DRAFT: Registry collection

src/CommonLib/ConnectionPoolManager.cs

@@ -7,6 +7,7 @@
 using System.Threading.Tasks;
 using Microsoft.Extensions.Logging;
 using SharpHoundCommonLib.Processors;
+using SharpHoundRPC.PortScanner;
 
 namespace SharpHoundCommonLib {
     internal class ConnectionPoolManager : IDisposable{
@@ -15,12 +16,12 @@ internal class ConnectionPoolManager : IDisposable{
         private readonly string[] _translateNames = { "Administrator", "admin" };
         private readonly ConcurrentDictionary<string, string> _resolvedIdentifiers = new(StringComparer.OrdinalIgnoreCase);
         private readonly ILogger _log;
-        private readonly PortScanner _portScanner;
+        private readonly IPortScanner _portScanner;
 
-        public ConnectionPoolManager(LdapConfig config, ILogger log = null, PortScanner scanner = null) {
+        public ConnectionPoolManager(LdapConfig config, ILogger log = null, IPortScanner scanner = null) {
             _ldapConfig = config;
             _log = log ?? Logging.LogProvider.CreateLogger("ConnectionPoolManager");
-            _portScanner = scanner ?? new PortScanner();
+            _portScanner = scanner;
         }
 
         public IAsyncEnumerable<Result<string>> RangedRetrieval(string distinguishedName,

src/CommonLib/Enums/CollectionMethod.cs

@@ -1,10 +1,8 @@
 using System;
 
-namespace SharpHoundCommonLib.Enums
-{
+namespace SharpHoundCommonLib.Enums {
     [Flags]
-    public enum CollectionMethod
-    {
+    public enum CollectionMethod {
         None = 0,
         Group = 1,
         LocalAdmin = 1 << 1,
@@ -25,10 +23,19 @@ public enum CollectionMethod
         CARegistry = 1 << 16,
         DCRegistry = 1 << 17,
         CertServices = 1 << 18,
+        LdapServices = 1 << 19,
+        WebClientService = 1 << 21,
+        SmbInfo = 1 << 22,
+        EventLogs = 1 << 23,
+        Registry = 1 << 24,
         LocalGroups = DCOM | RDP | LocalAdmin | PSRemote,
-        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry,
-        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices,
-        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices,
-        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry
+        ComputerOnly = LocalGroups | Session | UserRights | CARegistry | DCRegistry | WebClientService | SmbInfo | EventLogs | Registry,
+        DCOnly = ACL | Container | Group | ObjectProps | Trusts | GPOLocalGroup | CertServices | LdapServices | SmbInfo,
+
+        Default = Group | Session | Trusts | ACL | ObjectProps | LocalGroups | SPNTargets | Container | CertServices |
+                  LdapServices | SmbInfo,
+
+        All = Default | LoggedOn | GPOLocalGroup | UserRights | CARegistry | DCRegistry | WebClientService |
+              LdapServices | Registry
     }
 }

src/CommonLib/Enums/EventIds.cs

@@ -0,0 +1,6 @@
+namespace SharpHoundCommonLib.Enums;
+
+public class EventIds {
+    public static int LogonEvent = 4624;
+    public static int ValidateCredentialsEvent = 4776;
+}

src/CommonLib/Enums/LdapErrorCodes.cs

@@ -1,12 +1,12 @@
-namespace SharpHoundCommonLib.Enums
-{
-    public enum LdapErrorCodes : int
-    {
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapErrorCodes : int {
         Success = 0,
+        StrongAuthRequired = 8,
+        SaslBindInProgress = 14,
         InvalidCredentials = 49,
         Busy = 51,
         ServerDown = 81,
         LocalError = 82,
-        KerberosAuthType = 83
+        KerberosAuthType = 83,
     }
 }

