rusthound 1.1.69

Active Directory data collector for Bloodhound written in rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

use bitflags::bitflags;

bitflags! {
   struct Flags: u32 {
      // TRUST FLAG
      // From: https://msdn.microsoft.com/en-us/library/cc223779.aspx
      const NON_TRANSITIVE= 0x00000001;
      const UPLEVEL_ONLY= 0x00000002;
      const QUARANTINED_DOMAIN= 0x00000004;
      const FOREST_TRANSITIVE= 0x00000008;
      const CROSS_ORGANIZATION= 0x00000010;
      const WITHIN_FOREST= 0x00000020;
      const TREAT_AS_EXTERNAL= 0x00000040;
      const USES_RC4_ENCRYPTION= 0x00000080;
      const CROSS_ORGANIZATION_NO_TGT_DELEGATION= 0x00000200;
      const CROSS_ORGANIZATION_ENABLE_TGT_DELEGATION= 0x00000800;
      const PIM_TRUST= 0x00000400;
   }
}

/// Get the trust flags from "trustDomain".
pub fn get_trust_flag(trustflag: u32, trust_json: &mut serde_json::value::Value)
{
   let mut is_transitive = false;
   let mut sid_filtering = false;

   if (Flags::WITHIN_FOREST.bits() | trustflag) == trustflag
   {
      let trust_type = "ParentChild"; //0 = ParentChild
      trust_json["TrustType"] = trust_type.into();
      is_transitive = true;
      if (Flags::QUARANTINED_DOMAIN.bits() | trustflag) == trustflag {
         sid_filtering = true;
      }
   }
   else if (Flags::FOREST_TRANSITIVE.bits() | trustflag) == trustflag
   {
      let trust_type = "Forest"; //2 = Forest
      trust_json["TrustType"] = trust_type.into();
      is_transitive = true;
      sid_filtering = true;
   }
   else if (Flags::TREAT_AS_EXTERNAL.bits() | trustflag) == trustflag || (Flags::CROSS_ORGANIZATION.bits() | trustflag) == trustflag
   {
      let trust_type = "External"; //3 = External
      trust_json["TrustType"] = trust_type.into();
      is_transitive = false;
      sid_filtering = true;
   }
   else
   {
      let trust_type = "Unknown"; //4 = Unknown
      trust_json["TrustType"] = trust_type.into();
      if (Flags::NON_TRANSITIVE.bits() | trustflag) != trustflag {
         is_transitive = true;
      }
      sid_filtering = true;
   }

   // change value in mut vec json
   trust_json["SidFilteringEnabled"] = sid_filtering.into();
   trust_json["IsTransitive"] = is_transitive.into();
}