rusthound_ce/objects/
group.rs

1use serde::{Deserialize, Serialize};
2use serde_json::value::Value;
3use ldap3::SearchEntry;
4use log::{debug, trace};
5use std::collections::HashMap;
6use std::error::Error;
7
8use crate::enums::regex::OBJECT_SID_RE1;
9use crate::objects::common::{LdapObject, AceTemplate, SPNTarget, Link, Member};
10use crate::enums::acl::parse_ntsecuritydescriptor;
11use crate::enums::secdesc::LdapSid;
12use crate::enums::sid::{objectsid_to_vec8, sid_maker};
13use crate::utils::date::string_to_epoch;
14
15/// Group structure
16#[derive(Debug, Clone, Deserialize, Serialize, Default)]
17pub struct Group {
18    #[serde(rename = "ObjectIdentifier")]
19    object_identifier: String,
20    #[serde(rename = "IsDeleted")]
21    is_deleted: bool,
22    #[serde(rename = "IsACLProtected")]
23    is_acl_protected: bool,
24    #[serde(rename = "Properties")]
25    properties: GroupProperties,
26    #[serde(rename = "Members")]
27    members: Vec<Member>,
28    #[serde(rename = "Aces")]
29    aces: Vec<AceTemplate>,
30    #[serde(rename = "ContainedBy")]
31    contained_by: Option<Member>,
32}
33
34impl Group {
35    // New group.
36    pub fn new() -> Self { 
37        Self { ..Default::default() } 
38    }
39
40    // Immutable access.
41    pub fn members(&self) -> &Vec<Member> {
42        &self.members
43    }
44
45    // Mutable access.
46    pub fn properties_mut(&mut self) -> &mut GroupProperties {
47        &mut self.properties
48    }
49    pub fn object_identifier_mut(&mut self) -> &mut String {
50        &mut self.object_identifier
51    }
52    pub fn members_mut(&mut self) -> &mut Vec<Member> {
53        &mut self.members
54    }
55
56    /// Function to parse and replace value for group object.
57    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#groups>
58    pub fn parse(
59        &mut self,
60        result: SearchEntry,
61        domain: &str,
62        dn_sid: &mut HashMap<String, String>,
63        sid_type: &mut HashMap<String, String>,
64        domain_sid: &str,
65    ) -> Result<(), Box<dyn Error>> {
66        let result_dn: String = result.dn.to_uppercase();
67        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
68        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
69
70        debug!("Parse group: {result_dn}");
71
72        // Trace all result attributes
73        for (key, value) in &result_attrs {
74            trace!("  {key:?}:{value:?}");
75        }
76        // Trace all bin result attributes
77        for (key, value) in &result_bin {
78            trace!("  {key:?}:{value:?}");
79        }
80
81        // Change all values...
82        self.properties.domain = domain.to_uppercase();
83        self.properties.distinguishedname = result_dn;
84        self.properties.domainsid = domain_sid.to_string();
85
86        // With a check
87        for (key, value) in &result_attrs {
88            match key.as_str() {
89                "name" => {
90                    let name = &value[0];
91                    let email = format!("{}@{}", name.to_owned(), domain);
92                    self.properties.name = email.to_uppercase();
93                }
94                "description" => {
95                    self.properties.description = Some(value[0].to_owned());
96                }
97                "adminCount" => {
98                    let isadmin = &value[0];
99                    let mut admincount = false;
100                    if isadmin == "1" {
101                        admincount = true;
102                    }
103                    self.properties.admincount = admincount;
104                }
105                "sAMAccountName" => {
106                    self.properties.samaccountname = value[0].to_owned();
107                }
108                "member" => {
109                    if !value.is_empty() {
110                        let mut _vec_members: Vec<Member> = Vec::new();
111
112                        for member in value {
113                            let _member = member.trim();
114                            if _member.is_empty() {
115                                continue;
116                            }
117                            if _member.eq_ignore_ascii_case("SID") {
118                                continue;
119                            }
120
121                            let mut m = Member::new();
122                            *m.object_identifier_mut() = _member.to_uppercase();
123                            _vec_members.push(m);
124                        }
125                        
126                        self.members = _vec_members;
127                    }
128                }
129                "objectSid" => {
130                    // objectSid to vec and raw to string
131                    let vec_sid = objectsid_to_vec8(&value[0]);
132                    let sid = sid_maker(LdapSid::parse(&vec_sid).unwrap().1, domain);
133                    self.object_identifier = sid.to_owned();
134
135                    /*let re = Regex::new(r"^S-[0-9]{1}-[0-9]{1}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}").unwrap();
136                    for domain_sid in re.captures_iter(&sid) 
137                    {
138                        group_json["Properties"]["domainsid"] = domain_sid[0].to_owned().to_string();
139                    }*/
140
141                    // highvalue
142                    if sid.ends_with("-512") 
143                        || sid.ends_with("-516") 
144                        || sid.ends_with("-519") 
145                        || sid.ends_with("-520") 
146                    {
147                        self.properties.highvalue = true;
148                    } else if sid.ends_with("S-1-5-32-544") 
149                        || sid.ends_with("S-1-5-32-548") 
150                        || sid.ends_with("S-1-5-32-549")
151                        || sid.ends_with("S-1-5-32-550") 
152                        || sid.ends_with("S-1-5-32-551")
153                    {
154                        self.properties.highvalue = true;
155                    } else {
156                        self.properties.highvalue = false;
157                    }