src/CommonLib/Enums/LdapOption.cs

@@ -0,0 +1,12 @@
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOption : int {
+        Ssl = 0x0A,
+        ProtocolVersion = 0x11,
+        ResultCode = 0x31,
+        ServerError = 0x33,
+        ServerCertificate = 0x81,
+        Sign = 0x95,
+        Encrypt = 0x96,
+        Timeout = 0x5002,
+    }
+}

src/CommonLib/Enums/LdapOptionValue.cs

@@ -0,0 +1,13 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums {
+    public enum LdapOptionValue : int {
+        Off = 0,
+        On = 1,
+        Version3 = 3,
+    };
+}

src/CommonLib/Enums/LdapSupportedSaslMechanisms.cs

@@ -0,0 +1,14 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+
+namespace SharpHoundCommonLib.Enums {
+    public static class LdapSupportedSaslMechanisms {
+        public const string GSSAPI = "GSSAPI";
+        public const string GSS_SPNEGO = "GSS-SPNEGO";
+        public const string EXTERNAL = "EXTERNAL";
+        public const string DIGEST_MD5 = "DIGEST_MD5";
+    }
+}

src/CommonLib/Extensions.cs

@@ -186,7 +186,7 @@ public static string LdapValue(this Guid s)
         /// <param name="methods"></param>
         /// <returns></returns>
         public static bool IsComputerCollectionSet(this CollectionMethod methods) {
-            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn;
+            const CollectionMethod test = CollectionMethod.ComputerOnly | CollectionMethod.LoggedOn | CollectionMethod.SmbInfo | CollectionMethod.SmbInfo;
             return (methods & test) != 0;
         }
 

src/CommonLib/Impersonate.cs

@@ -4,7 +4,6 @@
 using System.ComponentModel;
 using System.Runtime.InteropServices;
 using System.Security.Principal;
-using System.Xml.Linq;
 
 namespace Impersonate {
     public enum LogonType {
@@ -90,7 +89,7 @@ public class Impersonator : IDisposable {
         ///<param name = "domainName" > Name of the domain.</param>
         ///<param name = "password" > The password. <see cref = "System.String" /></ param >
         ///< param name="logonType">Type of the logon.</param>
-        ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
+        ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></param >
         public Impersonator(string userName, string domainName, string password, LogonType logonType,
             LogonProvider logonProvider) {
             Impersonate(userName, domainName, password, logonType, logonProvider);
@@ -125,10 +124,11 @@ public void Dispose() {
         /// </summary>
         ///<param name = "userName" > Name of the user.</param>
         ///<param name = "domainName" > Name of the domain.</param>
-        ///<param name = "password" > The password. <see cref = "System.String" /></ param >
-        ///< param name="logonType">Type of the logon.</param>
+        ///<param name = "password" > The password. <see cref = "System.String" /></param >
+        ///<param name="logonType">Type of the logon.</param>
         ///<param name = "logonProvider" > The logon provider. <see cref = "Mit.Sharepoint.WebParts.EventLogQuery.Network.LogonProvider" /></ param >
-        public void Impersonate(string userName, string domainName, string password, LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
+        public void Impersonate(string userName, string domainName, string password,
+            LogonType logonType = LogonType.LOGON32_LOGON_INTERACTIVE,
             LogonProvider logonProvider = LogonProvider.LOGON32_PROVIDER_DEFAULT) {
             UndoImpersonation();
 
@@ -149,14 +149,11 @@ public void Impersonate(string userName, string domainName, string password, Log
                             ref logonTokenDuplicate) != 0) {
                         var wi = new WindowsIdentity(logonTokenDuplicate);
                         wi.Impersonate(); // discard the returned identity context (which is the context of the application pool)
-                    }
-                    else
+                    } else
                         throw new Win32Exception(Marshal.GetLastWin32Error());
-                }
-                else
+                } else
                     throw new Win32Exception(Marshal.GetLastWin32Error());
-            }
-            finally {
+            } finally {
                 if (logonToken != IntPtr.Zero)
                     Win32NativeMethods.CloseHandle(logonToken);