Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Extraction of password policies and some registry values from the GptTmpl file #52

Closed
wants to merge 15 commits into from

Conversation

0cmenog
Copy link

@0cmenog 0cmenog commented Mar 20, 2023

With this PR, the GptTmpl.inf file is parsed more in depth, to extract:

  • MinimumPasswordAge
  • MaximumPasswordAge
  • MinimumPasswordLength
  • PasswordComplexity
  • PasswordHistorySize
  • ClearTextPassword
  • RequiresServerSMBSigning
  • EnablesServerSMBSigning
  • RequiresClientSMBSigning
  • EnablesClientSMBSigning
  • RequiresLDAPClientSigning
  • LmCompatibilityLevel
    If a key is not found, the field is left empty.
    This extension is triggered with the collection method GPOLocalGroup and the changes are visible in the domains.json and the ous.json files.

@github-actions
Copy link

github-actions bot commented Mar 20, 2023

CLA Assistant Lite bot All contributors have signed the CLA ✍️ ✅

@0cmenog
Copy link
Author

0cmenog commented Mar 20, 2023

I have read the CLA Document and I hereby sign the CLA

@rvazarkar
Copy link
Contributor

This is pretty cool, we've been talking about pulling more info out of GPOs for a while. Will take a look and discuss internally

@0cmenog
Copy link
Author

0cmenog commented May 25, 2023

The extraction of the following lockout policies has been added:

  • LockoutDuration
  • LockoutBadCount
  • ResetLockoutCount
  • ForceLogoffWhenHourExpire

Also, some GPO precedences have been added to visualize the really applied GPO rules:

  • link order (already existing)
  • domain rules applied before the OU ones (already existing)
  • blockInheritance
  • enforced
  • nested OU

Indeed, this PR is related to the BloodHoundAD/BloodHound#672 one, where the main part of the precedences are managed.

@0cmenog 0cmenog changed the base branch from main to v3 October 24, 2023 12:18
@0cmenog 0cmenog mentioned this pull request Oct 30, 2023
8 tasks
@0cmenog
Copy link
Author

0cmenog commented Oct 30, 2023

The PR has been updated once more to add the extraction of:

  • CachedLogonsCount
  • LDAPEnforceChannelBinding

Moreover, the ingestion and the visualization have been implemented in a new PR for the new BloodHound version.

@StephenHinck
Copy link
Contributor

Hello, please see my comment here: SpecterOps/BloodHound#178 (comment)

@github-actions github-actions bot locked and limited conversation to collaborators Feb 28, 2024
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants