Improvements for pwn analysis CreateComputer and CreateUser

lkarlslund · Dec 13, 2021 · 81f9141 · 81f9141
1 parent a0c64fa
commit 81f9141
Show file tree

Hide file tree

Showing 3 changed files with 15 additions and 11 deletions.
diff --git a/modules/engine/object.go b/modules/engine/object.go
@@ -57,6 +57,7 @@ const (
 	ObjectTypeComputer
 	ObjectTypeManagedServiceAccount
 	ObjectTypeOrganizationalUnit
+	ObjectTypeBuiltinDomain
 	ObjectTypeContainer
 	ObjectTypeGroupPolicyContainer
 	ObjectTypeCertificateTemplate
@@ -320,6 +321,8 @@ func (o *Object) Type() ObjectType {
 		o.objecttype = ObjectTypeManagedServiceAccount
 	case "Organizational-Unit":
 		o.objecttype = ObjectTypeOrganizationalUnit
+	case "Builtin-Domain":
+		o.objecttype = ObjectTypeBuiltinDomain
 	case "Container":
 		o.objecttype = ObjectTypeContainer
 	case "Computer":

diff --git a/modules/engine/objecttype_enumer.go b/modules/engine/objecttype_enumer.go
diff --git a/modules/integrations/activedirectory/analyze/analyze-ad.go b/modules/integrations/activedirectory/analyze/analyze-ad.go
@@ -219,7 +219,7 @@ func init() {
 			Description: "Permissions that lets someone to create a user object in a container",
 			ObjectAnalyzer: func(o *engine.Object, ao *engine.Objects) {
 				// Only for containers and org units
-				if o.Type() != engine.ObjectTypeContainer && o.Type() != engine.ObjectTypeOrganizationalUnit {
+				if o.Type() != engine.ObjectTypeContainer && o.Type() != engine.ObjectTypeOrganizationalUnit && o.Type() != engine.ObjectTypeBuiltinDomain {
 					return
 				}
 				sd, err := o.SecurityDescriptor()
@@ -257,7 +257,7 @@ func init() {
 			Description: "Permissions that lets someone to create a computer object in a container",
 			ObjectAnalyzer: func(o *engine.Object, ao *engine.Objects) {
 				// Only for containers and org units
-				if o.Type() != engine.ObjectTypeContainer && o.Type() != engine.ObjectTypeOrganizationalUnit {
+				if o.Type() != engine.ObjectTypeContainer && o.Type() != engine.ObjectTypeOrganizationalUnit && o.Type() != engine.ObjectTypeDomainDNS {
 					return
 				}
 				sd, err := o.SecurityDescriptor()