
313    domain: String,
314    name: String,
315    distinguishedname: String,
316    domainsid: String,
317    isaclprotected: bool,
318    highvalue: bool,
319    samaccountname: String,
320    description: Option<String>,
321    whencreated: i64,
322    admincount: bool,
323}
324
325impl GroupProperties {
326    // Mutable access.
327    pub fn name_mut(&mut self) -> &mut String {
328        &mut self.name
329    }
330    pub fn domain_mut(&mut self) -> &mut String {
331        &mut self.domain
332    }
333    pub fn domainsid_mut(&mut self) -> &mut String {
334        &mut self.domainsid
335    }
336    pub fn highvalue_mut(&mut self) -> &mut bool {
337        &mut self.highvalue
338    }
339}
rusthound_ce/objects/group.rs

rusthound_ce/objects/
group.rs
