rusthound_ce/objects/
group.rs

1use serde::{Deserialize, Serialize};
2use serde_json::value::Value;
3use ldap3::SearchEntry;
4use log::{debug, trace};
5use std::collections::HashMap;
6use std::error::Error;
7
8use crate::enums::regex::OBJECT_SID_RE1;
9use crate::objects::common::{LdapObject, AceTemplate, SPNTarget, Link, Member};
10use crate::enums::acl::parse_ntsecuritydescriptor;
11use crate::enums::secdesc::LdapSid;
12use crate::enums::sid::{objectsid_to_vec8, sid_maker};
13use crate::utils::date::string_to_epoch;
14
15/// Group structure
16#[derive(Debug, Clone, Deserialize, Serialize, Default)]
17pub struct Group {
18    #[serde(rename = "ObjectIdentifier")]
19    object_identifier: String,
20    #[serde(rename = "IsDeleted")]
21    is_deleted: bool,
22    #[serde(rename = "IsACLProtected")]
23    is_acl_protected: bool,
24    #[serde(rename = "Properties")]
25    properties: GroupProperties,
26    #[serde(rename = "Members")]
27    members: Vec<Member>,
28    #[serde(rename = "Aces")]
29    aces: Vec<AceTemplate>,
30    #[serde(rename = "ContainedBy")]
31    contained_by: Option<Member>,
32}
33
34impl Group {
35    // New group.
36    pub fn new() -> Self { 
37        Self { ..Default::default() } 
38    }
39
40    // Immutable access.
41    pub fn members(&self) -> &Vec<Member> {
42        &self.members
43    }
44    pub fn properties(&self) -> &GroupProperties {
45        &self.properties 
46    }
47    pub fn object_identifier(&self) -> &String {
48        &self.object_identifier
49    }
50
51    // Mutable access.
52    pub fn properties_mut(&mut self) -> &mut GroupProperties {
53        &mut self.properties
54    }
55    pub fn object_identifier_mut(&mut self) -> &mut String {
56        &mut self.object_identifier
57    }
58    pub fn members_mut(&mut self) -> &mut Vec<Member> {
59        &mut self.members
60    }
61
62    /// Function to parse and replace value for group object.
63    /// <https://bloodhound.readthedocs.io/en/latest/further-reading/json.html#groups>
64    pub fn parse(
65        &mut self,
66        result: SearchEntry,
67        domain: &str,
68        dn_sid: &mut HashMap<String, String>,
69        sid_type: &mut HashMap<String, String>,
70        domain_sid: &str,
71        schema_guid_map: &HashMap<String, String>,
72    ) -> Result<(), Box<dyn Error>> {
73        let result_dn: String = result.dn.to_uppercase();
74        let result_attrs: HashMap<String, Vec<String>> = result.attrs;
75        let result_bin: HashMap<String, Vec<Vec<u8>>> = result.bin_attrs;
76
77        debug!("Parse group: {result_dn}");
78
79        // Trace all result attributes
80        for (key, value) in &result_attrs {
81            trace!("  {key:?}:{value:?}");
82        }
83        // Trace all bin result attributes
84        for (key, value) in &result_bin {
85            trace!("  {key:?}:{value:?}");
86        }
87
88        // Change all values...
89        self.properties.domain = domain.to_uppercase();
90        self.properties.distinguishedname = result_dn;
91        self.properties.domainsid = domain_sid.to_string();
92
93        // With a check
94        for (key, value) in &result_attrs {
95            match key.as_str() {
96                "name" => {
97                    let name = &value[0];
98                    let email = format!("{}@{}", name.to_owned(), domain);
99                    self.properties.name = email.to_uppercase();
100                }
101                "description" => {
102                    self.properties.description = Some(value[0].to_owned());
103                }
104                "adminCount" => {
105                    let isadmin = &value[0];
106                    let mut admincount = false;
107                    if isadmin == "1" {
108                        admincount = true;
109                    }
110                    self.properties.admincount = admincount;
111                }
112                "sAMAccountName" => {
113                    self.properties.samaccountname = value[0].to_owned();
114                }
115                "member" => {
116                    if !value.is_empty() {
117                        let mut _vec_members: Vec<Member> = Vec::new();
118
119                        for member in value {
120                            let _member = member.trim();
121                            if _member.is_empty() {
122                                continue;
123                            }
124                            if _member.eq_ignore_ascii_case("SID") {
125                                continue;
126                            }
127
128                            let mut m = Member::new();
129                            *m.object_identifier_mut() = _member.to_uppercase();
130                            _vec_members.push(m);
131                        }
132                        
133                        self.members = _vec_members;
134                    }
135                }
136                "objectSid" => {
137                    // objectSid to vec and raw to string
138                    let vec_sid = objectsid_to_vec8(&value[0]);
139                    let sid = sid_maker(LdapSid::parse(&vec_sid).unwrap().1, domain);
140                    self.object_identifier = sid.to_owned();
141
142                    /*let re = Regex::new(r"^S-[0-9]{1}-[0-9]{1}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}-[0-9]{1,}").unwrap();
143                    for domain_sid in re.captures_iter(&sid) 
144                    {
145                        group_json["Properties"]["domainsid"] = domain_sid[0].to_owned().to_string();
146                    }*/
147
148                    // highvalue
149                    if sid.ends_with("-512") 
150                        || sid.ends_with("-516") 
151                        || sid.ends_with("-519") 
152                        || sid.ends_with("-520") 
153                    {
154                        self.properties.highvalue = true;
155                    } else if sid.ends_with("S-1-5-32-544") 
156                        || sid.ends_with("S-1-5-32-548") 
157                        || sid.ends_with("S-1-5-32-549")
158                        || sid.ends_with("S-1-5-32-550") 
159                        || sid.ends_with("S-1-5-32-551")
160                    {
161                        self.properties.highvalue = true;
162                    } else {
163                        self.properties.highvalue = false;
164                    }
165                }
166                "whenCreated" => {
167                    let epoch = string_to_epoch(&value[0])?;
168                    if epoch.is_positive() {
169                        self.properties.whencreated = epoch;
170                    }
171                }
172                "isDeleted" => {
173                    self.is_deleted = true;
174                }
175                _ => {}
176            }
177        }
178
179        // For all, bins attributs
180        for (key, value) in &result_bin {
181            match key.as_str() {
182                "objectSid" => {
183                    // objectSid raw to string
184                    let sid = sid_maker(LdapSid::parse(&value[0]).unwrap().1, domain);
185                    self.object_identifier = sid.to_owned();
186
187                    for domain_sid in OBJECT_SID_RE1.captures_iter(&sid) {
188                        self.properties.domainsid = domain_sid[0].to_owned().to_string();
189                    }
190    
191                    // highvalue
192                    if sid.ends_with("-512") 
193                        || sid.ends_with("-516") 
194                        || sid.ends_with("-519") 
195                        || sid.ends_with("-520") 
196                    {
197                        self.properties.highvalue = true;
198                    }
199                    else if sid.ends_with("S-1-5-32-544") 
200                        || sid.ends_with("S-1-5-32-548") 
201                        || sid.ends_with("S-1-5-32-549")
202                        || sid.ends_with("S-1-5-32-550") 
203                        || sid.ends_with("S-1-5-32-551") 
204                    {
205                        self.properties.highvalue = true;
206                    }
207                    else {
208                        self.properties.highvalue = false;
209                    }
210                }
211                "nTSecurityDescriptor" => {
212                    // nTSecurityDescriptor raw to string
213                    let relations_ace = parse_ntsecuritydescriptor(
214                        self,
215                        &value[0],
216                        "Group",
217                        &result_attrs,
218                        &result_bin,
219                        domain,
220                        schema_guid_map,
221                    );
222                    self.aces = relations_ace;
223                }
224                _ => {}
225            }
226        }
227
228        // Push DN and SID in HashMap
229        dn_sid.insert(
230            self.properties.distinguishedname.to_string(),
231            self.object_identifier.to_string(),
232        );
233        // Push DN and Type
234        sid_type.insert(
235            self.object_identifier.to_string(),
236            "Group".to_string(),
237        );
238
239        // Trace and return Group struct
240        // trace!("JSON OUTPUT: {:?}",serde_json::to_string(&self).unwrap());
241        Ok(())
242    }
243}
244
245impl LdapObject for Group {
246    // To JSON
247    fn to_json(&self) -> Value {
248        serde_json::to_value(self).unwrap()
249    }
250
251    // Get values
252    fn get_object_identifier(&self) -> &String {
253        &self.object_identifier
254    }
255    fn get_is_acl_protected(&self) -> &bool {
256        &self.is_acl_protected
257    }
258    fn get_aces(&self) -> &Vec<AceTemplate> {
259        &self.aces
260    }
261    fn get_spntargets(&self) -> &Vec<SPNTarget> {
262        panic!("Not used by current object.");
263    }
264    fn get_allowed_to_delegate(&self) -> &Vec<Member> {
265        panic!("Not used by current object.");
266    }
267    fn get_links(&self) -> &Vec<Link> {
268        panic!("Not used by current object.");
269    }
270    fn get_contained_by(&self) -> &Option<Member> {
271        &self.contained_by
272    }
273    fn get_child_objects(&self) -> &Vec<Member> {
274        panic!("Not used by current object.");
275    }
276    fn get_haslaps(&self) -> &bool {
277        &false
278    }
279    
280    // Get mutable values
281    fn get_aces_mut(&mut self) -> &mut Vec<AceTemplate> {
282        &mut self.aces
283    }
284    fn get_spntargets_mut(&mut self) -> &mut Vec<SPNTarget> {
285        panic!("Not used by current object.");
286    }
287    fn get_allowed_to_delegate_mut(&mut self) -> &mut Vec<Member> {
288        panic!("Not used by current object.");
289    }
290    
291    // Edit values
292    fn set_is_acl_protected(&mut self, is_acl_protected: bool) {
293        self.is_acl_protected = is_acl_protected;
294        self.properties.isaclprotected = is_acl_protected;
295    }
296    fn set_aces(&mut self, aces: Vec<AceTemplate>) {
297        self.aces = aces;
298    }
299    fn set_spntargets(&mut self, _spn_targets: Vec<SPNTarget>) {
300        // Not used by current object.
301    }
302    fn set_allowed_to_delegate(&mut self, _allowed_to_delegate: Vec<Member>) {
303        // Not used by current object.
304    }
305    fn set_links(&mut self, _links: Vec<Link>) {
306        // Not used by current object.
307    }
308    fn set_contained_by(&mut self, contained_by: Option<Member>) {
309        self.contained_by = contained_by;
310    }
311    fn set_child_objects(&mut self, _child_objects: Vec<Member>) {
312        // Not used by current object.
313    }
314}
315
316// Group properties structure
317#[derive(Debug, Clone, Deserialize, Serialize, Default)]
318pub struct GroupProperties {
319    domain: String,
320    name: String,
321    distinguishedname: String,
322    domainsid: String,
323    isaclprotected: bool,
324    highvalue: bool,
325    samaccountname: String,
326    description: Option<String>,
327    whencreated: i64,
328    admincount: bool,
329}
330
331impl GroupProperties {
332    // Get access.
333    pub fn name(&self) -> &String {
334        &self.name
335    }
336
337    // Mutable access.
338    pub fn name_mut(&mut self) -> &mut String {
339        &mut self.name
340    }
341    pub fn domain_mut(&mut self) -> &mut String {
342        &mut self.domain
343    }
344    pub fn domainsid_mut(&mut self) -> &mut String {
345        &mut self.domainsid
346    }
347    pub fn highvalue_mut(&mut self) -> &mut bool {
348        &mut self.highvalue
349    }
350}
rusthound_ce/objects/group.rs

rusthound_ce/objects/
group.rs