158                }
159                "whenCreated" => {
160                    let epoch = string_to_epoch(&value[0])?;
161                    if epoch.is_positive() {
162                        self.properties.whencreated = epoch;
163                    }
164                }
165                "IsDeleted" => {
166                    self.is_deleted = true;
167                }
168                _ => {}
169            }
170        }
171
172        // For all, bins attributs
173        for (key, value) in &result_bin {
174            match key.as_str() {
175                "objectSid" => {
176                    // objectSid raw to string
177                    let sid = sid_maker(LdapSid::parse(&value[0]).unwrap().1, domain);
178                    self.object_identifier = sid.to_owned();
179
180                    for domain_sid in OBJECT_SID_RE1.captures_iter(&sid) {
181                        self.properties.domainsid = domain_sid[0].to_owned().to_string();
182                    }
183    
184                    // highvalue
185                    if sid.ends_with("-512") 
186                        || sid.ends_with("-516") 
187                        || sid.ends_with("-519") 
188                        || sid.ends_with("-520") 
189                    {
190                        self.properties.highvalue = true;
191                    }
192                    else if sid.ends_with("S-1-5-32-544") 
193                        || sid.ends_with("S-1-5-32-548") 
194                        || sid.ends_with("S-1-5-32-549")
195                        || sid.ends_with("S-1-5-32-550") 
196                        || sid.ends_with("S-1-5-32-551") 
197                    {
198                        self.properties.highvalue = true;
199                    }
200                    else {
201                        self.properties.highvalue = false;
202                    }
203                }
204                "nTSecurityDescriptor" => {
205                    // nTSecurityDescriptor raw to string
206                    let relations_ace = parse_ntsecuritydescriptor(
207                        self,
208                        &value[0],
209                        "Group",
210                        &result_attrs,
211                        &result_bin,
212                        domain,
213                    );
214                    self.aces = relations_ace;
215                }
216                _ => {}
217            }
218        }
219
220        // Push DN and SID in HashMap
221        dn_sid.insert(
222            self.properties.distinguishedname.to_string(),
223            self.object_identifier.to_string(),
224        );
225        // Push DN and Type
226        sid_type.insert(
227            self.object_identifier.to_string(),
228            "Group".to_string(),
229        );
230
231        // Trace and return Group struct
232        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
233        Ok(())
234    }
235}
236
237impl LdapObject for Group {
238    // To JSON
239    fn to_json(&self) -> Value {
240        serde_json::to_value(self).unwrap()
241    }
242
243    // Get values
244    fn get_object_identifier(&self) -> &String {
245        &self.object_identifier
246    }
247    fn get_is_acl_protected(&self) -> &bool {
248        &self.is_acl_protected
249    }
250    fn get_aces(&self) -> &Vec<AceTemplate> {
251        &self.aces
252    }
253    fn get_spntargets(&self) -> &Vec<SPNTarget> {
254        panic!("Not used by current object.");
255    }
256    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
257        panic!("Not used by current object.");
258    }
259    fn get_links(&self) -> &Vec<Link> {
260        panic!("Not used by current object.");
261    }
262    fn get_contained_by(&self) -> &Option<Member> {
263        &self.contained_by
264    }
265    fn get_child_objects(&self) -> &Vec<Member> {
266        panic!("Not used by current object.");
267    }
268    fn get_haslaps(&self) -> &bool {
269        &false
270    }
271    
272    // Get mutable values
273    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
274        &mut self.aces
275    }
276    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
277        panic!("Not used by current object.");
278    }
279    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
280        panic!("Not used by current object.");
281    }
282    
283    // Edit values
284    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
285        self.is_acl_protected = is_acl_protected;
286        self.properties.isaclprotected = is_acl_protected;
287    }
288    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
289        self.aces = aces;
290    }
291    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
292        // Not used by current object.
293    }
294    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
295        // Not used by current object.
296    }
297    fn set_links(&mut self, _links: Vec<Link>) {
298        // Not used by current object.
299    }
300    fn set_contained_by(&mut self, contained_by: Option<Member>) {
301        self.contained_by = contained_by;
302    }
303    fn set_child_objects(&mut self, _child_objects: Vec<Member>) {
304        // Not used by current object.
305    }
306}
307
308// Group properties structure
309#[derive(Debug, Clone, Deserialize, Serialize, Default)]
310pub struct GroupProperties {
311    domain: String,
312    name: String,
313    distinguishedname: String,
314    domainsid: String,
315    isaclprotected: bool,
316    highvalue: bool,
317    samaccountname: String,
318    description: Option<String>,
319    whencreated: i64,
320    admincount: bool,
321}
322
323impl GroupProperties {
324    // Mutable access.
325    pub fn name_mut(&mut self) -> &mut String {
326        &mut self.name
327    }
328    pub fn domain_mut(&mut self) -> &mut String {
329        &mut self.domain
330    }
331    pub fn domainsid_mut(&mut self) -> &mut String {
332        &mut self.domainsid
333    }
334    pub fn highvalue_mut(&mut self) -> &mut bool {
335        &mut self.highvalue
336    }
337}
rusthound_ce/objects/group.rs

rusthound_ce/objects/
group.rs
