rusthound_ce/enums/
sid.rs

1use std::error::Error;
2use log::{trace,error};
3use crate::enums::{secdesc::LdapSid, regex::IS_SID_RE1};
4
5/// Function to check if string is SID
6pub fn is_sid(input: &str) -> Result<bool, Box<dyn Error>> {
7    Ok(IS_SID_RE1.is_match(input))
8}
9
10/// Function to make SID String from ldap_sid struct
11pub fn sid_maker(sid: LdapSid, domain: &str) -> String {
12    trace!("sid_maker before: {:?}",&sid);
13
14    let sub = sid.sub_authority.iter().map(|x| x.to_string()).collect::<Vec<String>>().join("-");
15
16    let result = format!("S-{}-{}-{}", sid.revision, sid.identifier_authority.value[5], sub);
17
18    let final_sid = {
19        if result.len() <= 16 {
20            format!("{}-{}", domain.to_uppercase(), result.to_owned())
21        } else {
22            result
23        }
24    };
25
26    trace!("sid_maker value: {}",final_sid);
27    if final_sid.contains("S-0-0"){
28        error!("SID contains null bytes!\n[INPUT: {:?}]\n[OUTPUT: {}]", &sid, final_sid);
29    }
30
31    final_sid
32}
33
34/// Change SID value to correct format.
35pub fn objectsid_to_vec8(sid: &str) -> Vec<u8>
36{
37    sid.as_bytes().iter().map(|x| *x).collect::<Vec<u8>>()
38}
39
40/// Function to decode objectGUID binary to string value. 
41/// src: <https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/001eec5a-7f8b-4293-9e21-ca349392db40>
42/// Thanks to: <https://github.com/picketlink/picketlink/blob/master/modules/common/src/main/java/org/picketlink/common/util/LDAPUtil.java>
43pub fn _decode_guid(raw_guid: &[u8]) -> String
44{
45    // A byte-based String representation in the form of \[0]\[1]\[2]\[3]\[4]\[5]\[6]\[7]\[8]\[9]\[10]\[11]\[12]\[13]\[14]\[15]
46    // A string representing the decoded value in the form of [3][2][1][0]-[5][4]-[7][6]-[8][9]-[10][11][12][13][14][15].
47    let raw_guid = raw_guid.iter().map(|x| x & 0xFF).collect::<Vec<u8>>();
48    let rev = | x: &[u8] | -> Vec<u8> { x.iter().map(|i| *i).rev().collect::<Vec<u8>>()};
49
50    // Note slice syntax means up to the second number, but not including, so [0..4] is [0, 1, 2, 3] for example.
51    let str_guid = format!(
52        "{}-{}-{}-{}-{}",
53        &hex_push(&raw_guid[0..4]),
54        &hex_push(&rev(&raw_guid[4..6])),
55        &hex_push(&rev(&raw_guid[6..8])),
56        &hex_push(&raw_guid[8..10]),
57        &hex_push(&raw_guid[10..16]),
58    );
59
60    str_guid
61}
62
63/// Function to get a hexadecimal representation from bytes
64/// Thanks to: <https://newbedev.com/how-do-i-convert-a-string-to-hex-in-rust>
65pub fn hex_push(blob: &[u8]) -> String {
66    // For each char in blob, get the capitalised hexadecimal representation (:X) and collect that into a String
67    blob.iter().map(|x| format!("{:X}", x)).collect::<String>()
68}
69
70/// Function to get uuid from bin to string format
71pub fn bin_to_string(raw_guid: &[u8]) -> String
72{
73    // before: e2 49 30 00 aa 00 85 a2 11 d0 0d e6 bf 96 7a ba
74    //         0  1  2  3  4  5  6  7  8  9  10 11 12 13 14 15
75    // after: bf 96 7a ba - 0d e6 - 11 d0 - a2 85 - 00 aa 00 30 49 e2
76    //        12 13 14 15   10 11   8  9    7  6    5  4  3  2  1  0 
77
78    let raw_guid = raw_guid.iter().map(|x| x & 0xFF).collect::<Vec<u8>>();
79    let rev = | x: &[u8] | -> Vec<u8> { x.iter().map(|i| *i).collect::<Vec<u8>>()};
80
81    let str_guid = format!(
82        "{}-{}-{}-{}-{}",
83        &hex_push(&raw_guid[12..16]),
84        &hex_push(&raw_guid[10..12]),
85        &hex_push(&raw_guid[8..10]),
86        &hex_push(&rev(&raw_guid[6..8])),
87        &hex_push(&rev(&raw_guid[0..6]))
88    );
89
90    str_guid
91}
92
93/// Function to decode GUID from binary to string format with correct little-endian handling
94pub fn decode_guid_le(raw_guid: &[u8]) -> String {
95    // Correct GUID format with proper endianness
96    let str_guid = format!(
97        "{:02X}{:02X}{:02X}{:02X}-{:02X}{:02X}-{:02X}{:02X}-{:02X}{:02X}-{:02X}{:02X}{:02X}{:02X}{:02X}{:02X}",
98        raw_guid[3], raw_guid[2], raw_guid[1], raw_guid[0], // Data1 (little-endian)
99        raw_guid[5], raw_guid[4],                           // Data2 (little-endian)
100        raw_guid[7], raw_guid[6],                           // Data3 (little-endian)
101        raw_guid[8], raw_guid[9],                           // Data4 (big-endian)
102        raw_guid[10], raw_guid[11], raw_guid[12], raw_guid[13], raw_guid[14], raw_guid[15] // Data5 (big-endian)
103    );
104
105    str_guid
106}
rusthound_ce/enums/sid.rs

rusthound_ce/enums/
sid.rs
