Skip to content

Commit 02ed16e

Browse files
urangelurangel
authored
fix: update oid property to certtemplateoid to match documentation (#123)
1 parent 6ea0272 commit 02ed16e

4 files changed

Lines changed: 92 additions & 16 deletions

File tree

‎src/CommonLib/Processors/LDAPPropertyProcessor.cs‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -148,14 +148,14 @@ public async Task<UserProperties> ReadUserProperties(ISearchResultEntry entry)
148148
{
149149
var userProps = new UserProperties();
150150
var props = GetCommonProps(entry);
151-
151+
152152
var uacFlags = (UacFlags)0;
153153
var uac = entry.GetProperty(LDAPProperties.UserAccountControl);
154154
if (int.TryParse(uac, out var flag))
155155
{
156156
uacFlags = (UacFlags)flag;
157157
}
158-
158+
159159
props.Add("sensitive", uacFlags.HasFlag(UacFlags.NotDelegated));
160160
props.Add("dontreqpreauth", uacFlags.HasFlag(UacFlags.DontReqPreauth));
161161
props.Add("passwordnotreqd", uacFlags.HasFlag(UacFlags.PasswordNotRequired));
@@ -260,14 +260,14 @@ public async Task<ComputerProperties> ReadComputerProperties(ISearchResultEntry
260260
{
261261
var compProps = new ComputerProperties();
262262
var props = GetCommonProps(entry);
263-
263+
264264
var flags = (UacFlags)0;
265265
var uac = entry.GetProperty(LDAPProperties.UserAccountControl);
266266
if (int.TryParse(uac, out var flag))
267267
{
268268
flags = (UacFlags)flag;
269269
}
270-
270+
271271
props.Add("enabled", !flags.HasFlag(UacFlags.AccountDisable));
272272
props.Add("unconstraineddelegation", flags.HasFlag(UacFlags.TrustedForDelegation));
273273
props.Add("trustedtoauth", flags.HasFlag(UacFlags.TrustedToAuthForDelegation));
@@ -510,7 +510,7 @@ public static Dictionary<string, object> ReadCertTemplateProperties(ISearchResul
510510
props.Add("ekus", ekus);
511511
var certificateApplicationPolicy = entry.GetArrayProperty(LDAPProperties.CertificateApplicationPolicy);
512512
props.Add("certificateapplicationpolicy", certificateApplicationPolicy);
513-
513+
514514
var certificatePolicy = entry.GetArrayProperty(LDAPProperties.CertificatePolicy);
515515
props.Add("certificatepolicy", certificatePolicy);
516516

@@ -543,7 +543,7 @@ public IssuancePolicyProperties ReadIssuancePolicyProperties(ISearchResultEntry
543543
var ret = new IssuancePolicyProperties();
544544
var props = GetCommonProps(entry);
545545
props.Add("displayname", entry.GetProperty(LDAPProperties.DisplayName));
546-
props.Add("oid", entry.GetProperty(LDAPProperties.CertTemplateOID));
546+
props.Add("certtemplateoid", entry.GetProperty(LDAPProperties.CertTemplateOID));
547547

548548
var link = entry.GetProperty(LDAPProperties.OIDGroupLink);
549549
if (!string.IsNullOrEmpty(link))
@@ -621,9 +621,12 @@ private static string[] ParseCertTemplateApplicationPolicies(string[] applicatio
621621
|| applicationPolicies.Length == 0
622622
|| schemaVersion == 1
623623
|| schemaVersion == 2
624-
|| (schemaVersion == 4 && hasUseLegacyProvider)) {
624+
|| (schemaVersion == 4 && hasUseLegacyProvider))
625+
{
625626
return applicationPolicies;
626-
} else {
627+
}
628+
else
629+
{
627630
// Format: "Name`Type`Value`Name`Type`Value`..."
628631
// (https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-crtd/c55ec697-be3f-4117-8316-8895e4399237)
629632
// Return the Value of Name = "msPKI-RA-Application-Policies" entries

