Add collection of DC reg keys

src/CommonLib/Enums/CollectionMethods.cs

@@ -23,10 +23,11 @@ public enum ResolvedCollectionMethod
         PSRemote = 1 << 14,
         UserRights = 1 << 15,
         CARegistry = 1 << 16,
+        DCRegistry = 1 << 17,
         LocalGroups = DCOM | RDP | LocalAdmin | PSRemote,
-        ComputerOnly = LocalGroups | Session | UserRights | CARegistry,
+        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry,
         DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup,
         Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container,
-        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry
+        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry
     }
 }

src/CommonLib/Processors/DCRegistryProcessor.cs

@@ -0,0 +1,103 @@
+using System;
+using System.Collections.Generic;
+using System.Diagnostics.CodeAnalysis;
+using System.Security.AccessControl;
+using System.Security.Principal;
+using System.Text;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Logging;
+using Microsoft.Win32;
+using SharpHoundCommonLib.Enums;
+using SharpHoundCommonLib.OutputTypes;
+using SharpHoundRPC;
+using SharpHoundRPC.Wrappers;
+
+namespace SharpHoundCommonLib.Processors
+{
+    public class DCRegistryProcessor
+    {
+        private readonly ILogger _log;
+        public readonly ILDAPUtils _utils;
+        public delegate Task ComputerStatusDelegate(CSVComputerStatus status);
+        public event ComputerStatusDelegate ComputerStatusEvent;
+
+
+        public DCRegistryProcessor(ILDAPUtils utils, ILogger log = null)
+        {
+            _utils = utils;
+            _log = log ?? Logging.LogProvider.CreateLogger("DCRegProc");
+        }
+
+        public (bool collected, int value) GetCertificateMappingMethods(string target)
+        {
+            bool collected = false;
+            int value = -1;
+
+            try
+            {
+                var baseKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, target);
+                var key = baseKey.OpenSubKey(
+                    $"SYSTEM\\CurrentControlSet\\Control\\SecurityProviders\\Schannel");
+                if (key == null)
+                {
+                    _log.LogDebug("Registry path for CertificateMappingMethods is null on {Target}", target);
+                }
+                else
+                {
+                    var val = key.GetValue("CertificateMappingMethods");
+                    if (val == null)
+                    {
+                        _log.LogDebug("Registry key for CertificateMappingMethods is null on {Target}", target);
+                    }
+                    else
+                    {
+                        value = (int) val;
+                        collected = true;
+                    }
+                }
+            }
+            catch (Exception e)
+            {
+                _log.LogError(e, "Error getting CertificateMappingMethods on {Target}", target);
+            }
+
+            return (collected, value);
+        }
+
+        public (bool collected, int value) GetStrongCertificateBindingEnforcement(string target)
+        {
+            bool collected = false;
+            int value = -1;
+
+            try
+            {
+                var baseKey = RegistryKey.OpenRemoteBaseKey(RegistryHive.LocalMachine, target);
+                var key = baseKey.OpenSubKey(
+                    $"SYSTEM\\CurrentControlSet\\Services\\Kdc");
+                if (key == null)
+                {
+                    _log.LogDebug("Registry path for StrongCertificateBindingEnforcement is null on {Target}", target);
+                }
+                else
+                {
+                    var val = key.GetValue("StrongCertificateBindingEnforcement");
+                    if (val == null)
+                    {
+                        _log.LogDebug("Registry key for StrongCertificateBindingEnforcement is null on {Target}", target);
+                    }
+                    else
+                    {
+                        value = (int) val;
+                        collected = true;
+                    }
+                }
+            }
+            catch (Exception e)
+            {
+                _log.LogError(e, "Error getting StrongCertificateBindingEnforcement on {Target}", target);
+            }
+
+            return (collected, value);
+        }
+    }
+}