Skip to content
This repository was archived by the owner on Sep 2, 2022. It is now read-only.

Add collection for Remote Management Users #83

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Add collection for Remote Management Users #83

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions Sharphound2/App.config
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,3 +1,3 @@
<?xml version="1.0" encoding="utf-8" ?>
<?xml version="1.0" encoding="utf-8"?>
<configuration>
</configuration>
<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.5"/></startup></configuration>
18 changes: 18 additions & 0 deletions Sharphound2/Enumeration/EnumerationRunner.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -949,6 +949,14 @@ private Task StartListRunner(BlockingCollection<Wrapper<string>> input, Blocking
{
timeout = true;
}
try
{
obj.RemoteManagementUsers = LocalGroupHelpers.GetGroupMembers(full, LocalGroupHelpers.LocalGroupRids.RemoteManagementUsers).ToArray();
}
catch (TimeoutException)
{
timeout = true;
}

try
{
Expand Down Expand Up @@ -1137,6 +1145,16 @@ private Task StartRunner(BlockingCollection<Wrapper<SearchResultEntry>> processQ
timeout = true;
}

try
{
obj.RemoteManagementUsers = LocalGroupHelpers.GetGroupMembers(resolved,
LocalGroupHelpers.LocalGroupRids.RemoteManagementUsers).ToArray();
}
catch (TimeoutException)
{
timeout = true;
}

try
{
foreach (var s in SessionHelpers.GetNetSessions(resolved, domain))
Expand Down
11 changes: 10 additions & 1 deletion Sharphound2/Enumeration/LocalGroupHelpers.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -254,6 +254,9 @@ public static IEnumerable<LocalMember> GetGroupMembers(ResolvedEntry entry, Loca
if (rid.Equals(LocalGroupRids.DcomUsers) && !Utils.IsMethodSet(ResolvedCollectionMethod.DCOM))
yield break;

if (rid.Equals(LocalGroupRids.RemoteManagementUsers) && !Utils.IsMethodSet(ResolvedCollectionMethod.LocalAdmin)) //TODO add proper collection method
yield break;

Utils.Debug("Starting GetSamAdmins");
string machineSid = null;
Utils.Debug("Starting Task");
Expand Down Expand Up @@ -782,6 +785,11 @@ public static IEnumerable<GpoMember> GetGpoMembers(SearchResultEntry entry, stri
Type = x.Type
}).ToArray(),
DcomUsers = resolvedList.Where((x) => x.RID == 562).Select((x) => new LocalMember
{
Name = x.Name,
Type = x.Type
}).ToArray(),
RemoteManagementUsers = resolvedList.Where((x) => x.RID == 580).Select((x) => new LocalMember
{
Name = x.Name,
Type = x.Type
Expand Down Expand Up @@ -848,7 +856,8 @@ internal enum LocalGroupRids
{
Administrators = 544,
RemoteDesktopUsers = 555,
DcomUsers = 562
DcomUsers = 562,
RemoteManagementUsers = 580
}

#region LSA Imports
Expand Down
1 change: 1 addition & 0 deletions Sharphound2/JsonObjects/Computer.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,7 @@ public string Name
public LocalMember[] LocalAdmins { get; set; }
public LocalMember[] RemoteDesktopUsers { get; set; }
public LocalMember[] DcomUsers { get; set; }
public LocalMember[] RemoteManagementUsers { get; set; }
public string[] AllowedToDelegate { get; set; }
public LocalMember[] AllowedToAct { get; set; }
public ACL[] Aces { get; set; }
Expand Down
1 change: 1 addition & 0 deletions Sharphound2/JsonObjects/GpoMember.cs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,5 +6,6 @@ internal class GpoMember : JsonBase
public LocalMember[] RemoteDesktopUsers { get; set; }
public LocalMember[] LocalAdmins { get; set; }
public LocalMember[] DcomUsers { get; set; }
public LocalMember[] RemoteManagementUsers { get; set; }
}
}
8 changes: 6 additions & 2 deletions Sharphound2/Sharphound2.csproj
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,11 @@
<OutputType>Exe</OutputType>
<RootNamespace>Sharphound2</RootNamespace>
<AssemblyName>SharpHound</AssemblyName>
<TargetFrameworkVersion>v3.5</TargetFrameworkVersion>
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<NuGetPackageImportStamp>
</NuGetPackageImportStamp>
<TargetFrameworkProfile />
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
Expand All @@ -22,6 +23,7 @@
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
<Prefer32Bit>false</Prefer32Bit>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<PlatformTarget>AnyCPU</PlatformTarget>
Expand All @@ -31,9 +33,11 @@
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
<Prefer32Bit>false</Prefer32Bit>
</PropertyGroup>
<PropertyGroup>
<ApplicationIcon>favicon.ico</ApplicationIcon>
<ApplicationIcon>
</ApplicationIcon>
</PropertyGroup>
<ItemGroup>
<Reference Include="CommandLine, Version=1.9.71.2, Culture=neutral, PublicKeyToken=de6f01bd326f8c32, processorArchitecture=MSIL">
Expand Down