‎test/unit/CommonLibHelperTests.cs‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -23,7 +23,7 @@ public void RemoveDistinguishedNamePrefix_ExpectedResult()
2323
"OU=Test\\, OU,OU=Test,DC=Fabrikam,DC=COM");
2424
Assert.Equal("OU=Test,DC=Fabrikam,DC=COM", result);
2525
}
26-
26+
2727
[Fact]
2828
public void SplitGPLinkProperty_ValidPropFilterEnabled_ExpectedResult()
2929
{
@@ -166,7 +166,7 @@ public void StripServicePrincipalName_InValidServicePrincipal_ExpectedHostName()
166166
var actual = SharpHoundCommonLib.Helpers.StripServicePrincipalName(testString);
167167
Assert.Equal(expected, actual);
168168
}
169-
169+
170170
[Fact]
171171
public void StripServicePrincipalName_EmptyHost_Valid()
172172
{
@@ -202,7 +202,7 @@ public void ConvertFileTimeToUnixEpoch_Null_NegativeOne()
202202
Assert.Equal(-1, result);
203203
}
204204

205-
[Fact]
205+
[WindowsOnlyFact]
206206
public void ConvertFileTimeToUnixEpoch_WrongFormat_FortmatException()
207207
{
208208
Exception ex =
@@ -229,7 +229,7 @@ public void ConvertTimestampToUnixEpoch_ValidTimestamp_ValidUnixEpoch()
229229
Assert.Equal(d.ToUniversalTime().Date, testDate);
230230
}
231231

232-
[Fact]
232+
[WindowsOnlyFact]
233233
public void ConvertTimestampToUnixEpoch_InvalidTimestamp_FormatException()
234234
{
235235
Exception ex = Assert.Throws<FormatException>(() =>

‎test/unit/Facades/MockLDAPUtils.cs‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -41,10 +41,10 @@ public string[] GetUserGlobalCatalogMatches(string name)
4141
name = name.ToLower();
4242
return name switch
4343
{
44-
"dfm" => new[] {"S-1-5-21-3130019616-2776909439-2417379446-1105"},
44+
"dfm" => new[] { "S-1-5-21-3130019616-2776909439-2417379446-1105" },
4545
"administrator" => new[]
4646
{"S-1-5-21-3130019616-2776909439-2417379446-500", "S-1-5-21-3084884204-958224920-2707782874-500"},
47-
"admin" => new[] {"S-1-5-21-3130019616-2776909439-2417379446-2116"},
47+
"admin" => new[] { "S-1-5-21-3130019616-2776909439-2417379446-2116" },
4848
_ => Array.Empty<string>()
4949
};
5050
}
@@ -1021,7 +1021,8 @@ public TypedPrincipal ResolveDistinguishedName(string dn)
10211021
"S-1-5-21-3130019616-2776909439-2417379446-2106", Label.User),
10221022
"CN=KRBTGT,CN=USERS,DC=TESTLAB,DC=LOCAL" => new TypedPrincipal(
10231023
"S-1-5-21-3130019616-2776909439-2417379446-502", Label.User),
1024-
_ => null
1024+
"CN=ENTERPRISE KEY ADMINS,CN=USERS,DC=ESC10,DC=LOCAL" => new TypedPrincipal("S-1-5-21-3662707843-2053279151-3839588741-527", Label.Group),
1025+
_ => null,
10251026
};
10261027
}
10271028

@@ -1064,7 +1065,7 @@ public string BuildLdapPath(string dnPath, string domain)
10641065

10651066
private Group GetBaseEnterpriseDC()
10661067
{
1067-
var g = new Group {ObjectIdentifier = "TESTLAB.LOCAL-S-1-5-9".ToUpper()};
1068+
var g = new Group { ObjectIdentifier = "TESTLAB.LOCAL-S-1-5-9".ToUpper() };
10681069
g.Properties.Add("name", "ENTERPRISE DOMAIN CONTROLLERS@TESTLAB.LOCAL".ToUpper());
10691070
return g;
10701071
}

‎test/unit/LDAPPropertyTests.cs‎

Lines changed: 72 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -770,6 +770,78 @@ public void LDAPPropertyProcessor_ReadCertTemplateProperties()
770770

