rusthound 1.1.69

Active Directory data collector for Bloodhound written in rust.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

use bitflags::bitflags;

bitflags! {
    struct Flags: u32 {
        const SCRIPT = 0x0001;
        const ACCOUNT_DISABLE = 0x0002;
        const HOME_DIR_REQUIRED = 0x0008;
        const LOCKOUT = 0x0010;
        const PASSWORD_NOT_REQUIRED = 0x0020;
        const PASSWORD_CANT_CHANGE = 0x0040;
        const ENCRYPTED_TEXT_PWD_ALLOWED = 0x0080;
        const TEMP_DUPLICATE_ACCOUNT = 0x0100;
        const NORMAL_ACCOUNT = 0x0200;
        const INTER_DOMAIN_TRUST_ACCOUNT = 0x0800;
        const WORKSTATION_TRUST_ACCOUNT = 0x1000;
        const SERVER_TRUST_ACCOUNT = 0x2000;
        const DONT_EXPIRE_PASSWORD = 0x10000;
        const MNS_LOGON_ACCOUNT = 0x20000;
        const SMART_CARD_REQUIRED = 0x40000;
        const TRUSTED_FOR_DELEGATION = 0x80000;
        const NOT_DELEGATED = 0x100000;
        const USE_DES_KEY_ONLY = 0x200000;
        const DONT_REQ_PRE_AUTH = 0x400000;
        const PASSWORD_EXPIRED = 0x800000;
        const TRUSTED_TO_AUTH_FOR_DELEGATION = 0x1000000;
        const PARTIAL_SECRETS_ACCOUNT = 0x04000000;
    }
}

/// Get the UAC flags from "userAccountControl" LDAP attribut.
pub fn get_flag(uac: u32) -> Vec<String>
{
    let mut uac_flags: Vec<String> = Vec::new();

    if (Flags::SCRIPT.bits() | uac) == uac
    {
        uac_flags.push("Script".to_string());
    }
    if (Flags::ACCOUNT_DISABLE.bits() | uac) == uac
    {
        uac_flags.push("AccountDisable".to_string());
    }
    if (Flags::HOME_DIR_REQUIRED.bits() | uac) == uac
    {
        uac_flags.push("HomeDirRequired".to_string());
    }
    if (Flags::LOCKOUT.bits() | uac) == uac
    {
        uac_flags.push("Lockout".to_string());
    }
    if (Flags::PASSWORD_NOT_REQUIRED.bits() | uac) == uac
    {
        uac_flags.push("PasswordNotRequired".to_string());
    }
    if (Flags::PASSWORD_CANT_CHANGE.bits() | uac) == uac
    {
        uac_flags.push("PasswordCantChange".to_string());
    }
    if (Flags::ENCRYPTED_TEXT_PWD_ALLOWED.bits() | uac) == uac
    {
        uac_flags.push("EncryptedTextPwdAllowed".to_string());
    }
    if (Flags::TEMP_DUPLICATE_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("TempDuplicateAccount".to_string());
    }
    if (Flags::NORMAL_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("NormalAccount".to_string());
    }
    if (Flags::INTER_DOMAIN_TRUST_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("InterdomainTrustAccount".to_string());
    }
    if (Flags::WORKSTATION_TRUST_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("WorkstationTrustAccount".to_string());
    }
    if (Flags::SERVER_TRUST_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("ServerTrustAccount".to_string());
    }
    if (Flags::DONT_EXPIRE_PASSWORD.bits() | uac) == uac
    {
        uac_flags.push("DontExpirePassword".to_string());
    }
    if (Flags::MNS_LOGON_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("MnsLogonAccount".to_string());
    }
    if (Flags::SMART_CARD_REQUIRED.bits() | uac) == uac
    {
        uac_flags.push("SmartcardRequired".to_string());
    }
    if (Flags::TRUSTED_FOR_DELEGATION.bits() | uac) == uac
    {
        uac_flags.push("TrustedForDelegation".to_string());
    }
    if (Flags::NOT_DELEGATED.bits() | uac) == uac
    {
        uac_flags.push("NotDelegated".to_string());
    }
    if (Flags::USE_DES_KEY_ONLY.bits() | uac) == uac
    {
        uac_flags.push("UseDesKeyOnly".to_string());
    }
    if (Flags::DONT_REQ_PRE_AUTH.bits() | uac) == uac
    {
        uac_flags.push("DontReqPreauth".to_string());
    }
    if (Flags::PASSWORD_EXPIRED.bits() | uac) == uac
    {
        uac_flags.push("PasswordExpired".to_string());
    }
    if (Flags::TRUSTED_TO_AUTH_FOR_DELEGATION.bits() | uac) == uac
    {
        uac_flags.push("TrustedToAuthForDelegation".to_string());
    }
    if (Flags::PARTIAL_SECRETS_ACCOUNT.bits() | uac) == uac
    {
        uac_flags.push("PartialSecretsAccount".to_string());
    }
    return uac_flags
}