rusthound_ce/objects/
domain.rs

1use serde_json::value::Value;
2use serde::{Deserialize, Serialize};
3use colored::Colorize;
4use ldap3::SearchEntry;
5use log::{info, debug, trace};
6use std::collections::HashMap;
7use std::error::Error;
8
9use crate::enums::regex::OBJECT_SID_RE1;
10use crate::objects::common::{LdapObject, GPOChange, Link, AceTemplate, SPNTarget, Member};
11use crate::objects::trust::Trust;
12use crate::utils::date::{span_to_string, string_to_epoch};
13use crate::enums::acl::parse_ntsecuritydescriptor;
14use crate::enums::forestlevel::get_forest_level;
15use crate::enums::gplink::parse_gplink;
16use crate::enums::secdesc::LdapSid;
17use crate::enums::sid::sid_maker;
18
19/// Domain structure
20#[derive(Debug, Clone, Deserialize, Serialize, Default)]
21pub struct Domain {
22    #[serde(rename = "Properties")]
23    properties: DomainProperties,
24    #[serde(rename = "GPOChanges")]
25    gpo_changes: GPOChange,
26    #[serde(rename = "ChildObjects")]
27    child_objects: Vec<Member>,
28    #[serde(rename = "Trusts")]
29    trusts: Vec<Trust>,
30    #[serde(rename = "Links")]
31    links: Vec<Link>,
32    #[serde(rename = "Aces")]
33    aces: Vec<AceTemplate>,
34    #[serde(rename = "ObjectIdentifier")]
35    object_identifier: String,
36    #[serde(rename = "IsDeleted")]
37    is_deleted: bool,
38    #[serde(rename = "IsACLProtected")]
39    is_acl_protected: bool,
40    #[serde(rename = "ContainedBy")]
41    contained_by: Option<Member>,
42}
43
44impl Domain {
45    // New domain.
46    pub fn new() -> Self { 
47        Self { ..Default::default() } 
48    }
49
50    // Get access.
51    pub fn object_identifier(&self) -> &String {
52        &self.object_identifier
53    }
54
55    // Mutable access.
56    pub fn properties_mut(&mut self) -> &mut DomainProperties {
57        &mut self.properties
58    }
59    pub fn object_identifier_mut(&mut self) -> &mut String {
60        &mut self.object_identifier
61    }
62    pub fn gpo_changes_mut(&mut self) -> &mut GPOChange {
63        &mut self.gpo_changes
64    }
65    pub fn trusts_mut(&mut self) -> &mut Vec<Trust> {
66        &mut self.trusts
67    }
68
69    /// Function to parse and replace value for domain object.
70    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#domains>
71    pub fn parse(
72        &mut self,
73        result: SearchEntry,
74        domain_name: &str,
75        dn_sid: &mut HashMap<String, String>,
76        sid_type: &mut HashMap<String, String>,
77    ) -> Result<String, Box<dyn Error>> {
78        let result_dn: String = result.dn.to_uppercase();
79        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
80        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
81
82        // Debug for current object
83        debug!("Parse domain: {result_dn}");
84
85        // Trace all result attributes
86        for (key, value) in &result_attrs {
87            trace!("  {key:?}:{value:?}");
88        }
89        // Trace all bin result attributes
90        for (key, value) in &result_bin {
91            trace!("  {key:?}:{value:?}");
92        }
93
94        // Change all values...
95        self.properties.domain = domain_name.to_uppercase();
96        self.properties.distinguishedname = result_dn;
97
98        // Change all values...
99        #[allow(unused_assignments)]
100        let mut sid: String = "".to_owned();
101        let mut global_domain_sid: String = "DOMAIN_SID".to_owned();
102        // With a check
103        for (key, value) in &result_attrs {
104            match key.as_str() {
105                "distinguishedName" => {
106                    // name & domain & distinguishedname
107                    self.properties.distinguishedname = value[0].to_owned().to_uppercase();
108                    let name = value[0]
109                        .split(",")
110                        .filter(|x| x.starts_with("DC="))
111                        .map(|x| x.strip_prefix("DC=").unwrap_or(""))
112                        .collect::<Vec<&str>>()
113                        .join(".");
114                    self.properties.name = name.to_uppercase();
115                    self.properties.domain = name.to_uppercase();
116                }
117                "msDS-Behavior-Version" => {
118                    let level = get_forest_level(value[0].to_string());
119                    self.properties.functionallevel  = level;
120                }
121                "whenCreated" => {
122                    let epoch = string_to_epoch(&value[0])?;
123                    if epoch.is_positive() {
124                        self.properties.whencreated = epoch;
125                    }
126                }
127                "gPLink" => {
128                    self.links = parse_gplink(value[0].to_string())?;
129                }
130                "isCriticalSystemObject" => {
131                    self.properties.highvalue = value[0].contains("TRUE");
132                }
133                // The number of computer accounts that a user is allowed to create in a domain.
134                "ms-DS-MachineAccountQuota" => {
135                    let machine_account_quota = value[0].parse::<i32>().unwrap_or(0);
136                    self.properties.machineaccountquota = machine_account_quota;
137                    if machine_account_quota > 0 {
138                        info!("MachineAccountQuota: {}", machine_account_quota.to_string().yellow().bold());
139                    }
140                }
141                "IsDeleted" => {
142                    self.is_deleted = true;
143                }
144                "msDS-ExpirePasswordsOnSmartCardOnlyAccounts" => {
145                    self.properties.expirepasswordsonsmartcardonlyaccounts = true;
146                }
147                "minPwdLength" => {
148                    self.properties.minpwdlength = value[0].parse::<i32>().unwrap_or(0);
149                }
150                "pwdProperties" => {
151                    self.properties.pwdproperties = value[0].parse::<i32>().unwrap_or(0);
152                }
153                "pwdHistoryLength" => {
154                    self.properties.pwdhistorylength = value[0].parse::<i32>().unwrap_or(0);
155                }
156                "lockoutThreshold" => {
157                    self.properties.lockoutthreshold = value[0].parse::<i32>().unwrap_or(0);
158                }
159                "minPwdAge" => {
160                    self.properties.minpwdage = span_to_string(value[0].parse::<i64>().unwrap_or(0));
161                }
162                "maxPwdAge" => {
163                    self.properties.maxpwdage = span_to_string(value[0].parse::<i64>().unwrap_or(0));
164                }
165                "lockoutDuration" => {
166                    self.properties.lockoutduration = span_to_string(value[0].parse::<i64>().unwrap_or(0));
167                }
168                "lockOutObservationWindow" => {
169                    self.properties.lockoutobservationwindow = value[0].parse::<i64>().unwrap_or(0);
170                }
171                _ => {}
172            }
173        }
174
175        // For all, bins attributes
176        for (key, value) in &result_bin {
177            match key.as_str() {
178                "objectSid" => {
179                    // objectSid raw to string
180                    sid = sid_maker(LdapSid::parse(&value[0]).unwrap().1, domain_name);
181                    self.object_identifier = sid.to_owned();
182
183                    for domain_sid in OBJECT_SID_RE1.captures_iter(&sid) {
184                        self.properties.domainsid = domain_sid[0].to_owned().to_string();
185                        global_domain_sid = domain_sid[0].to_owned().to_string();
186                    }
187
188                    // Data Quality flag
189                    self.properties.collected = true;
190                }
191                "nTSecurityDescriptor" => {
192                    // nTSecurityDescriptor raw to string
193                    let relations_ace = parse_ntsecuritydescriptor(
194                        self,
195                        &value[0],
196                        "Domain",
197                        &result_attrs,
198                        &result_bin,
199                        domain_name,
200                    );
201                    self.aces = relations_ace;
202                }
203                _ => {}
204            }
205        }
206
207        // Push DN and SID in HashMap
208        dn_sid.insert(
209        self.properties.distinguishedname.to_string(),
210        self.object_identifier.to_string()
211        );
212        // Push DN and Type
213        sid_type.insert(
214            self.object_identifier.to_string(),
215            "Domain".to_string(),
216        );
217
218        // Trace and return Domain struct
219        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
220        Ok(global_domain_sid)
221    }
222}
223
224impl LdapObject for Domain {
225    // To JSON
226    fn to_json(&self) -> Value {
227        serde_json::to_value(self).unwrap()
228    }
229
230    // Get values
231    fn get_object_identifier(&self) -> &String {
232        &self.object_identifier
233    }
234    fn get_is_acl_protected(&self) -> &bool {
235        &self.is_acl_protected
236    }
237    fn get_aces(&self) -> &Vec<AceTemplate> {
238        &self.aces
239    }
240    fn get_spntargets(&self) -> &Vec<SPNTarget> {
241        panic!("Not used by current object.");
242    }
243    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
244        panic!("Not used by current object.");
245    }
246    fn get_links(&self) -> &Vec<Link> {
247        &self.links
248    }
249    fn get_contained_by(&self) -> &Option<Member> {
250        &self.contained_by
251    }
252    fn get_child_objects(&self) -> &Vec<Member> {
253        &self.child_objects
254    }
255    fn get_haslaps(&self) -> &bool {
256        &false
257    }
258    
259    // Get mutable values
260    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
261        &mut self.aces
262    }
263    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
264        panic!("Not used by current object.");
265    }
266    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
267        panic!("Not used by current object.");
268    }
269    
270    // Edit values
271    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
272        self.is_acl_protected = is_acl_protected;
273        self.properties.isaclprotected = is_acl_protected;
274    }
275    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
276        self.aces = aces;
277    }
278    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
279        // Not used by current object.
280    }
281    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
282        // Not used by current object.
283    }
284    fn set_links(&mut self, links: Vec<Link>) {
285        self.links = links;
286    }
287    fn set_contained_by(&mut self, contained_by: Option<Member>) {
288        self.contained_by = contained_by;
289    }
290    fn set_child_objects(&mut self, child_objects: Vec<Member>) {
291        self.child_objects = child_objects
292    }
293}
294
295// Domain properties structure
296#[derive(Debug, Clone, Deserialize, Serialize, Default)]
297pub struct DomainProperties {
298    domain: String,
299    name: String,
300    distinguishedname: String,
301    domainsid: String,
302    isaclprotected: bool,
303    highvalue: bool,
304    description: Option<String>,
305    whencreated: i64,
306    machineaccountquota: i32,
307    expirepasswordsonsmartcardonlyaccounts: bool,
308    minpwdlength: i32,
309    pwdproperties: i32,
310    pwdhistorylength: i32,
311    lockoutthreshold: i32,
312    minpwdage: String,
313    maxpwdage: String,
314    lockoutduration: String,
315    lockoutobservationwindow: i64,
316    functionallevel: String,
317    collected: bool
318}
319
320impl DomainProperties {
321    // Mutable access.
322    pub fn domain_mut(&mut self) -> &mut String {
323       &mut self.domain
324    }
325    pub fn name_mut(&mut self) -> &mut String {
326       &mut self.name
327    }
328    pub fn highvalue_mut(&mut self) -> &mut bool {
329        &mut self.highvalue
330     }
331    pub fn distinguishedname_mut(&mut self) -> &mut String {
332        &mut self.distinguishedname
333     }
334}
rusthound_ce/objects/domain.rs

rusthound_ce/objects/
domain.rs