771771
}
772772

773+
[Fact]
774+
public void LDAPPropertyProcessor_ReadIssuancePolicyProperties()
775+
{
776+
var mock = new MockSearchResultEntry("CN\u003d6250993.11BB1AB25A8A65E9FCDF709FCDD5FBC6,CN\u003dOID,CN\u003dPUBLIC KEY SERVICES,CN\u003dSERVICES,CN\u003dCONFIGURATION,DC\u003dESC10,DC\u003dLOCAL",
777+
new Dictionary<string, object>
778+
{
779+
{"domain", "ESC10.LOCAL"},
780+
{"name", "KEYADMINSOID@ESC10.LOCAL"},
781+
{"domainsid", "S-1-5-21-3662707843-2053279151-3839588741"},
782+
{"description", null},
783+
{"whencreated", 1712567279},
784+
{"displayname", "KeyAdminsOID"},
785+
{"certtemplateoid", "1.3.6.1.4.1.311.21.8.4571196.1884641.3293620.10686285.12068043.134.1.30"},
786+
{"msds-oidtogrouplink", "CN=ENTERPRISE KEY ADMINS,CN=USERS,DC=ESC10,DC=LOCAL"}
787+
,
788+
}, "1E5311A8-E949-4E02-8E08-234ED63200DE", Label.IssuancePolicy);
789+
790+
var mockLDAPUtils = new MockLDAPUtils();
791+
var ldapPropertyProcessor = new LDAPPropertyProcessor(mockLDAPUtils);
792+
793+
794+
var test = ldapPropertyProcessor.ReadIssuancePolicyProperties(mock);
795+
var keys = test.Props.Keys;
796+
797+
//These are not common properties
798+
Assert.DoesNotContain("domain", keys);
799+
Assert.DoesNotContain("name", keys);
800+
Assert.DoesNotContain("domainsid", keys);
801+
802+
Assert.Contains("description", keys);
803+
Assert.Contains("whencreated", keys);
804+
Assert.Contains("displayname", keys);
805+
Assert.Contains("certtemplateoid", keys);
806+
Assert.Contains("oidgrouplink", keys);
807+
}
808+
809+
[Fact]
810+
public void LDAPPropertyProcessor_ReadIssuancePolicyProperties_NoOIDGroupLink()
811+
{
812+
var mock = new MockSearchResultEntry("CN\u003d6250993.11BB1AB25A8A65E9FCDF709FCDD5FBC6,CN\u003dOID,CN\u003dPUBLIC KEY SERVICES,CN\u003dSERVICES,CN\u003dCONFIGURATION,DC\u003dESC10,DC\u003dLOCAL",
813+
new Dictionary<string, object>
814+
{
815+
{"domain", "ESC10.LOCAL"},
816+
{"name", "KEYADMINSOID@ESC10.LOCAL"},
817+
{"domainsid", "S-1-5-21-3662707843-2053279151-3839588741"},
818+
{"description", null},
819+
{"whencreated", 1712567279},
820+
{"displayname", "KeyAdminsOID"},
821+
{"certtemplateoid", "1.3.6.1.4.1.311.21.8.4571196.1884641.3293620.10686285.12068043.134.1.30"},
822+
{"msds-oidtogrouplink", null}
823+
,
824+
}, "1E5311A8-E949-4E02-8E08-234ED63200DE", Label.IssuancePolicy);
825+
826+
var mockLDAPUtils = new MockLDAPUtils();
827+
var ldapPropertyProcessor = new LDAPPropertyProcessor(mockLDAPUtils);
828+
829+
830+
var test = ldapPropertyProcessor.ReadIssuancePolicyProperties(mock);
831+
var keys = test.Props.Keys;
832+
833+
//These are not common properties
834+
Assert.DoesNotContain("domain", keys);
835+
Assert.DoesNotContain("name", keys);
836+
Assert.DoesNotContain("domainsid", keys);
837+
Assert.DoesNotContain("oidgrouplink", keys);
838+
839+
Assert.Contains("description", keys);
840+
Assert.Contains("whencreated", keys);
841+
Assert.Contains("displayname", keys);
842+
Assert.Contains("certtemplateoid", keys);
843+
}
844+
773845
[Fact]
774846
public void LDAPPropertyProcessor_ParseAllProperties()
775847
{

0 commit comments

Comments
 (0)