Time decoding for BadPasswordTime

lkarlslund · Dec 10, 2023 · 92c2f16 · 92c2f16
1 parent 0a503ff
commit 92c2f16
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/modules/integrations/activedirectory/attributes.go b/modules/integrations/activedirectory/attributes.go
@@ -17,6 +17,7 @@ var (
 	GroupType                  = engine.NewAttribute("groupType").Tag("AD").Single()
 	MemberOf                   = engine.NewAttribute("memberOf").Tag("AD")
 	Member                     = engine.NewAttribute("member").Tag("AD")
+	BadPasswordTime            = engine.NewAttribute("badPasswordTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	CreationTime               = engine.NewAttribute("creationTime").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	AccountExpires             = engine.NewAttribute("accountExpires").Tag("AD").Type(engine.AttributeTypeTime100NS)
 	RepsTo                     = engine.NewAttribute("repsTo").Tag("AD")

diff --git a/modules/integrations/activedirectory/rawobject.go b/modules/integrations/activedirectory/rawobject.go
@@ -94,11 +94,9 @@ func EncodeAttributeData(attribute engine.Attribute, values []string) engine.Att
 		var attributevalue engine.AttributeValue
 		switch attribute {
 		// Add more things here, like time decoding etc
-		case CreationTime, AccountExpires, PwdLastSet, LastLogon, LastLogonTimestamp, MSmcsAdmPwdExpirationTime:
-			// Just use string encoding
+		case CreationTime, PwdLastSet, LastLogon, LastLogonTimestamp, MSmcsAdmPwdExpirationTime, BadPasswordTime:
 			if intval, err := strconv.ParseInt(value, 10, 64); err == nil {
-				if attribute == PwdLastSet && intval == 0 {
-					// ui.Warn().Msg("PwdLastSet is 0")
+				if intval == 0 {
 					attributevalue = engine.AttributeValueInt(intval)
 				} else {
 					t := util.FiletimeToTime(uint64(intval))
@@ -107,7 +105,7 @@ func EncodeAttributeData(attribute engine.Attribute, values []string) engine.Att
 			} else {
 				ui.Warn().Msgf("Failed to convert attribute %v value %2x to timestamp: %v", attribute.String(), value, err)
 			}
-		case WhenChanged, WhenCreated, DsCorePropagationData,
+		case AccountExpires, WhenChanged, WhenCreated, DsCorePropagationData,
 			MsExchLastUpdateTime, MsExchPolicyLastAppliedTime, MsExchWhenMailboxCreated,
 			GWARTLastModified, SpaceLastComputed: