Make some corrections on UserRightsAssignmentProcessor and SearchResu…

…ltEntryWrapper
SpecterOps · Jul 2, 2024 · ef2b38e · ef2b38e
1 parent e57db76
commit ef2b38e
Show file tree

Hide file tree

Showing 2 changed files with 23 additions and 16 deletions.
diff --git a/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs b/src/CommonLib/Processors/UserRightsAssignmentProcessor.cs
@@ -53,15 +53,15 @@ public async IAsyncEnumerable<UserRightsAssignmentAPIResult> GetUserRightsAssign
             string computerObjectId, string computerDomain, bool isDomainController, string[] desiredPrivileges = null)
         {
             var policyOpenResult = OpenLSAPolicy(computerName);
-            if (policyOpenResult.IsFailed)
+            if (!policyOpenResult.IsSuccess)
             {
                 _log.LogDebug("LSAOpenPolicy failed on {ComputerName} with status {Status}", computerName,
-                    policyOpenResult.SError);
+                    policyOpenResult.Error);
                 await SendComputerStatus(new CSVComputerStatus
                 {
                     Task = "LSAOpenPolicy",
                     ComputerName = computerName,
-                    Status = policyOpenResult.SError
+                    Status = policyOpenResult.Error
                 });
                 yield break;
             }
@@ -109,7 +109,7 @@ await SendComputerStatus(new CSVComputerStatus
                 {
                     _log.LogDebug(
                         "LSAEnumerateAccountsWithUserRight failed on {ComputerName} with status {Status} for privilege {Privilege}",
-                        computerName, policyOpenResult.SError, privilege);
+                        computerName, policyOpenResult.Error, privilege);
                     await SendComputerStatus(new CSVComputerStatus
                     {
                         ComputerName = computerName,

diff --git a/src/CommonLib/SearchResultEntryWrapper.cs b/src/CommonLib/SearchResultEntryWrapper.cs
@@ -2,8 +2,10 @@
 using System.Collections.Generic;
 using System.DirectoryServices.Protocols;
 using System.Linq;
+using System.Runtime.InteropServices;
 using System.Security.Cryptography.X509Certificates;
 using System.Security.Principal;
+using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using SharpHoundCommonLib.Enums;
 
@@ -12,7 +14,7 @@ namespace SharpHoundCommonLib
     public interface ISearchResultEntry
     {
         string DistinguishedName { get; }
-        ResolvedSearchResult ResolveBloodHoundInfo();
+        Task<ResolvedSearchResult> ResolveBloodHoundInfo();
         string GetProperty(string propertyName);
         byte[] GetByteProperty(string propertyName);
         string[] GetArrayProperty(string propertyName);
@@ -37,18 +39,18 @@ public class SearchResultEntryWrapper : ISearchResultEntry
         private const string MSAClass = "msds-managedserviceaccount";
         private readonly SearchResultEntry _entry;
         private readonly ILogger _log;
-        private readonly ILDAPUtils _utils;
+        private readonly ILdapUtilsNew _utils;
 
-        public SearchResultEntryWrapper(SearchResultEntry entry, ILDAPUtils utils = null, ILogger log = null)
+        public SearchResultEntryWrapper(SearchResultEntry entry, ILdapUtilsNew utils = null, ILogger log = null)
         {
             _entry = entry;
-            _utils = utils ?? new LDAPUtils();
+            _utils = utils ?? new LdapUtilsNew();
             _log = log ?? Logging.LogProvider.CreateLogger("SearchResultWrapper");
         }
 
         public string DistinguishedName => _entry.DistinguishedName;
 
-        public ResolvedSearchResult ResolveBloodHoundInfo()
+        public async Task<ResolvedSearchResult> ResolveBloodHoundInfo()
         {
             var res = new ResolvedSearchResult();
 
@@ -76,9 +78,9 @@ public ResolvedSearchResult ResolveBloodHoundInfo()
             string itemDomain;
             if (distinguishedName == null)
             {
-                if (objectId.StartsWith("S-1-"))
+                if (objectId.StartsWith("S-1-") && await _utils.GetDomainNameFromSid(objectId) is (true, var domain))
                 {
-                    itemDomain = _utils.GetDomainNameFromSid(objectId);
+                    itemDomain = domain;
                 }
                 else
                 {
@@ -104,10 +106,12 @@ public ResolvedSearchResult ResolveBloodHoundInfo()
 
             if (WellKnownPrincipal.GetWellKnownPrincipal(objectId, out var wkPrincipal))
             {
-                res.DomainSid = _utils.GetSidFromDomainName(itemDomain);
+                if (await _utils.GetDomainSidFromDomainName(itemDomain) is (true, var sid))
+                    res.DomainSid = sid;
                 res.DisplayName = $"{wkPrincipal.ObjectIdentifier}@{itemDomain}";
                 res.ObjectType = wkPrincipal.ObjectType;
-                res.ObjectId = _utils.ConvertWellKnownPrincipal(objectId, itemDomain);
+                if (await _utils.ConvertLocalWellKnownPrincipal(new SecurityIdentifier(objectId), res.DomainSid, itemDomain) is (true, var principal))
+                    res.ObjectId = principal.ObjectIdentifier;
 
                 _log.LogTrace("Resolved {DN} to wkp {ObjectID}", DistinguishedName, res.ObjectId);
                 return res;
@@ -120,10 +124,12 @@ public ResolvedSearchResult ResolveBloodHoundInfo()
                 }
                 catch
                 {
-                    res.DomainSid = _utils.GetSidFromDomainName(itemDomain);
+                    if (await _utils.GetDomainSidFromDomainName(itemDomain) is (true, var sid))
+                        res.DomainSid = sid;
                 }
             else
-                res.DomainSid = _utils.GetSidFromDomainName(itemDomain);
+                if (await _utils.GetDomainSidFromDomainName(itemDomain) is (true, var sid))
+                    res.DomainSid = sid;
 
             var samAccountName = GetProperty(LDAPProperties.SAMAccountName);
 
@@ -232,7 +238,8 @@ public bool IsDeleted()
 
         public Label GetLabel()
         {
-            return _entry.GetLabel();
+            _entry.GetLabel(out var label);
+            return label;
         }
 
         public string GetSid()