NH-RED-TEAM / RustHound

Active Directory data collector for BloodHound written in Rust. 🦀

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Missing ACE

g0h4n opened this issue · comments

Some ACEs were missing on one of my labs.
The padding was not taken into consideration on the ACE datas part.
And found ACE with null SID like DOMAIN-S-0-0

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-dtyp/628ebb1d-c509-4ea0-a10f-77ef97ca4586

struct ACE {
    uint8   AceType;
    uint8   AceFlags;
    uint16  AceSize;
    char    Data[AceSize - 4];
};

I found my error which was about the size of the data retrieved by RustHound for an ACE.

I changed completely the code of secdesc.rs to fixed the error and to use the new version of nom7 as suricata does to parse the network packet data.