Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User-created Machine Accounts are not parsed properly as Computers #11

Closed
0xb50d opened this issue Jun 18, 2022 · 1 comment
Closed

Comments

@0xb50d
Copy link

0xb50d commented Jun 18, 2022

User-created machine accounts (e.g. with new-adcomputer cmdlet) are not included in the parsed output from AD Explorer snapshot. Per source code, it appears the object is not parsed correctly due to a lack of the "dnshostname" attribute for Computer objects created this way.

dnshostname = ADUtils.get_entry_property(obj, 'dNSHostname')

To replicate :

  • Create an object with "New-ADComputer" (notice the dnshostname attribute is missing)
  • Open in ADExplorer, create snapshot
  • Run parser, check the computer.json file

image

@c3c
Copy link
Owner

c3c commented May 18, 2023

Looking at this, computers without dnshostname are indeed being excluded by

hostname = ADUtils.get_entry_property(entry, 'dNSHostName')
if not hostname:
return

Based on how bloodhound.py does this per https://github.com/fox-it/BloodHound.py/blob/master/bloodhound/ad/computer.py#L82-L85, I'm now using resolve_ad_entry to fill in the hostname.

Commit 9fc8412 should hopefully fix this; closing for now.

@c3c c3c closed this as completed May 18, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants